Call recording and GDPR: what to know before you hit record

Why call recording falls under GDPR

Call recording falls under GDPR, Regulation (EU) 2016/679, because a person’s voice, their phone number and what they say on the call are all personal data. Recording, storing, listening, downloading, transcribing and deleting an audio file are all processing operations. It makes no difference whether you use a desk recorder, an on-site PBX or a cloud phone system: the rules are the same. If you operate in the UK, the UK GDPR and the Data Protection Act 2018 follow very similar principles.

Every phone call involves at least two people. On one side is the customer, supplier or prospect who calls you or whom you call; on the other is your agent, usually an employee or contractor. Both are data subjects, and for both you need to be able to explain why you record, what you do with the recordings and how long you keep them.

This guide sets out general principles and is not legal advice. The right choices depend on your industry, the country you operate in, the kind of calls you handle and your employment contracts. Before you switch recording on, talk to your privacy adviser, your Data Protection Officer if you have one, or a lawyer who specialises in data protection.

The Article 5 principles applied to recorded calls

Article 5 of GDPR lists the principles that apply to all processing. Applied to call recording, they turn into very practical questions worth answering before you flip any switch.

• Lawfulness, fairness and transparency: do you have a valid lawful basis, and does the person on the line know the call is being recorded?
• Purpose limitation: do you use recordings only for the stated purposes, such as service quality or proof of an order, and nothing else?
• Data minimisation: do you record only the calls that serve that purpose, or everything out of habit?
• Accuracy: is each recording linked to the right call, with the correct date, number and agent?
• Storage limitation: have you set how long to keep recordings, and do you actually delete them when that time is up?
• Integrity and confidentiality: who can listen, where are the files stored and how are they protected?
• Accountability: can you show the choices you made, with documents and settings that match?

Lawful basis: what your call recording rests on

Article 6 of GDPR provides six lawful bases: consent, performance of a contract or steps before entering one, legal obligation, vital interests, public task and legitimate interests. Each purpose of recording needs one of them, and you have to pick it before you start, not afterwards.

Consent looks like the easy option but has limits: it has to be freely given, specific, informed and withdrawable at any time, and if the customer says no you need to be able to handle the call without recording it. That’s why many businesses look at other bases, such as legitimate interests for training and quality monitoring, or contract when the recording documents an order. Legitimate interests, however, requires a written balancing test between your interest and people’s rights, and the person recorded can object.

Some sectors are required to record by specific rules, certain financial services for example, and there the basis is legal obligation. For employees the picture is different again: the employment relationship means consent is rarely truly free, and national rules on monitoring workers come on top, as covered further down.

Call recording privacy notice: what to say and when

Article 13 of GDPR requires you to inform people at the time you collect their data. On a phone call that means telling them before recording starts, or at the latest at the start of the conversation. A notice buried on a website page nobody reads is not enough on its own.

In practice a layered approach is common. The first layer is a short spoken message at the start of the call: it says the call may be recorded, why, and where to find the full privacy notice. The second layer is the full notice, published on your website or sent on request, with everything Article 13 requires.

• Who the controller is and how to contact them, plus your DPO’s contact details if you have appointed one.
• The purposes of recording and the lawful basis for each, with the legitimate interest described if you rely on it.
• Who receives the recordings, including suppliers who process them on your behalf.
• Any transfers outside the European Economic Area.
• How long you keep recordings, or the criteria used to decide.
• People’s rights: access, rectification, erasure, restriction, objection, and the right to complain to a supervisory authority, such as the Garante in Italy or the ICO in the UK.
• How to withdraw consent, if consent is your basis.

Recording your agents’ calls: employment rules

When you record calls, you also record your agents’ work. On top of GDPR, national laws on monitoring employees may apply. In Italy the key reference is Article 4 of the Workers’ Statute, Law 300 of 1970, which governs tools that may also allow remote monitoring of employees’ activity and, in many cases, requires an agreement with worker representatives or authorisation from the labour inspectorate.

How rules like these apply to call recording depends on how work is organised, what you record and how the files are used, and it’s a question for an employment lawyer or adviser in your country. Other countries have different rules with the same spirit: workers should know they are recorded, why, and how the recordings will be used.

Employees need their own clear privacy notice, separate from the one for customers. It helps to set out in an internal policy who can listen to recordings, for what reasons, and whether they may be used to assess performance. An agent who finds out afterwards that their calls were being reviewed to grade them is both a legal problem and a trust problem.

How long to keep call recordings

GDPR doesn’t set a number of days that works for everyone. It asks you to keep data only as long as the purpose requires, and to be able to explain why. A recording used to train agents is needed for a short time; a recording that proves an agreement may be needed for longer, as long as that agreement could be disputed. If your sector has its own rules, those apply.

The most common mistake is not deciding at all: recordings pile up for years, nobody listens to them, yet they remain a risk in a data breach and a burden when someone asks to see their data. A written retention period applied automatically is far easier to defend than manual clean-ups done whenever someone remembers.

In Robottino you set retention in your Profile, anywhere from 1 to 3650 days, with 30 days if you don’t change it. Every night, recordings older than that are deleted and can’t be recovered. Leaving the field empty keeps them until you delete them yourself, which you should only do with a specific reason.

1. List your purposes

   For each reason you record, ask how long you really need the file.

2. Pick a period

   Choose the shortest period that fits the purpose and any sector rules.

3. Automate it

   Set retention in your system so deletion happens without anyone remembering to do it.

4. Cover the copies

   Backups, downloaded files and external archives must follow the same rule, or deletion is only on paper.

5. Put it in the notice

   State the period or the criteria in your privacy notice and your record of processing.

Access, security and suppliers: who can listen to what

Article 32 of GDPR requires security appropriate to the risk. For call recordings the key questions are where the files are stored, who can listen and what happens once they are downloaded. An MP3 file on a shared desktop or attached to an internal email escapes every retention rule you set.

With a cloud phone system, the provider processes recordings on your behalf and is usually a processor under Article 28. You need a written agreement covering what they may do with the data, the security measures and any sub-processors. Check where the servers are, too. If you are weighing up a switch, the guide on cloud versus on-premise phone systems helps you line up the differences.

In Robottino recordings sit in private storage and can only be played through the portal, never through a public link. In the Calls report, recorded calls show a microphone icon, and the call detail lets you download them as MP3. The backup feature can copy them to your own FTP, FTPS or SFTP server or an S3 bucket; from then on, retention and security of those copies are your responsibility, because the backup never deletes files it has already copied.

• Give only a few people permission to listen to and download recordings.
• Avoid downloading files when listening in the portal is enough.
• Apply the same retention period to your backup copies.
• Keep track of who has access in your record of processing activities under Article 30.

Data subject rights, AI and impact assessments

Anyone who has been recorded can make a subject access request under Article 15, which includes a copy of the recording. You must reply without undue delay and normally within one month, which Article 12 allows you to extend in certain cases. To answer, you have to be able to find the calls from a given number, and a report you can filter by number and date makes that much easier. Watch out for the agent’s voice and anyone else on the same recording, since that is other people’s data.

You may also receive erasure requests under Article 17, or objections if you rely on legitimate interests. They don’t always have to be granted, for instance when the recording is needed to defend a legal claim, but they always need to be assessed and answered with reasons.

Transcribing calls and analysing them with AI is processing on top of the recording itself. Robottino’s AI call analysis works only on recorded calls, and on past calls only while the recording is still retained, but it is still a purpose to state in your notice and to review with your adviser. Where recording is systematic, covers many people or is used to evaluate staff, consider whether a data protection impact assessment under Article 35 is needed.

Record only what you need: settings and mistakes to avoid

Data minimisation becomes a set of technical choices. Recording every call on every number is often more than you need; recording only the order line, one queue or a few agents may be enough. Most phone systems let you work at that level, and it’s worth using it.

In Robottino you can turn recording on for a single phone number, which records every inbound call from the moment it arrives, IVR menus included, or for a single agent, covering the calls they make, the calls they answer, or both. From the agent panel, if you grant the permission, agents can start and stop recording on an individual call, which helps when you only need part of a conversation, such as an order confirmation. Test calls made from the portal are never recorded.

Your recording notice can play before the queue: an audio file you upload, the queue’s welcome message or the IVR greeting. If you record to measure service quality, the guide on call center KPIs helps you work out which data you actually need and which you don’t.

• Recording without telling people, or only mentioning it in a website notice.
• Using recordings for purposes you never stated, such as disciplinary action not covered by your policy.
• Not setting a retention period, or forgetting backups and downloaded files.
• Letting every user listen to and download recordings.
• Ignoring the rules on monitoring employees.
• Switching on transcription and automated analysis without updating your privacy notice.

Frequently asked questions