Glossary · Regulation
GDPR and telephony
In one sentence
GDPR applies to business telephony whenever it handles personal data: phone numbers, call logs, recordings and voicemails. It requires a defined purpose and lawful basis, clear information for callers and staff, limited retention and safeguards from suppliers.
Also known as : GDPR · UK GDPR · EU GDPR · General Data Protection Regulation
What is GDPR in telephony?
The General Data Protection Regulation (GDPR) governs any processing of information about an identifiable person. Since Brexit the UK applies its own version, UK GDPR, alongside the Data Protection Act 2018; Ireland and the rest of the EU apply EU GDPR. A business phone system processes plenty of personal data, often without anyone noticing:
- the numbers of callers and people called;
- call logs (date, time, duration, extension);
- call recordings and voicemail messages;
- data synced with a CRM.
The ICO enforces the rules in the UK and the Data Protection Commission in Ireland. Marketing calls and texts are also covered by e-privacy law, PECR in the UK (see TPS).
How it works
For each use of call data, a business should be able to answer five questions:
- Why? A specific purpose: proof of an order, staff training, dispute handling, regulatory record-keeping.
- On what lawful basis? Contract, legal obligation, legitimate interests or consent. Legitimate interests needs a documented balancing test.
- Who is told, and how? Callers before recording starts, usually by a short message with a link or number for full details, and employees through an internal policy.
- For how long? A defined retention period, then deletion. GDPR sets no default, so you must justify yours.
- Where, and by whom? Your phone provider usually acts as a processor and needs a data processing agreement. Transfers outside the UK or EU need appropriate safeguards.
People keep their rights throughout, including access to recordings of their own calls through a subject access request.
Example
A lettings agency in Edinburgh recorded every call “for training and quality” and kept recordings indefinitely on its old phone system. After a tenant made a subject access request, the agency found it could not easily locate the right recordings. It now records only the lettings and maintenance lines, plays a short notice at the start of calls, restricts access to two managers and sets automatic deletion after a fixed period in its phone system.
What it means for your business
Choosing a phone provider also means choosing where your call logs and recordings live. Before signing, ask for the data processing agreement, the hosting location and the retention settings available. For questions about our own services, reach us via the contact page; our privacy policy explains how we process data. AI processing of calls, such as automatic transcription, raises further questions covered on utio.io.
Frequently asked questions
Is call recording legal under GDPR?
Yes, if you have a clear purpose and lawful basis, tell people before recording, keep recordings only as long as needed and protect them. Regulated sectors may be required to record: in the UK, FCA rules require many investment firms to record relevant calls.
How long can I keep call recordings?
GDPR sets no fixed period: you decide one based on the purpose and must be able to justify it. Keeping everything forever 'just in case' is hard to defend. Some sector rules set minimum periods, which then take precedence.
Does UK GDPR differ from EU GDPR?
The core principles are the same. The UK version sits alongside the Data Protection Act 2018 and PECR and is enforced by the ICO. In Ireland, EU GDPR applies and is enforced by the Data Protection Commission.
Related terms
- Call recording
Call recording saves business phone conversations as audio files for training, evidence, compliance or quality checks. Callers must be told, and the recordings are personal data under GDPR.
- TPS (Telephone Preference Service)
The Telephone Preference Service (TPS) is the UK's free opt-out register for unsolicited live sales and marketing calls. Under PECR, businesses must not make such calls to registered numbers unless the person has told that caller they are happy to be called.
- CRM integration
CRM integration connects a business phone system to customer relationship management software, so the caller's record opens when they ring, staff dial with one click and every call is logged automatically.
- Voicemail
Voicemail records a message when a call goes unanswered and makes it available to the recipient on their phone, in an app or by email, often with the caller's number and the time.
- Telecom API
A telecom API is a programming interface that lets software control communication services: place or receive calls, manage phone numbers, send SMS, pull call history or get notified in real time when something happens on a call.
Updated on