EmpfangoThe short answer
A sick call by phone is permissible under the GDPR as long as only the fact and expected duration of the absence are captured, the announcement is clear and a deletion policy is in place.
That applies to an office clerk just as much as to an AI phone assistant. The difference: an assistant asks the same fields every time and notes nothing that is not intended. This article sets out which data may be captured in a sick call, on which legal basis, and how the announcement, retention periods and data processing agreements fit in. It is not legal advice; agree the implementation with your data protection officer.
For cleaning companies the topic is anything but abstract. The BIV autumn survey 2024 reports a higher sickness rate at 71.3 % of companies since sick notes by phone were introduced, and cleaning tops the statistics of all occupational groups with 29.1 sick days per employee in Bavaria (bkvfirmenservice.de, secondary source, as of 10/2026). Each of these calls reaches the site manager by phone early in the morning.
What may be captured in a sick call
What is allowed is what the employer needs for continued pay and scheduling: name, the fact of incapacity for work, the expected duration, site and callback number. Diagnosis, symptoms and the doctor's name are not part of it.
The basis is Section 5(1) of the German Continued Remuneration Act (EFZG): the employee must report the incapacity for work and its expected duration without delay. The law requires nothing more. Anything beyond these details is health data under Art. 9(1) GDPR without a recognisable purpose, and the principle of data minimisation in Art. 5(1)(c) GDPR argues against capturing it at all.
The table shows the fields a phone assistant should ask for in a sick call, and those it deliberately leaves out.
| Data field | Allowed? | Reason |
|---|---|---|
| Name and employee number | Yes | Assignment to the employee (Section 26 BDSG); no report without identification |
| Fact of incapacity for work | Yes | Reporting duty under Section 5(1) EFZG; health data, but necessary to fulfil employment-law obligations |
| Expected duration | Yes | Section 5(1) EFZG names the duration explicitly; needed for arranging cover |
| Site, place of work, shift start | Yes | Not health data; needed so the operations lead can organise cover |
| Callback number | Yes | Contact detail for follow-up questions; data minimisation: one number only |
| Diagnosis, symptoms, condition | No | No purpose under the EFZG; Art. 9(1) GDPR; the assistant does not ask and does not carry over free text about it |
| Treating doctor, practice | No | Not required; the employer retrieves the sick certificate electronically from the health insurer (eAU) |
| Child ill instead of employee ill | Category only | Relevant for leave under Section 45 SGB V; capture no details about the child |
Legal basis: Art. 9(2)(b) GDPR and Section 26 BDSG
Processing a sick call is usually based on Art. 9(2)(b) GDPR in conjunction with Section 26(3) of the German Federal Data Protection Act (BDSG): health data may be processed where necessary to exercise obligations under employment law.
Continued pay, scheduling and the report to the health insurer are such obligations. You do not need the employee's consent for this, and you should not ask for it: consent in an employment relationship is rarely freely given and can be withdrawn at any time. The legal basis applies regardless of whether a human or an assistant answers the call.
Two points still belong on the list for your data protection officer. First, the information duty under Art. 13 GDPR, usually met through the employee privacy notice plus a note that sick calls to the company number are answered by an AI assistant. Second, the record of processing activities, in which the phone assistant is listed as a procedure. The EU AI Act adds to this: since 2 August 2026 callers must be able to tell that they are talking to an AI.
Section 201 Criminal Code: the announcement before the first word
Section 201 of the German Criminal Code (StGB) makes it an offence to record the non-public spoken word without the consent of everyone involved; a sick call must therefore never be recorded covertly.
The safest option is not to store audio permanently at all. A transcript with a summary is not a sound recording and is sufficient for scheduling and as evidence. Empfango works exactly this way by default: every call begins with a fixed announcement, not worded by the language model, that an AI is speaking and how the call is processed. Call audio is not stored permanently; transcript and summary are in the dashboard.
If you absolutely need recordings, for example because of internal rules, then only with consent that is obtained and documented before the recording starts. Whether a mere announcement followed by continuing the call counts as consent is disputed. For employee calls there is the added point that consent in an employment relationship needs particular justification. When in doubt: no recording.
Retention periods and deletion policy
A deletion policy defines for each type of data how long it is kept and who deletes it; for sick calls the rule is: transcript short, payroll records for the statutory period.
In practice that means three periods. The call transcript is a working tool: once the operations lead has taken over the absence and entered it in the roster or personnel file, it has served its purpose. Many companies set 30 to 90 days here. The absence itself remains in the payroll records, which are subject to social-security and tax retention periods. The WhatsApp or email notification to the site manager is a copy and should fall under the same period as the transcript.
Check three things with the provider: can transcripts be deleted individually and by retention period? Is audio stored at all? And is the period stated in the privacy policy? For Empfango you will find the details under privacy. What a sick call looks like with Empfango, from the announcement to notifying the site manager, is shown on the solution page capture sick calls by phone.
DPA and sub-processors: what to require from the provider
An AI phone assistant is a processor under Art. 28 GDPR; without a data processing agreement it may not take a single sick call.
The DPA must name every sub-processor that handles speech: speech recognition, language model, speech synthesis, telephony. With health data you should additionally ask where each of these services runs. Empfango runs the language model via Azure OpenAI in the EU and speech recognition via Deepgram with EU processing; ElevenLabs for speech synthesis is a US provider and is bound by a DPA with standard contractual clauses. The full list is published in the DPA and in the privacy policy.
For cleaning companies this means in practice: put the DPA and the sub-processor list in front of your data protection officer before the first sick call runs through the assistant. What else Empfango handles for cleaning companies, from complaints to quote requests, is on the industry page.
Frequently asked questions
No. It asks that and until when someone is absent. If the employee volunteers a diagnosis, it should not be carried over into the summary. Configure the assistant so that it neither asks for nor notes health details.
Not for the sick call itself; the legal basis is Art. 9(2)(b) GDPR with Section 26 BDSG. You must however inform employees (Art. 13 GDPR) and, if there is a works council, check whether co-determination under Section 87(1) no. 6 of the Works Constitution Act applies.
No. A transcript with timestamp and summary is sufficient as evidence that and when the report came in. An audio recording additionally creates a risk under Section 201 StGB and one more piece of health data.
As long as scheduling and follow-up questions require. Set a period in the deletion policy, many companies choose 30 to 90 days, and delete automatically. The absence remains in the payroll records regardless.
Conclusion
A sick call by phone is compatible with the GDPR when four things are right: only the details required by Section 5 EFZG, a documented legal basis, a clear announcement about AI and recording, and a deletion period for transcripts. With an assistant that fixes these fields in advance, this is easier to comply with than with a note on the site manager's desk. It does not replace the review by your data protection officer.