Call recording and the law in the UK

This guide explains the main rules in plain English. It is general information, not legal advice. If you are in a regulated sector or unsure how the rules apply to you, take advice from a solicitor or your compliance adviser.

Can businesses record calls in the UK?

Yes. Businesses can record calls for reasons such as training, quality, keeping a record of what was agreed, and resolving disputes. The key is being open about it and handling recordings as the personal data they are.

The rules that apply

UK GDPR and the Data Protection Act 2018

A recording of someone's voice, along with their phone number and what they say, is personal data. That means you need:

A lawful basis. For most businesses this is legitimate interests, such as training and keeping accurate records. You do not usually need the caller's consent, but you do need to be able to explain why recording is necessary and proportionate.
Transparency. Callers must be told calls are recorded and why. A short announcement at the start of the call, plus details in your privacy notice, covers this.
Retention limits. Keep recordings only as long as you need them. Set a period, such as 90 days, and delete them after that.
Security. Store recordings securely and limit who can access them.
Data subject rights. People can ask for a copy of their recordings. You need to be able to find and provide them.

If recordings are likely to include sensitive information, such as health details, consider carrying out a data protection impact assessment before you start.

The interception regulations

The Investigatory Powers (Interception by Businesses etc. for Monitoring and Record-keeping Purposes) Regulations 2018 allow businesses to record calls on their own systems for legitimate business purposes, as long as they make reasonable efforts to tell the people using the system that calls may be recorded. Again, an announcement does the job.

PECR

The Privacy and Electronic Communications Regulations mainly cover marketing calls, texts and cookies. If you use a missed-call text, keep it to a service message about the call the person just made, not a marketing message. If your website uses tracking cookies, your cookie banner should cover them.

PCI DSS

If you take card payments over the phone, the Payment Card Industry Data Security Standard applies. Card security codes must never be stored, and storing full card numbers in recordings creates a heavy compliance burden. The practical answer is to pause recording while card details are given, or use a payment method that keeps card numbers off the call altogether.

Sector rules

Some sectors have their own requirements. Certain FCA-regulated firms must record and keep calls relating to investment business. Healthcare providers handle special category data and should be especially careful about access and retention. Check what applies to you.

A simple checklist

Play a recording announcement at the start of calls.
Mention call recording, its purpose and your retention period in your privacy notice.
Record your lawful basis, usually a short legitimate interests assessment.
Set a retention period and make sure recordings are deleted automatically.
Limit who can listen to and download recordings, and keep an access log.
Pause recording during card payments.
Know how to find and export a caller's recordings if they ask.
Make sure your call tracking provider will sign a data processing agreement and stores recordings securely.

How Call Tracked helps

An announcement on every recorded number, which you can word yourself
Recording switched on per number, so you only record lines that need it
Pause and resume recording during card payments, and automatic removal of card numbers from transcripts
Retention periods from 30 days to two years, with automatic deletion
User permissions and a full log of who listened to or downloaded what
Recordings stored in UK data centres, encrypted at rest
A data processing agreement as standard

Read more on our security and GDPR page.

Frequently asked questions

Do I need the caller's consent to record?

Usually not. Most businesses rely on legitimate interests and tell callers through an announcement and their privacy notice. Some situations, such as certain sensitive calls, may call for a different approach.

Is a line on my website enough?

It helps, but callers may not have read it. An announcement at the start of the call is the clearest way to tell them.

Can I record calls to my mobile?

Calls to a tracking number are recorded by the tracking system before they reach your phone, so it does not matter which phone answers.

How long should I keep recordings?

As long as you need them for the reasons you record. For many businesses that is 30 to 90 days. Regulated firms may need much longer.