Is it legal to record phone calls in the UK and EU? Consent, notice, retention
Most UK and EU businesses can record customer calls. They need a lawful basis, a notice before recording starts, a retention period they can defend and a way to hand over a copy.
Is it legal to record phone calls in the UK? Usually, yes. A UK business can record customer calls when it has a lawful basis under the UK GDPR and tells callers before recording starts. It must also keep recordings no longer than it needs and hand over a copy on request. Consent is one possible basis among several. EU data protection rules match in substance, but some national laws are stricter.
This is general information, not legal advice. The rules depend on your country, your sector and why you record, so check your plan with a qualified adviser or your data protection officer.
Each legal point below links to its primary source.
Is it legal to record phone calls in the UK, and which laws apply?
Two sets of rules apply in the UK.
Data protection. A recording of a customer's voice is personal data, so the UK GDPR applies. You need a lawful basis under Article 6, privacy information under Article 13, a retention period you can justify and a way to answer access requests.
Interception. Section 3 of the Investigatory Powers Act 2016 makes it an offence to intentionally intercept a communication in the UK without lawful authority. Under section 4, interception means doing something to the system, such as modifying it or monitoring its transmissions, so that the content becomes available "to a person who is not the sender or intended recipient of the communication".
Businesses get lawful authority from section 46 and the 2018 business monitoring Regulations. The listed purposes include establishing facts, checking compliance with regulatory practices, showing the standards staff achieve and preventing or detecting crime. One condition is that the business has "made all reasonable efforts to inform every person who may use the telecommunication system" that communications may be intercepted.
Older guides still cite the Telecommunications (Lawful Business Practice) Regulations 2000. Those were made under section 4 of the Regulation of Investigatory Powers Act 2000, which no longer has effect. Section 46 of the 2016 Act has been in force since 27 June 2018.
Some regulated sectors add recording duties of their own on top of these.
Do you need consent to record a call under the GDPR?
Not always. The ICO says "No one basis is always better, safer or more important than the others" (ICO, a guide to lawful basis). Choose the basis before you record, write down why, and name it in your privacy information.
| Lawful basis | When it can fit a recorded call | What to watch |
|---|---|---|
| Legitimate interests, Art. 6(1)(f) | Quality checks, training, a record of what was agreed | Run and keep the three-part test; callers can object under Article 21 |
| Contract, Art. 6(1)(b) | Only where recording is necessary to perform a contract, or for steps the caller asked for | Being convenient does not meet the test |
| Legal obligation, Art. 6(1)(c) | A law or regulator requires you to record | You must be able to name the obligation |
| Consent, Art. 6(1)(a) | National law requires it, or recording is optional and the caller can refuse | Freely given, easy to withdraw, and no switching basis later |
Legitimate interests can fit quality checks, training and keeping a record. The ICO's three-part test asks you to identify the purpose and check the recording is "actually necessary" for it. Then you balance it against the caller's interests, including whether "a reasonable person would expect the processing". For the legitimate interests assessment (LIA), the ICO adds that "you should record your LIA and the outcome".
Consent sets a higher bar. Article 4(11) of the GDPR requires it to be "freely given, specific, informed and unambiguous". Article 7(3) adds: "It shall be as easy to withdraw as to give consent."
Asking for consent also closes a door. In the EDPB's words, "the controller cannot swap from consent to other lawful bases" (EDPB Guidelines 05/2020, paragraph 123). If you ask and the caller says no, do not record, and carry on with the call.
The Data (Use and Access) Act 2025 added a further UK basis, recognised legitimate interests, in Article 6(1)(ea). It is limited to the purposes in Annex 1: national security, public security and defence, emergencies, crime, safeguarding, and disclosures for public-task processing. Routine sales or support recording does not obviously fit any of them.
What must you tell callers before you record?
Tell them before recording starts, in plain words. Article 13 asks for privacy information "at the time when personal data are obtained". For a recorded call, that covers:
- who you are and how to reach you;
- why you record, your lawful basis and, if you rely on it, your legitimate interest;
- who receives the recording, such as a provider that stores or transcribes it;
- how long you keep it, or the criteria you use to decide;
- the caller's rights, including access, erasure and objection, and withdrawing consent if consent is your basis.
The ICO asks for information that is "concise, transparent, intelligible, easily accessible" and suggests combining layering with "just-in-time notices" (ICO, the right to be informed). On a call, that means one short line when recording starts, with your privacy notice behind it.
EU law points the same way. Recital 23 of the ePrivacy Directive says parties "should be informed prior to the recording about the recording, its purpose and the duration of its storage".
Lines your team can adapt:
- Phone, at the start: "This call is recorded so we have an accurate note of what we agree. Our privacy notice explains how long we keep it."
- Browser call, before recording: "Would it be all right if I record this so we have a note of the sizes we agree? If not, we carry on without it."
- If you transcribe or summarise: "The recording is also transcribed and summarised for our team."
Can you record a meeting or call without consent in the UK as an individual?
For your own use, usually yes, but business recording follows different rules. The UK GDPR does not apply to processing "by an individual in the course of a purely personal or household activity" (Article 2(2)(a)).
Interception law turns on who gets the content. Section 4 of the 2016 Act covers making it available to someone who is not the sender or intended recipient, including later from a recording. Keeping a recording of your own call to yourself does not do that. Passing it on can, so take advice before you share one.
The personal exemption ends where work begins. Recital 18 of the GDPR describes it as activity "with no connection to a professional or commercial activity". A salesperson who records a client meeting on their own phone is recording for work.
| Personal recording | Business recording | |
|---|---|---|
| Who records | An individual, for their own purposes | A business, or staff doing their job |
| Data protection | Outside the UK GDPR if purely personal or household | UK GDPR or GDPR applies in full |
| Interception law | Not what section 4 describes, while kept to yourself | Where it is interception, lawful authority comes from section 46 and the 2018 Regulations |
| Notice, retention and access | Not required by data protection law | Notice before recording, justified retention, a copy on request |
Can you record a conversation in Ireland or elsewhere in the EU?
Generally yes for a business, under the same GDPR rules: a lawful basis, notice, retention and access. Communications and criminal law on top varies by country.
The ePrivacy Directive. Article 5(1) requires member states to prohibit "listening, tapping, storage or other kinds of interception" by people other than users without their consent, unless legally authorised. Article 5(2) preserves "legally authorised recording" in "the course of lawful business practice" as evidence of a transaction or other business communication.
Ireland. The Postal Packets and Telecommunications Messages (Regulation) Act 1993, as enacted, defines "intercept" to exclude listening or recording where the sender or the intended recipient "has consented". A business that records is still a controller under the GDPR, which the Data Protection Commission enforces.
Germany. Section 201 of the German Criminal Code makes it an offence to make, without authorisation, "an audio recording of the privately spoken words of another".
Other member states. In some member states, criminal or communications law sets stricter rules, as in Germany above. Check each country your callers are in.
How long can you keep call recordings?
As long as you can justify, and no longer. Article 5(1)(e) requires personal data to be kept "for no longer than is necessary for the purposes". The ICO notes that "The UK GDPR does not set specific time limits for different types of data" (ICO, storage limitation). It expects "a policy setting standard retention periods wherever possible", periodic reviews, and that you "erase or anonymise it when you no longer need it".
Set the period by purpose. A recording kept to settle disputes has a natural end date. Recital 23 of the ePrivacy Directive says it should be erased "at the latest by the end of the period during which the transaction can be lawfully challenged". For training recordings, decide in advance when they stop being useful.
Transcripts and AI summaries are personal data too. Give them the same retention as the audio, and mention them in your notice.
What should you do when a caller asks for their recording?
Treat it as a subject access request. The ICO says a request can be made "verbally or in writing, including via social media". You must answer "at the latest within one month", and complex or repeated requests allow up to two more months (ICO, a guide to subject access). Article 15(3) entitles the person to "a copy of the personal data undergoing processing".
Retention schedules can collide with this rule. In a decision of 10 November 2020, Ireland's Data Protection Commission reprimanded Ryanair. A caller's access request stalled, and the recording was deleted under a 90-day retention policy. The DPC found infringements of Articles 15 and 12(3).
When a request arrives:
- Log the date. The one-month clock usually starts on receipt, or once you have confirmed who is asking.
- Pause deletion of that person's recordings, transcripts and summaries until you have answered.
- Collect everything: audio, transcript, summary and notes.
- Remove other people's data where the material mentions them.
- Send the copy in a commonly used electronic format if the request arrived electronically.
How GreetDock handles call recording
GreetDock calls are voice and video calls in the browser, offered by your team from the chat thread. The visitor accepts in the widget before anything connects, and recording is never automatic.
- A teammate starts it. Recording begins only when someone on your team deliberately starts it. Until then, the call screen reads "Media is not recorded".
- The visitor is told. When recording starts, the visitor sees a recording indicator and a notice in the widget.
- A transcript and a summary, from 4 November 2026. AI transcription and summaries are switched on for each workspace from that date, after notice under our DPA. A recorded call is then saved to the visitor's record with a transcript and a short AI summary. The summary is a draft for your team to check, and AI processing runs on an EU-hosted model. See transcripts and AI call summaries.
- Your retention. Recordings stay in your workspace Cloud storage until you delete them or the workspace closes. Transcripts and summaries follow your retention and are deleted with the record.
- Unrecorded calls are not kept. Call audio and video pass through a media relay that GreetDock self-hosts in the EEA. No audio or video is kept unless your team records the call, and an unrecorded call is not transcribed or summarised.
- Access requests. Search Cloud → Records by name or email to collect a visitor's messages, transcripts and summaries. During the beta, deleting a specific record is a request by email to our team.
The indicator is notice, not consent. As controller, your business decides whether to record and is responsible for the lawful basis, notice or consent, retention and deletion. Where a law requires consent, get it before recording, or do not record.
From 4 November 2026, an "ask first" mode lets the widget ask the visitor before recording starts. It is on by default for customers established in the EU or EEA, and other customers can turn it on. "Agree" and "Don't record" carry equal weight, and declining keeps the call going.
For hosting, the DPA and sub-processors, see the GDPR and live chat guide and the security page.
What to do next
- Write down why you record each kind of call, and the lawful basis for each purpose.
- Keep a legitimate interests assessment if that is your basis, completed before you start.
- Check the law where your callers are. Where every participant must consent, ask first and accept a no.
- Add a one-line notice at the moment recording starts, and a recording section to your privacy notice that mentions transcripts and summaries.
- Set a retention period per purpose, with a hold for open access requests.
- Check the plan with a qualified adviser before you switch recording on.
This is general information, not legal advice. Laws and guidance change, and your obligations depend on your facts.
GreetDock is in private beta, with a free 30-day trial, no card and no automatic charge. If browser calls that record only when your team chooses suit how you work, get early access.
