GDPR Call Recording: Lawful Basis, Notices, and Retention

To record phone calls lawfully under the GDPR call recording requirements, you need a documented lawful basis before recording starts, a clear notice to the caller explaining who you are and why you are recording, security and retention controls on the audio, and a workable process for handling requests from callers and employees who appear on the tape. Getting any of these wrong exposes your organization to fines of up to €20 million or 4% of total worldwide annual turnover from the preceding year, whichever is higher.¹

A voice recording is personal data. Article 4 defines personal data as any information relating to an identifiable person, and treats recording and storage as processing.² A standard customer service recording is not automatically biometric data; Article 9’s stricter regime kicks in only if you process the audio specifically to identify a caller, such as voice-recognition authentication.³ The regulation also reaches beyond Europe: a controller or processor anywhere in the world falls within it when the activity involves offering goods or services to people in the EU or monitoring their behavior there.⁴

Pick a Lawful Basis Before You Record

Article 6 lists six lawful bases: consent, contractual necessity, legal obligation, vital interests, public task, and legitimate interests.⁵ You must decide which one applies and document that choice before processing begins.⁶

For most commercial call recording, the practical choice is between legitimate interests and consent. Contractual necessity covers narrow situations such as recording a financial transaction where the audio is the proof of the deal the caller asked for. Legal obligation applies when a specific rule requires retention, as with certain financial services regimes that mandate keeping evidence of advice given. Vital interests and public task rarely fit private-sector recording.

Legitimate Interests and the Three-Part Test

Legitimate interests is the basis most organizations rely on because it covers training, quality assurance, and fraud prevention without collecting individual consent. The ICO uses call recording for training as its worked example of the basis.⁷ The EDPB’s 2024 guidelines set three cumulative conditions you must satisfy and record:

Purpose test. The interest must be lawful, clearly articulated, and real. “Improving customer service” works. “We might use this someday” does not.
Necessity test. Recording must be genuinely necessary for that purpose, and no less intrusive alternative would achieve the same result. If written notes would do the job, recording fails here.
Balancing test. The caller’s rights and freedoms can still override your interest. You weigh impact on the data subject, their reasonable expectations, the nature of the data, and any safeguards that reduce intrusion.

Processing goes ahead only when your interests are not overridden by the caller’s.⁸ Recital 47 gives reasonable expectations serious weight: a customer calling their bank expects some form of recording; someone calling a florist does not.⁹ Write the assessment down. Regulators will ask for it.

When You Rely on Consent

Article 7 sets a high bar. Consent must be freely given, specific, informed, and unambiguous, and it must come through a clear affirmative act, such as an oral statement or pressing a key on the keypad.¹⁰ The familiar “by continuing this call you agree to be recorded” message is silence treated as permission, and the GDPR does not accept it.

Consent also must be genuinely optional. If the caller has no realistic route to the service except to accept recording, the consent is not freely given. Your system should keep recording paused until the caller actively signals approval for that specific call, and you must be able to prove the consent was obtained.¹¹ Withdrawal has to be as easy as giving consent. If a caller says stop, the recording stops immediately, and the withdrawal is logged.

What Callers Must Be Told Before Recording Starts

Articles 12 and 13 require you to provide certain information at the point you collect the data, in language that is concise, transparent, and easy to understand.¹² Before the recording begins, the caller needs:

The name and contact details of your organization.
The specific purposes for the recording, such as quality assurance, regulatory compliance, or dispute resolution.
The lawful basis you are relying on.
How long the recording will be kept, or the criteria used to decide.
Any third parties or categories of recipients that may receive the audio.
The caller’s rights to access, erasure, restriction, and objection.

That is a lot for an automated greeting.¹³ Most organizations use a layered notice: the essentials (identity, that recording is happening, and the purpose) go into the phone message, with a full privacy notice available at a URL mentioned in the greeting or sent afterward. The detail has to be genuinely reachable. A link buried in unread terms of service does not satisfy transparency.

Requests You Must Be Able to Handle

Callers keep their rights over the audio after the call ends. Article 15 lets them ask whether their calls have been recorded and obtain a copy along with processing details.¹⁴ Article 20 adds portability where processing is based on consent or a contract and carried out by automated means, requiring you to hand over the data in a structured, commonly used, machine-readable format such as MP3 or WAV.¹⁵

Under Article 17, a caller can ask you to delete a recording when the data is no longer needed for its original purpose, when they withdraw consent, or when the recording was unlawful. You must delete without undue delay unless an exception applies, such as a legal duty to retain the audio or a need to defend a legal claim.¹⁶ Article 18 provides a middle path: restriction, which freezes the file while a dispute is resolved or when the caller contests accuracy or lawfulness. Once restricted, the recording can only be processed with the caller’s consent, for legal claims, or to protect another person.¹⁷

Article 21 lets callers object to processing based on legitimate interests at any time. You must stop unless you can demonstrate compelling legitimate grounds that override the caller’s interests. For direct marketing, the objection is absolute.¹⁸

The clock is short. Article 12(3) gives you one month to respond, extendable by up to two additional months for complex or high-volume requests, provided you notify the requester of the extension within that first month and explain why.¹⁹ If your archive holds millions of calls with no reliable search mechanism, you will miss deadlines.

Employees on the Call Are Data Subjects Too

Recording an agent’s voice is processing their personal data, and every requirement above runs in parallel for staff. Consent is a poor basis in the employment context because of the power imbalance: an employee who fears discipline for refusing has not freely consented. Legitimate interests is usually the better fit, with the same three-part assessment weighing training and quality needs against employee privacy. The monitoring must be proportionate. Recording every second of every shift to catch rare misconduct is hard to defend when spot-checks would work.

Tell employees what is recorded, why, how long it is kept, and who can listen. Each purpose needs its own documented justification. Repurposing quality-assurance audio to build a disciplinary case, without having identified that purpose in advance, is a fast route to a complaint at a supervisory authority.

When a DPIA Is Required

Article 35 requires a Data Protection Impact Assessment before any processing likely to result in a high risk to individuals’ rights and freedoms.²⁰ Large-scale call recording often clears that threshold, particularly if you are systematically monitoring employees, running voice analytics against the audio, or capturing conversations that touch health, financial, or other sensitive information. A DPIA is specifically mandatory for systematic and extensive automated evaluation, large-scale processing of special category data, or systematic monitoring of publicly accessible areas, and many national supervisory authorities add employee monitoring to their own lists. If you are recording thousands of calls a day, do the assessment.

Map the data flows, identify risks to callers and staff, test whether the lawful basis holds, and document the safeguards. Doing this before launch is far cheaper than doing it after a complaint.

Storage, Security, and Retention

Article 5’s storage limitation principle means you keep audio only as long as your documented purpose requires. If training is complete within six months, holding the file for five years is indefensible.²¹ Build a retention schedule that triggers automatic deletion or anonymization on time.

Article 32 requires technical and organizational security proportionate to the risk. For recordings, that means encryption in transit and at rest, strict role-based access, and audit logs of who listened to what and when.²² Only people who need access should have it. A breach involving audio must be reported to your supervisory authority within 72 hours of becoming aware of it, unless it is unlikely to pose a risk to the people whose data was exposed.²³

Vendors and Sub-Processors

Any external vendor handling your recordings, whether a cloud recording platform or a transcription service, is a processor under Article 28. You need a written data processing agreement in place before they touch a file. The contract must specify the subject matter and duration of processing, the types of data, and the vendor’s obligations, and must require the processor to act only on your documented instructions, keep the data confidential, assist with data subject requests, and either delete or return everything when the contract ends.²⁴ Sub-processors need your prior written authorization and the same obligations flowing down. You remain liable if the chain breaks.

Payment Card Data on Recorded Calls

If callers read out card numbers during recorded calls, the recording collides with PCI DSS, which prohibits storing full cardholder data in call recordings.²⁵ The usual fixes are pause-and-resume recording during payment capture, or redaction software that strips the card details from the audio afterward.

Sending Recordings Outside the EEA

Transferring recordings out of the EEA requires a separate legal mechanism under Chapter V. For US destinations, the EU-US Data Privacy Framework offers one route: the European Commission adopted an adequacy decision in July 2023, and a first periodic review completed in October 2024 kept it in force.²⁶ The US recipient must be a commercial organization that has self-certified with the International Trade Administration; without self-certification, the framework does not apply.²⁷

Where no adequacy decision covers the destination, the standard fallback is the Standard Contractual Clauses adopted by the European Commission in June 2021. The clauses are modular, and you pick the module matching the parties’ roles, typically controller-to-processor when sending recordings to an overseas vendor.²⁸ Signing is not enough on its own; you also need a transfer impact assessment considering whether the destination country’s laws could undermine the clauses’ protections.

What Non-Compliance Costs

Fines run on two tiers. Violations of core processing principles, including choosing the wrong lawful basis, failing to obtain valid consent, or breaching data subject rights, sit at the higher tier of up to €20 million or 4% of worldwide annual turnover.¹ Lower-tier failures, such as missing a data processing agreement or skipping a DPIA, cap at €10 million or 2% of turnover.²⁹

Beyond fines, supervisory authorities can order you to stop processing altogether, which for a call center that depends on recordings for compliance can mean shutting down until the problem is fixed. Data subjects can also sue for material or non-material damage. An order to delete an archive or halt a core process often costs more than the fine.

1
General Data Protection Regulation (GDPR). Art. 83 GDPR – General Conditions for Imposing Administrative Fines
2
Legislation.gov.uk. Regulation (EU) 2016/679 – Article 4
3
Information Commissioner’s Office. Key Data Protection Concepts
4
European Data Protection Board. Guidelines 3/2018 on the Territorial Scope of the GDPR (Article 3)
5
General Data Protection Regulation (GDPR). Art. 6 GDPR – Lawfulness of Processing
6
Information Commissioner’s Office. A Guide to Lawful Basis
7
Information Commissioner’s Office. What Is the Legitimate Interests Basis?
8
European Data Protection Board. Guidelines 1/2024 on Processing of Personal Data Based on Article 6(1)(f)
9
General Data Protection Regulation (GDPR). Recital 47 – Overriding Legitimate Interest
10
Legislation.gov.uk. Regulation (EU) 2016/679 – Article 7
11
General Data Protection Regulation (GDPR). Art. 7 GDPR – Conditions for Consent
12
General Data Protection Regulation (GDPR). Art. 12 GDPR – Transparent Information, Communication and Modalities
13
General Data Protection Regulation (GDPR). Art. 13 GDPR – Information to Be Provided Where Personal Data Are Collected from the Data Subject
14
General Data Protection Regulation (GDPR). Art. 15 GDPR – Right of Access by the Data Subject
15
General Data Protection Regulation (GDPR). Art. 20 GDPR – Right to Data Portability
16
General Data Protection Regulation (GDPR). Art. 17 GDPR – Right to Erasure (Right to Be Forgotten)
17
General Data Protection Regulation (GDPR). Art. 18 GDPR – Right to Restriction of Processing
18
General Data Protection Regulation (GDPR). Art. 21 GDPR – Right to Object
19
GDPR-Text.com. Article 12 GDPR – Transparent Information, Communication and Modalities
20
General Data Protection Regulation (GDPR). Art. 35 GDPR – Data Protection Impact Assessment
21
General Data Protection Regulation (GDPR). Art. 5 GDPR – Principles Relating to Processing of Personal Data
22
General Data Protection Regulation (GDPR). Art. 32 GDPR – Security of Processing
23
European Data Protection Board. Guidelines 9/2022 on Personal Data Breach Notification Under GDPR
24
General Data Protection Regulation (GDPR). Art. 28 GDPR – Processor
25
PCI Security Standards Council. Information Supplement: Protecting Telephone-Based Payment Card Data
26
European Commission. Data Protection Adequacy for Non-EU Countries
27
EU-U.S. Data Privacy Framework. EU-U.S. Data Privacy Framework (DPF) – Program Overview
28
European Commission. New Standard Contractual Clauses – Questions and Answers Overview
29
General Data Protection Regulation (GDPR). Fines and Penalties – General Data Protection Regulation