24 September 2026

Call recording and the GDPR: what to say and when

Learn what to tell callers before recording, which legal basis to choose and how long to keep recordings to avoid GDPR mistakes and protect your business.

Recording calls can help you review sales conversations, handle complaints and improve service quality. It also turns the conversation into the processing of personal data as soon as the recording can identify the person speaking — which is normally the case in a business call: their voice, name, calling number or order reference may be enough. The problem starts when a company enables call recording and relies on a generic message to cover every requirement.

Call recording and the GDPR require more: inform people before recording starts, explain who processes the data and why, choose an appropriate legal basis and respect the person’s rights. Consent is not always the only option for recording calls, and it does not cover every purpose.

The company must also decide how long to keep the recordings, restrict who can listen to them and protect the files from unauthorised access. Recording, transcribing or analysing a call with AI may involve separate processing activities and additional obligations.

Technology makes configuration easier, but it does not decide whether the notice is sufficient or how long the recordings should be kept. That responsibility remains with the company.

Can sales and customer service calls be recorded?

Yes, a company can record sales and customer service calls. But enabling the feature in the phone system is not enough.

A recording captures the voice and content of a conversation. If that data can identify a person, the company is processing personal data under the General Data Protection Regulation. The company must decide why it records calls, how long it keeps the data, who can access it and when it deletes it. Under the Regulation’s definitions, this makes the company the data controller.

The purpose determines the legal analysis. Recording a call to provide evidence of a contract is not the same as recording it to review service quality, train a team or manage a complaint. Each purpose requires an appropriate legal basis and must comply with the GDPR principles of purpose limitation, data minimisation and storage limitation. In Spain, Organic Law 3/2018 completes this legal framework.

It is therefore useful to separate two questions:

Can the phone system do it? Many platforms allow companies to enable call recording, restrict permissions and store the files.
Can the company do it in that specific case? It must justify the purpose, choose the applicable legal basis, inform the person and establish controls for the recordings.

A generic notice such as “this call may be recorded” does not, by itself, explain who processes the data, why it is used or how the person can exercise their rights. The company must prepare this processing before enabling call recording and document its decisions.

Technology makes recording easy. Responsibility remains with the company.

What the notice must include before recording starts

The call recording notice must help the person understand what will happen to their conversation. Saying “this call may be recorded” is not enough. The information must be provided when the data is collected, in a clear, concise and accessible way, under Article 13 of the GDPR.

At a minimum, the recording or opening message must state:

Who processes the data. Identify the company responsible for the recording. Include its legal name and a channel for contacting it.
Why the call is being recorded. State the purpose clearly: for example, handling a complaint, evidencing a contract or reviewing customer service quality. Do not group different purposes under a vague statement such as “to improve the service”.
What the lawful basis is. Explain whether the processing relies on consent, performance of a contract, a legal obligation or a legitimate interest. The lawful basis must match the stated purpose, in accordance with Article 6 of the GDPR.
Which rights the person can exercise. Explain their rights of access, rectification, erasure, objection and restriction of processing, among others provided for by the GDPR.
Where to find the full information. Provide a website address, an email address or a clear reference to the privacy policy. The recording can summarise the information; the policy must set it out in full.

A practical notice would be: “[Company name] will record this call for [purpose]. The lawful basis is [applicable legal basis]. You can find information about your rights and the full privacy notice at [privacy channel].” The company must then process the recording as stated and must not reuse it for an incompatible purpose, in line with the purpose limitation principle under the GDPR.

When must you provide the notice: before recording, not afterwards

The person must receive the information when their data is collected. Article 13 places that moment at the point of collection. During a call, personal data is processed as soon as someone answers, and recording adds another processing activity. That is why the notice about recording must come before recording starts. A follow-up email can expand on the information — and is a good way to provide the second level of detail — but it does not replace the notice at the beginning. By then, the data has already been collected. This is required by the information duty under Article 13 of the General Data Protection Regulation.

The most practical approach is usually an automated message at the start of the call:

“Please note that this call will be recorded by [company name] for [purpose]. You can find full information about the processing of your data and your rights at [channel or address]. If you continue, the call will be recorded.”

The wording must reflect the actual processing. Do not announce that calls are recorded “for quality purposes” if the company later uses the audio to train its team, handle a complaint or analyse conversations. Each purpose needs a documented justification and information that matches the subsequent use, in line with the principles of purpose limitation and transparency under the GDPR.

We also add something that the regulation does not require in such detail: explain what someone can do if they do not want to continue under those conditions. A call where the only option is to hang up will often end as a complaint. For example:

offer an alternative channel that is not recorded;
transfer the call to an agent who can handle that option;
allow the caller to end the call without penalising them for refusing the recording, when the recording is not necessary to provide the service.

Do not present silence as consent. Continuing after the notice may allow you to manage the call, but it does not automatically turn that behaviour into valid consent. The legal basis depends on the specific purpose, and Article 5(2) of the GDPR requires the company to be able to demonstrate compliance. Choosing the right legal basis is not enough; you must be able to show it. The natural place to document this is the Article 30 record of processing activities — not every company is required to keep one, but it is where people look when they ask.

Not always. Consent is one possible legal basis for recording calls, but it is not the only one. The company must choose the basis that fits the specific purpose of the recording and be able to justify that choice under the GDPR.

Consent. This may be appropriate when the person clearly agrees to the conversation being recorded for a specific purpose. They must receive enough information before making that decision and be able to withdraw their consent afterwards. The company must not present consent as mandatory if it needs the recording for another purpose that can rely on a different legal basis.

Performance of a contract. If the recording is necessary to manage a contract or prove a transaction requested by the customer, the company may consider this legal basis. “Useful” does not mean “necessary”: keeping every sales call for convenience does not, by itself, show that recording is essential to provide the service. The legal basis must have a direct connection with the purpose stated in the notice.

Legal obligation. When a law requires a communication to be retained or recorded, that obligation may justify the processing. The company must identify the applicable law and limit the recording to what that law requires. It is not enough to claim that “the GDPR requires recording”: the GDPR sets out the legal bases, but it does not generally require calls to be recorded.

Legitimate interest. The company may consider this basis for purposes such as preventing fraud, handling complaints or reviewing quality. First, it must identify a genuine interest, check that recording is necessary and balance that interest against the person’s rights. It must also explain this legal basis and allow the person to exercise their right to object where applicable, in accordance with the GDPR.

The right decision is not to “always ask for permission”. It is to document the purpose, necessity and legal basis before enabling call recording.

Retention, access and security of recordings

There is no single retention period for all recordings. The company must link retention to the stated purpose and delete the files when they are no longer needed for that purpose. This applies the storage limitation principle in Article 5(1)(e) of the GDPR.

Define the retention period before enabling recording. For example:

If the recording is used for quality checks, set a short period and review whether it still needs to be retained.
If it documents a contract or a complaint, retain the file for as long as it serves that purpose and there is a justified need to use it.
If a call no longer has operational value, delete it. Do not keep it “just in case”.

Document the criteria. The regulation sets the principle —do not retain data for longer than necessary— but it does not prescribe a specific record. In practice, a record that stands up to review states the purpose, the planned retention period, who approved it and what happens when the period ends. If copies exist in backup systems, include their deletion cycle as well.

Access should follow the same logic. An agent may need to listen to a call to resolve an issue. They do not need access to every recording in the company. Separate permissions by role, restrict downloads and remove access when someone changes position or leaves the company.

Protect the files with technical and organisational measures appropriate to the risk, as required by Article 32 of the GDPR. In practice, this means managing identities, protecting communications and storage, logging who accesses the files and reviewing those logs. It is also advisable to keep recordings separate from general-purpose tools.

If a PBX or provider stores, transcribes or analyses calls, document what data it processes, for what purpose and with which permissions. The GDPR governs this relationship and the processor’s instructions in Article 28. Technical configuration helps, but it does not replace this documentation.

Cases that change the analysis: employees, sales and quality control

The purpose changes the practical rules. A call with a customer is not assessed in the same way as an internal conversation between employees.

Customer service. Recording a call can help handle a complaint or document what happened. The company must explain this purpose, restrict access to the people who need it and keep the file only for as long as that purpose justifies. These principles are set out in Articles 5 and 6 of the General Data Protection Regulation.
Sales. Recording a sales call does not authorise the company to reuse it for any purpose. The company must distinguish between evidence of a contract, offer review and team performance analysis. Each use requires a defined purpose and a consistent legal basis. If the call is also transcribed or analysed with artificial intelligence, it is advisable to document this additional processing and review which data is necessary.
Training and quality control. Listening to calls to correct a script or train new agents requires access to be restricted. Reviewing one specific conversation is not the same as systematically analysing the behaviour of customers and employees. In the latter case, the company must assess the risks, proportionality and applicable safeguards under the principles of data minimisation, purpose limitation and security set out in the GDPR.
Employee calls. The fact that a company is the employer does not make every conversation available for monitoring. It must inform employees about the processing, justify it and avoid broader surveillance than necessary. Organic Law 3/2018 develops the Spanish framework for data protection and digital rights.

Before enabling recording, document the specific purpose. If you want to measure reasons, classification or quality, separate that use from the original file and review access permissions. AI call analytics does not replace this legal assessment. It makes it more necessary.

Checklist for configuring call recording without guesswork

Before enabling call recording, complete this checklist:

Define the purpose. Write down why you record calls: to prove that a contract was agreed, handle a complaint, review customer service or train the team. Do not reuse the recording for an incompatible purpose that was not covered by the notice. Article 5 of the GDPR requires you to limit the purpose and collect only the data you need.
Choose and document the legal basis. Link the purpose to consent, a contract, a legal obligation or legitimate interest. If you rely on legitimate interest, document the balancing test between the company’s interest and the individual’s rights. Article 6 of the GDPR sets out these legal bases.
Write the notice. State who is recording the call, why it is being recorded, which legal basis applies and where the privacy policy can be found. Article 13 of the GDPR sets out the information you must provide when collecting personal data.
Prepare an alternative. If the person does not want to continue with the recording, define another channel or handle the call without recording it where feasible. Do not turn the notice into an ambiguous acceptance.
Set up permissions. Decide which user profiles can listen to, download or delete recordings. Log access and check that each permission serves a specific role. Apply appropriate security measures in line with Article 32 of the GDPR.
Set the retention period. Assign a retention period to each purpose and schedule deletion. Article 5 of the GDPR requires you not to keep data for longer than necessary.
Review the provider. Check whether the provider stores, transcribes or analyses calls on your company’s behalf. If it does, formalise the obligations that apply to the data processor under Article 28 of the GDPR.
Document data-subject rights. Define who handles requests for access, erasure, objection or restriction of processing, and how they will locate the relevant recording.

Review this configuration whenever the purpose, provider, notice or customer service process changes. The LOPDGDD completes the applicable framework in Spain.

Frequently asked questions

Can I use a recording for a purpose different from the one I disclosed?

Not automatically. The company must check whether the new use is compatible with the original purpose and whether it still has a valid legal basis. If it wants to analyse the call for another purpose, it must also review the information provided, access permissions and retention period, in line with the GDPR principles of purpose limitation and storage limitation (Article 5).

Does transcribing a call require a compliance review?

Yes. Transcribing a call also involves processing personal data. The company must include this activity in the stated purpose, control who can access the transcript and apply a justified retention period.

What rights can a person exercise over a recording?

Depending on the circumstances, they can request access to their data, erasure or restriction of processing, or object to the processing. The company must identify the recording, verify the request and respond in accordance with the GDPR rules on data subject rights (Articles 12 to 23).

What should a company require from its cloud PBX provider?

The company must formalise the relationship when the provider stores or manages recordings on its behalf. The contract must set out instructions, confidentiality obligations, security measures, access controls and the conditions for deleting or returning the data, as required by the GDPR for data processors (Article 28).

Configure call recording in your cloud PBX with permissions, schedules and centralised management.