Recording calls under UK GDPR

You need a lawful basis

For most businesses recording calls for quality, training and record keeping, the usual basis is legitimate interests. You should be able to explain why recording is necessary and why it does not override the caller's rights, and it is worth writing that reasoning down.

Consent is a weaker basis here than people assume, because consent must be freely given and a caller who has to accept recording to speak to you is not choosing freely.

You have to tell people

Transparency is the requirement that catches businesses out. Callers should be told that the call is recorded, and why, at the start of the call.

A short announcement is sufficient. It does not need to be a legal recital, and a long one increases hang ups. Say it is recorded, say why in a few words, and get on with the call.

The detail belongs in your privacy notice, which should be findable from your website and cover what you record, why, how long you keep it and who it is shared with.

Retention

There is no fixed legal period. You keep recordings as long as you need them for the purpose you stated, and no longer. Many businesses settle on somewhere between thirty days and twelve months depending on the purpose.

Whatever you choose, state it in your privacy notice and make sure deletion actually happens. A stated policy that is not enforced is worse than a longer stated policy that is.

Special category data

Health information is special category data and needs extra care. A dental, veterinary or medical practice will inevitably record calls containing it.

That does not prevent recording, but it raises the bar on security, retention and the assessment you should have done. If your calls routinely contain health data, a data protection impact assessment is a sensible step.

If you use a third party

Any supplier processing calls on your behalf is a processor and you need a data processing agreement with them. Ask for it before you sign, not after.

Ask where data is stored, whether it leaves the UK or EEA, what the retention period is, and how you get recordings deleted on request. A supplier who cannot answer those quickly is a problem for you, not for them.

• A signed data processing agreement
• Where recordings and transcripts are stored
• The retention period, and whether you control it
• How a subject access request is handled
• How deletion requests are actioned and evidenced

Subject access requests

A caller can ask for a copy of their own recording, and you generally have a month to provide it. Being able to find a specific call quickly is therefore a practical requirement rather than a theoretical one.

Searchable transcripts make this straightforward. Boxes of audio files do not.