UK Call Recording Law and GDPR: A Guide for Businesses

Which laws apply?

Three sets of rules cover most businesses:

• UK GDPR and the Data Protection Act 2018. A recording or transcript of someone’s call is personal data if it identifies them, so all the usual data protection rules apply.
• The Investigatory Powers Act 2016. Intercepting communications without lawful authority is an offence. Section 46 lets businesses record on their own phone systems where regulations allow it.
• The Investigatory Powers (Interception by Businesses etc. for Monitoring and Record-keeping Purposes) Regulations 2018. These carry forward the rules in the older 2000 “Lawful Business Practice” Regulations. They allow recording for listed purposes, such as establishing facts, checking regulatory compliance, checking staff standards and preventing crime, provided you have made all reasonable efforts to tell people using the system that calls may be recorded.

Choosing a lawful basis

The ICO’s guide to lawful basis says no basis is better or safer than the others. For call recording, the realistic options are:

• Legitimate interests – the usual choice for training, quality checks and settling disputes. Run and write down the ICO’s three-part test: is there a legitimate purpose, is recording necessary for it, and does it override the caller’s interests?
• Legal obligation – where a law or regulator requires you to record, as with the FCA rules below.
• Contract – occasionally, where the recording is needed to perform a contract with the caller, such as confirming an order placed by phone.
• Consent – rarely a good fit. Consent has to be freely given and can be withdrawn, which is awkward when the caller can’t reach you any other way.

Callers sometimes volunteer health or other special category data. If that is likely in your line of work, you also need a separate condition for processing it.

Telling callers

UK GDPR’s right to be informed means giving privacy information at the time you collect the data. On a phone call, the ICO’s layered approach works well: a short line at the start of the call, and the detail in your online privacy notice.

Example greeting:

“Thanks for calling Smith Plumbing. Calls are recorded for training and to help us resolve any queries. You can read how we use your details at smithplumbing.co.uk/privacy.”

Your privacy notice should then cover what you record, why, your lawful basis, who you share recordings with (such as your phone provider), how long you keep them, and how people can use their rights or complain.

Retention and security

The ICO’s storage limitation guidance confirms UK GDPR sets no fixed retention periods. You decide, justify and document them.

For security, limit who can listen to or read recordings, use strong passwords and two-factor sign-in, and make sure any provider storing recordings for you has a written processor contract.

Access, deletion and complaints

Anyone you have recorded can ask for a copy. You normally have one month to respond, extendable by two months for complex requests, and usually can’t charge. The Data (Use and Access) Act 2025 confirms you only need to make reasonable and proportionate searches.

People can also ask you to delete a recording. The right to erasure isn’t absolute, but where you rely on legitimate interests and the caller objects, you need a strong reason to keep it.

Since 19 June 2026, every organisation must also have a way for people to make data protection complaints, acknowledge them within 30 days and respond without undue delay.

Card payments: pause the recording

If you take card payments by phone, PCI DSS applies to your recordings. The PCI Security Standards Council’s telephone payments supplement says storing the card security code (CVV2 and similar) after authorisation breaches PCI DSS, even if encrypted, and that technology to stop it being recorded should be used where it exists.

In practice: pause recording while card details are given, use a system that masks keypad entry, or send the customer a secure payment link instead.

Regulated firms: FCA SYSC 10A

Some FCA-regulated firms must record. SYSC 10A applies mainly to investment firms and similar businesses dealing in financial instruments. They must record relevant calls, tell clients in advance, and keep records for five years (up to seven if the FCA asks). If that applies to you, take compliance advice.

Transcripts and AI-answered calls

Not recording audio doesn’t take you outside data protection law. A written transcript or summary that identifies a caller is still personal data, so the same rules on lawful basis, transparency, retention and rights apply.

If an AI system answers or transcribes your calls, the ICO’s guidance on AI transparency says you must give privacy information when you collect the data, covering your purposes, retention and who you share it with. Telling callers at the start that an AI assistant is answering is the simplest way to keep that promise, and list the AI provider in your privacy notice.

Checklist

• Decide why you record and pick a lawful basis (write up a legitimate interests assessment if you use it).
• Add a recording line to your greeting and link to your privacy notice.
• Update the privacy notice: purpose, basis, recipients, retention, rights, how to complain.
• Set a retention period and delete on schedule.
• Restrict access and check your providers’ processor contracts.
• Pause recording, or use another route, for card payments.
• Have a process for access, deletion and complaint requests.
• If you are FCA-regulated, check whether SYSC 10A applies.

Frequently asked questions

Do I need a caller's consent to record a business call in the UK?

Not usually. Legitimate interests is often a better fit than consent, but you must still tell callers the call is being recorded, why, and where to find your privacy notice.

How long can I keep call recordings?

UK GDPR sets no fixed period. Decide how long you need recordings for their purpose, write it down, and delete them when the period ends. Some regulated firms must keep them for longer, such as five years under SYSC 10A.

Can a caller ask for a copy of their call recording?

Yes. A recording or transcript that identifies someone is their personal data, so they can make a subject access request. You normally have one month to respond and cannot usually charge a fee.

Is a call transcript treated differently from an audio recording?

Not for data protection purposes. A transcript that identifies the caller is personal data, just like audio, so the same rules apply.

Can I record card details given over the phone?

You should avoid it. PCI DSS does not allow the card security code to be stored after authorisation, even if encrypted, so pause recording while card details are read out or take payments by another route.