GDPR and Call Recording: What Businesses Need to Know

Every recorded phone call that includes a person's voice counts as personal data under UK GDPR, which means it comes with the same obligations as any other personal information a business holds — a lawful basis for processing it, appropriate security, defined retention periods, and respect for the individual's data rights. This applies whether the call was recorded automatically by your phone system or manually by a member of staff, and regardless of whether the caller was told in advance.

For the broader question of whether recording calls is legal in the first place, see our guide to is call recording legal in the UK. This article focuses specifically on what GDPR requires once a recording exists.

Why Call Recordings Count as Personal Data

A recording of someone's voice, combined with whatever's discussed during the call, almost always identifies them or relates directly to them — which is exactly what GDPR defines as personal data. This applies even to internal calls between colleagues, not just customer-facing ones.

What Lawful Basis Can You Rely On?

Every use of personal data needs a lawful basis under GDPR, and businesses have a few realistic options for call recording:

• Legitimate interests — the most common basis for routine business call recording, provided the business can show recording is necessary and proportionate, and doesn't override the individual's own interests or rights
• Legal obligation — relevant where recording is required by a specific regulatory framework, such as in financial services
• Consent — sometimes used, though it comes with the requirement that consent must be freely given and genuinely withdrawable, which doesn't always suit routine business recording well

Most businesses recording calls for training, quality, or dispute resolution purposes rely on legitimate interests, documenting why the recording is necessary as part of their own compliance records.

What Are Your Core GDPR Obligations?

• Purpose limitation — only record calls for the reasons you've identified, and don't repurpose recordings for something unrelated later without reconsidering the lawful basis
• Data minimisation — don't record more than necessary; some businesses selectively record only certain call types rather than everything by default
• Security — recordings need to be stored securely, with access limited to people who genuinely need it, not open to the whole organisation by default
• Retention limits — recordings can't be kept indefinitely; our guide to how long to keep recorded calls covers practical retention periods
• Transparency — callers should generally be made aware recording may happen, even where explicit consent isn't strictly required; our guide on telling customers about call recording covers this specifically

Handling Sensitive or Special Category Information

Calls sometimes drift into more sensitive territory than businesses plan for — health information, financial details, or other special category data under GDPR, which carries stricter requirements than ordinary personal data. It's worth training staff to be aware of this, particularly in sectors like healthcare, financial services, or recruitment, where sensitive information is more likely to come up naturally during a call.

Where Are Your Recordings Stored?

Where call recordings are physically stored matters under GDPR, particularly if your phone system or call recording platform stores data outside the UK or EU. Transfers to countries without an adequacy decision need additional safeguards in place. It's worth checking with your phone system provider exactly where recordings are stored and processed, rather than assuming.

What Rights Do Callers Have Over Their Recording?

Individuals have the same GDPR rights over a call recording as they do over any other personal data a business holds about them, including the right to request a copy (a subject access request), and in some circumstances, the right to have it deleted. Businesses need a practical way to locate and retrieve a specific individual's recordings if asked, which is worth thinking through before a request actually arrives rather than during one.

Do You Need a Data Protection Impact Assessment?

A Data Protection Impact Assessment (DPIA) is generally required where processing is likely to result in high risk to individuals — large-scale systematic call recording, particularly involving special category data, can fall into this category. Smaller businesses recording calls for standard quality and training purposes may not need a full DPIA, but it's worth assessing this rather than assuming it doesn't apply.

ICO Registration

Most UK businesses processing personal data, including call recordings, need to be registered with the Information Commissioner's Office (ICO) and pay the relevant data protection fee, unless a specific exemption applies. This is a separate requirement from the recording itself, but one that's easy to overlook when the focus is on the phone system rather than the wider data protection picture.

Frequently Asked Questions

Do I need a different lawful basis for recording sales calls versus support calls? Not necessarily a different basis, but it's worth documenting the specific reason for each type of recording separately, since "necessary and proportionate" can look different depending on the purpose.

Can I record calls for training purposes without telling staff? This carries meaningful risk. Staff have their own reasonable expectations around workplace monitoring, and being transparent about recording internal calls is generally expected good practice, not just an external customer consideration.

What happens if a customer asks me to delete their call recording? You'll need to assess the request against your retention policy and lawful basis — in many cases, the recording should be deleted, though there can be legitimate reasons to retain it longer, such as an ongoing dispute or legal requirement.

Does GDPR apply differently to VoIP call recordings than traditional phone system recordings? No, the underlying GDPR obligations are the same regardless of the technology used to make and record the call.

Getting call recording set up compliantly from the start avoids a much bigger headache later. Request a quote if you'd like T2K to advise on a compliant setup, or read our guide to is call recording legal in the UK for the wider legal picture.