Can businesses record calls?
Yes. UK law allows businesses to record calls on their own systems for legitimate business purposes, such as keeping records of transactions, checking quality, training staff and meeting regulatory obligations. Some sectors, such as FCA-regulated investment firms, are required to record certain calls.
Telling people
Recordings contain personal data, so UK GDPR applies. You need a lawful basis, you must tell people that calls may be recorded and why, and your privacy notice should explain how long recordings are kept and who can access them. A short message at the start of calls is the usual approach.
Storing recordings
- Keep recordings only as long as you need them, and set automatic deletion
- Restrict access by role
- Encrypt recordings in transit and at rest
- Be ready to find and provide recordings for subject access requests
Card payments
If card details are read out on a recorded call, the recording falls into PCI DSS scope. Pause and resume recording, or a secure payment option where the caller types the card number on their keypad, keeps card data out of recordings.