Call recording legal requirements: UK business guide

UK call recording legal requirements centre on having a clear purpose, choosing and documenting a lawful basis, telling people that calls are being recorded, and protecting the recordings as personal data. Consent is not automatically required in every case, but businesses must comply with UK data-protection law and any rules that apply to their sector.

Call recording can support training, quality assurance, complaint handling and regulatory compliance. However, it also captures people’s voices and may reveal financial, health or other sensitive information. A business should therefore record only when it has a justified need and a proportionate process.

This guide provides general information for UK organisations and is not legal advice. Seek professional advice for your circumstances, particularly if you work in a regulated sector or expect to record sensitive information.

Is it legal to record business calls in the UK?

Yes, businesses can record calls in the UK, but the recording must be lawful, fair and transparent. There is no single rule that makes every recording lawful or unlawful. The answer depends on why the business records the call, what information it captures and how it uses, stores and shares that information.

The Information Commissioner’s Office explains the principles of lawfulness, fairness and transparency. In practice, organisations must identify a valid lawful basis under UK data-protection law and be open with people about the processing.

Do callers have to consent to call recording?

Not always. Consent is one possible lawful basis for processing personal information, but it is not the only one. Depending on the purpose, a business may instead rely on a contract, legal obligation or legitimate interests. The correct basis must be chosen before recording begins and documented properly.

Consent must be freely given, specific, informed and easy to withdraw. It may be unsuitable where the person has no realistic choice or where the business would continue recording regardless. In those cases, presenting consent as the basis could be misleading.

Transparency is still essential even when consent is not the lawful basis. Callers should be told that the call is being recorded, why it is being recorded and where they can find further privacy information. A short recorded message is common, followed by a privacy notice covering retention, sharing and individual rights.

Which UK laws affect business call recording?

UK GDPR and the Data Protection Act 2018

A call recording is personal information when someone can be identified directly or indirectly. UK GDPR principles require organisations to process that information lawfully, fairly and transparently; collect it for clear purposes; minimise what they capture; keep it accurate where relevant; retain it only as long as needed; and protect it appropriately.

The business must identify and record the lawful basis for each purpose. For example, recording required by a regulator may rely on legal obligation, while proportionate quality monitoring might rely on legitimate interests after a documented balancing assessment. No basis should be selected simply because it seems convenient.

Lawful Business Practice Regulations

The Telecommunications (Lawful Business Practice) (Interception of Communications) Regulations 2000 set conditions for certain business monitoring and recording. They sit alongside the Regulation of Investigatory Powers Act 2000 and do not replace data-protection duties.

Permitted business purposes can include establishing facts, demonstrating standards, preventing or detecting crime, investigating unauthorised use and securing the effective operation of a telecommunications system. Organisations should check that their activity fits the rules and that people receive appropriate notice.

Sector-specific requirements

Some regulated organisations must record particular calls or communications. Financial-services rules are a common example, but the exact duties depend on the firm, activity and regulator. A legal or compliance team should confirm which communications must be captured, the required retention period and any controls on access.

What must a business do before recording calls?

1. Define the purpose

Start with a specific reason. “We might find it useful” is not enough. A clear purpose could be resolving complaints, providing evidence of transactions, training customer-service teams or meeting a regulatory duty.

Next, consider whether the same result could be achieved in a less intrusive way. For example, itemised call records may be enough to investigate unusual calling patterns without recording every conversation.

2. Choose and document a lawful basis

Select the lawful basis that genuinely matches each purpose. If the business relies on legitimate interests, complete the purpose, necessity and balancing tests. If special-category information is likely to be recorded, identify an additional condition where required.

The ICO’s guide to lawful basis explains the options and documentation requirements. Record the decision so the organisation can demonstrate accountability.

3. Assess privacy risks

A data protection impact assessment, or DPIA, helps the business identify risks and safeguards. It may be required where monitoring is likely to create a high risk to people’s rights and freedoms. Worker monitoring deserves particular care because employees may feel unable to object.

4. Tell callers and workers

Give people clear information before or at the start of recording. Explain the purpose in plain language and direct them to a fuller privacy notice. Staff should also understand which calls are recorded, why, who can listen and how recordings may be used.

The ICO’s guidance on monitoring workers says organisations must tell callers that they are recording and why. It also advises businesses to make workers aware through privacy information and relevant internal policies.

5. Set a retention period

Do not keep recordings indefinitely “just in case”. Choose a period that matches the purpose, legal duties and likely complaint or dispute timescales. Different categories of calls may need different periods.

Once that period ends, delete or anonymise the recording securely unless a documented reason requires a legal hold. Review retention rules regularly rather than allowing storage to grow unnoticed.

6. Secure recordings and control access

Use suitable technical and organisational safeguards. These may include encryption, strong authentication, access based on job role, audit logs, secure deletion and checks on suppliers that host or process recordings.

Recordings do not always have to remain physically “in-house”. Cloud storage or a specialist provider can be lawful if contracts, security, international-transfer rules and controller-processor responsibilities are handled correctly.

7. Plan for individual rights

People may request access to personal information held about them, including call recordings. The business needs a process to find the right call, verify identity, consider other people’s rights and respond within the applicable timescale.

Recordings may also be relevant to requests for erasure, restriction or objection, depending on the lawful basis and circumstances. Staff should know where to send these requests.

What are the business benefits of call recording?

Improved customer service

Managers can review a representative sample of calls to understand what customers experience. This can reveal unclear processes, common questions and opportunities to improve call handling without relying on memory alone.

Practical training examples

With appropriate controls, real calls can help colleagues learn how to explain products, handle difficult conversations and follow company procedures. Wayv’s call recording feature can support structured review and coaching.

Training should focus on constructive development rather than constant surveillance. Use relevant excerpts where possible, restrict access and ensure workers understand the process.

Complaint and dispute handling

A recording can provide an accurate account of what was said, reducing uncertainty when a customer challenges advice, an order or an agreed action. It should be treated as evidence rather than assumed to be the whole story; notes, system records and context may also matter.

Quality assurance and compliance

Call reviews can test whether teams follow required scripts, disclosures and internal standards. In regulated environments, recordings may also help demonstrate compliance with specific duties.

Better insight into customer needs

Recurring themes can show where customers struggle or what they value. Businesses can use properly governed insights to improve products, help content and processes. Any analysis must remain within the stated purpose and lawful basis.

Fewer unnecessary follow-up calls

If someone misses a detail, an authorised colleague may be able to review the recording instead of contacting the customer again. For training purposes, this can also help staff practise accurate note-taking.

How should businesses handle sensitive calls?

Calls may capture payment details, health information, trade-union membership, biometric data or allegations of criminal activity. These categories can trigger extra legal conditions and stronger safeguards.

Where possible, pause or suppress recording while payment-card details are collected. Restrict access to sensitive calls, document why recording is necessary and ensure the privacy notice reflects the information involved.

Can call recordings be shared?

Sharing is not automatically prohibited, but it must be lawful, necessary and consistent with what people were told. The organisation should identify the recipient, purpose and legal basis, then use secure transfer and an appropriate agreement.

Examples might include giving a recording to a regulator, legal adviser, police force or technology supplier. Wider internal access should also be limited to people who genuinely need it.

Call recording compliance checklist

• Define a clear and proportionate purpose.
• Choose and document the correct lawful basis.
• Complete a DPIA where monitoring creates high privacy risks.
• Tell callers and workers what is recorded and why.
• Publish accessible privacy information.
• Set and enforce a justified retention period.
• Protect recordings with suitable security and access controls.
• Check contracts with recording and storage providers.
• Prepare for subject access and other rights requests.
• Review the process when technology, purposes or legal duties change.

Call recording FAQs

Must a business play a recorded announcement?

A recorded message is good practice and provides clear notice. Where that is not possible, staff should tell callers that recording is taking place and explain why, then provide fuller privacy information by another route.

Can employees’ calls be recorded?

Potentially, but worker monitoring must be necessary, proportionate and transparent. Employers should inform workers, consider their expectations of privacy and avoid routinely recording personal calls.

How long should call recordings be kept?

There is no universal period for every business. Retention should match the purpose, sector rules and genuine operational or legal needs. Document the decision and delete recordings when the period expires.

Can recordings be used for a new purpose?

Only where the new use is compatible with the original purpose or another valid legal route applies. Before reusing recordings, assess fairness, transparency, lawful basis and whether people need further information.

Is consent always the safest lawful basis?

No. Consent is appropriate only when people have genuine choice and control. Another basis may be more suitable, but the business must still be transparent and meet all other data-protection duties.