Call recording rules for businesses: what the law requires

The short answer

You can record your business calls. Across the EU, the rules do not prohibit recording - they discipline it: the caller knows, the purpose is defined, the recording lives only as long as needed, and only the right people can hear it. Follow those four principles and recording is not a legal risk; it is an operational asset - the record that settles disputes, the material that improves service, the memory the business keeps of its own commitments.

Pillar 1: notice, before the substance

The caller hears, at the start, that the call is recorded and why. A single natural sentence is enough - before the conversation gets going, not buried at the end. This is the pillar that separates legitimate recording from the kind that creates real trouble: secret recording of calls is what the rules exist to prevent.

If your line is answered by an AI assistant, this pillar gains a quiet superpower: the notice is part of the script, delivered on every call, identically, without exception. No training reminders, no Friday-afternoon lapses. The consistency wins.

Pillar 2: a purpose you can name

Why do you record? Quality of service, record of what was agreed, dispute resolution - all legitimate. What matters is that the purpose is defined before recording starts, stated in the notice, and respected afterwards. Using recordings for something different from what was announced - the training recording that becomes marketing material, the quality archive mined for something else - is the second classic way businesses get this wrong.

Pillar 3: retention with an expiry date

Recordings live as long as the purpose requires and then they are deleted. What that period is depends on the purpose - dispute-related records reasonably live longer than quality samples - but the principle is universal: 'keep everything forever, just in case' is exactly what data protection principles rule out. Define the period, automate the deletion, and the question stays answered.

Pillar 4: access that is actually controlled

A recording is personal data. The people who can listen to it are the people who need to for the declared purpose - and nobody else. Access lists, not open folders. This is the pillar most often neglected in small businesses, and the easiest to fix in an afternoon.

The special case of AI-answered lines

When an AI assistant answers your calls, three things change in practice, all favourably. The notice never fails, because it is scripted. Collection is minimised by configuration - the assistant asks what the scenario needs and nothing more. And the infrastructure comes with paperwork: your provider is a data processor, and the processing agreement defines where recordings are stored, for how long and with what access. The wider data-protection picture for voice AI is in our GDPR practical guide, and the general legality question in is it legal to have AI answering your phone?

What never to do

The short blacklist, for clarity: recording without telling the caller. Using recordings for purposes different from the announced one. Keeping recordings indefinitely without a defined period. Letting recordings circulate without access control. And - the compound error - doing any of the above with health-related or otherwise sensitive calls, where the standards are strictest. Each item on this list is avoidable with configuration, not effort.

The one-afternoon setup

1. Write the notice sentence: recorded, and why.
2. Name the purpose in your privacy notice.
3. Set the retention period and automate deletion.
4. Define the access list.
5. If a provider records for you, sign the processing agreement covering storage, retention and access.

After that afternoon, recording stops being a nagging legal doubt and becomes what it should be: infrastructure. If you are still weighing what an AI-answered line involves end to end, the full journey - capabilities, costs, compliance, rollout - is in the complete 2026 guide to AI phone agents, with every term defined in the voice AI glossary.