Bringing call recording up to GDPR standard

The client, a financial services firm required by FCA rules to record client-facing calls, had been recording for years without a documented retention policy, a clear lawful basis for every call type, or a way to action a data subject's request to access or delete their recording. The setup worked day-to-day but left the business exposed to ICO penalties of up to 17.5 million or 4% of global turnover.

PurpleBox reviewed every category of call being recorded and matched it to the correct lawful basis - explicit consent for marketing, training and quality assurance calls, and clear notification for calls covered by contract fulfilment or regulatory requirement. We moved recordings into encrypted storage with restricted access, built a five-year retention schedule to match FCA requirements, added transparent recording disclaimers to the call flow, and set up a straightforward process for handling data access and deletion requests within the required one-month window.

The client can now demonstrate a documented, compliant call recording process end-to-end - from the disclaimer a customer hears at the start of a call through to how long that recording is kept and how a deletion request gets actioned. Regular compliance reviews are now built into the schedule rather than left until a request or audit forces the issue.