GDPR and recording business phone calls in the UK

Recording business calls is legal in the UK, and for some firms it is required. But a recording of a call is personal data. That means UK GDPR applies to why you record, what you tell people, where recordings are stored, how long you keep them and how you respond when someone asks for a copy.

This guide covers the rules that apply to most UK businesses, plus the extra requirements for FCA-regulated firms and businesses that take card payments by phone.

Key takeaways

• You can record business calls, but you need a lawful basis for each type of call you record.
• You must tell callers they are being recorded, and why, at or before the start of the call.
• Recordings must be stored securely, with access limited to people who need it.
• Set a retention period and delete recordings when it ends. FCA firms usually keep recordings for at least five years.
• Never record card details. Pause recording or use a secure payment method.
• People can ask for a copy of their recording. You normally have one month to respond.

Which laws apply to call recording in the UK?

Three sets of rules work together:

• UK GDPR and the Data Protection Act 2018 govern how you handle the recordings as personal data.
• The Investigatory Powers Act 2016, and the regulations made under it for businesses, set out when a business may lawfully record calls on its own system, for example to keep records of transactions, check compliance or prevent crime.
• Sector rules. The FCA requires many investment and trading firms to record relevant calls (SYSC 10A). PCI DSS applies if you take card payments over the phone.

The Information Commissioner's Office (ICO) enforces data protection. Fines under UK GDPR can reach £17.5 million or 4% of annual global turnover, whichever is higher.

Choosing a lawful basis for recording calls

You need a lawful basis under Article 6 of UK GDPR for each purpose. Most businesses use one of these:

If you rely on legitimate interests, write down a short legitimate interests assessment: why you need the recordings, whether you could achieve the same thing without recording, and how you protect the caller's interests.

Consent is harder to rely on than it looks. It must be freely given and can be withdrawn at any time, which means you need a way to stop recording when someone says no.

What you must tell callers

Tell people at the start of the call that it may be recorded and why. A short recorded message works for inbound calls, for example:

"Calls are recorded for training, quality and record-keeping purposes. For more information see our privacy notice at [your website]."

For outbound calls, staff should say it at the start. Your privacy notice should then explain the purposes, the lawful basis, how long recordings are kept, who can access them and how to request a copy.

Storing call recordings securely

Recordings often contain sensitive information, so treat them like any other confidential file:

• store them encrypted, in the UK or with appropriate safeguards if stored abroad
• restrict access by role, and use multi-factor authentication
• keep an audit log of who listens to or downloads recordings
• make sure your phone system provider is covered by a data processing agreement

How long should you keep call recordings?

Keep recordings only as long as you need them for the purpose you recorded them for. Set a written retention period and automate deletion where you can.

• FCA-regulated firms: usually at least five years, and up to seven if the FCA asks.
• Training and quality: often a few months is enough.
• Disputes and complaints: keep the relevant recordings until the matter is closed and any limitation period has passed.

Taking card payments over the phone (PCI DSS)

You must not store card numbers or security codes in call recordings. The usual solutions are:

• pause and resume recording while card details are given (automated is better than manual)
• DTMF masking, where the caller types their card number on the keypad and the tones are hidden from the agent and the recording
• sending a secure payment link instead of taking details by voice

Handling requests for call recordings

People can make a subject access request for recordings of their calls. You normally have one month to respond. You also need to be able to find a specific recording, and in some cases delete it. Make sure your phone system lets you search recordings by number and date, and export them.

A quick compliance checklist

• Lawful basis documented for each type of recorded call
• Recording message on inbound lines and a script for outbound calls
• Privacy notice updated
• Recordings encrypted, with role-based access and MFA
• Written retention period, with automatic deletion
• Card details never recorded
• Process for finding, exporting and deleting recordings on request
• Data processing agreement in place with your phone provider

How PurpleBox can help

We set up business phone systems with compliant call recording built in: the announcement, encrypted storage, access controls, retention rules and the ability to find a recording quickly when someone asks. See how we did this for an FCA-regulated firm in our case study.

Case study: GDPR-compliant call recording for a financial services firm · Business communications · Request a callback

Frequently asked questions

This guide is general information, not legal advice. For decisions about your own business, take advice from a qualified data protection professional.