Call recording, consent and UK GDPR: what you actually have to tell callers

The moment you record — or even just transcribe — a phone call, you're processing someone's personal data, and UK GDPR applies. That sounds heavier than it is. In practice it comes down to four questions you can answer in an afternoon. Here they are, in plain English. (This is guidance, not legal advice — check your own case.)

<rect x="192" y="44" width="160" height="76" rx="11" fill="#1E3A5F"/>
<text x="272" y="72" text-anchor="middle" fill="#93C5FD" font-size="11" font-weight="700">2</text>
<text x="272" y="92" text-anchor="middle" fill="#fff" font-weight="600">Lawful basis</text>
<text x="272" y="108" text-anchor="middle" fill="#CBD5E1" font-size="10.5">legit. interest + LIA, or consent</text>

<rect x="376" y="44" width="160" height="76" rx="11" fill="#3B82F6"/>
<text x="456" y="72" text-anchor="middle" fill="#DBEAFE" font-size="11" font-weight="700">3</text>
<text x="456" y="92" text-anchor="middle" fill="#fff" font-weight="600">Tell callers</text>
<text x="456" y="108" text-anchor="middle" fill="#DBEAFE" font-size="10.5">up front, clearly</text>

<rect x="560" y="44" width="152" height="76" rx="11" fill="#0A1628"/>
<text x="636" y="72" text-anchor="middle" fill="#60A5FA" font-size="11" font-weight="700">4</text>
<text x="636" y="92" text-anchor="middle" fill="#fff" font-weight="600">Minimise &amp; retain</text>
<text x="636" y="108" text-anchor="middle" fill="#94A3B8" font-size="10.5">only what you need</text>

<line x1="168" y1="82" x2="190" y2="82" stroke="#94A3B8" stroke-width="1.6" marker-end="url(#ac)"/>
<line x1="352" y1="82" x2="374" y2="82" stroke="#94A3B8" stroke-width="1.6" marker-end="url(#ac)"/>
<line x1="536" y1="82" x2="558" y2="82" stroke="#94A3B8" stroke-width="1.6" marker-end="url(#ac)"/>

1. A recorded call is personal data

Audio of a person's voice, and a transcript of what they said, are personal data. So UK GDPR applies the moment you keep it. If the call touches health, finances or anything sensitive, you're into special-category data, which needs extra care.

2. Pick a lawful basis — and write it down

You need a lawful reason to record. For most business calls that's one of two:

• Legitimate interests — the usual choice for quality, training or record-keeping. It requires a short Legitimate Interests Assessment (LIA): a written note weighing your need against the caller's reasonable expectations. It's not onerous, but "we didn't do one" is the finding you don't want.
• Consent — cleaner in some cases, but it must be freely given, and the caller must be able to decline and still get service.

3. Tell callers — at the start, clearly

Transparency is the part people skip and regulators care about. Callers should be told, up front, that the call is recorded, by whom, and why — the same breath in which a good AI agent says it's an AI. A buried line in a privacy policy isn't enough; the notice belongs at the top of the call.

A note on the marketing line: if the call sells, PECR adds consent rules on top of GDPR. A genuine research or satisfaction survey with no marketing isn't caught by those — but the moment a pitch appears, it is.

4. Keep only what you need, only as long as you need it

Data minimisation is the quiet superpower here. Do you need the audio, or just a structured summary of the outcome? Keeping less lowers your risk, your storage and your breach exposure all at once. Set a retention period and actually delete on it.

This is the design choice we made deliberately: for privacy-sensitive work, capture a structured transcript or notes rather than recording everything by default. The best way to protect call data is to not hold more of it than the job requires.

🎧 Listen to the compliance briefing above.

Related: Do you have to tell people it's an AI? · Compliance & trust · AI receptionist vs answering service