Your phone system has a "record all calls" switch, and you're wondering whether to turn it on. Maybe a customer disputed a quote last month and you had nothing but your memory to go on. Maybe you want to train a new member of staff. Or maybe you're looking at an AI receptionist and want to know what it keeps. The GDPR call recording rules don't ban recording, but they do expect you to have a reason, to tell people, and to look after what you keep.
This post sets out those rules for a small business in the UK or the EU, in plain terms, with a checklist at the end.
Why the GDPR call recording rules apply to you
A recording of a phone call is personal data. It carries the caller's voice, usually their name and number, and often whatever they said about themselves: an address, a health problem, a complaint about a neighbour. The same is true of a written log or transcript of the call. Under the UK GDPR and the EU GDPR, anything that identifies a person is personal data, and holding it means you're the "controller" with duties attached.
So the question is never "is it allowed to record?" in the abstract. It's whether you can meet the GDPR's principles for this particular recording:
- A lawful basis. You need one of the six bases in Article 6. The ICO's guide to lawful basis explains each.
- Transparency. People must be told what you're collecting and why, at the time you collect it.
- Data minimisation. Collect what you need for the purpose, not everything you could.
- Storage limitation. Keep it only as long as the purpose requires.
- Security. Protect it properly, and control who in your business can listen.
Choosing a lawful basis for recording calls
Most small businesses that record calls rely on one of two bases.
Legitimate interests
This is the usual choice for recording calls for training, quality, or keeping evidence of what was agreed. You have a genuine interest (settling disputes, improving service), recording is a reasonable way to serve it, and you've weighed that against the caller's expectations. The ICO expects you to do this weighing properly and write it down, in what it calls a legitimate interests assessment. It doesn't need to be long. A page that says why you record, why less intrusive options won't do, and what you do to protect callers is a good start.
Consent
Consent sounds safer but often isn't. Under the GDPR, consent must be freely given, specific and informed, and the person must be able to say no without losing the service. If a caller who refuses can't speak to you at all, the consent isn't free. The ICO makes this point in its innovation advice Q&As, which include a question on using a third-party supplier to create call transcripts. Its answer: consent may not be the most suitable basis, and you should look at the alternatives.
There's one case where you may need more. If callers routinely tell you about their health, or other "special category" data, you also need an Article 9 condition. A dental practice or a physiotherapist recording calls is in different territory from a plumber. That's a good reason to get advice.
What you must tell callers
The ICO's guidance on monitoring workers has a section on telephone calls. Its position on callers is direct: you must tell them that you're recording the call and why. A recorded message at the start is good practice. If that isn't possible, whoever answers should say calls may be recorded and why, and point to fuller information elsewhere, such as your website.
The fuller information is your privacy notice. The ICO's page on the right to be informed lists what it must cover, including why you process the data, how long you keep it and who you share it with. A short version for callers might be:
Two sentences, said before the conversation starts. That's the part most small businesses skip.
Recording your own staff
The same ICO guidance covers your team. You must tell workers about call monitoring in their privacy information. You shouldn't routinely monitor personal calls. The ICO also says recording every call isn't usually proportionate, and suggests itemised call records (who called whom, when, for how long) as a less intrusive option where they'd do the job.
Other laws that sit beside the GDPR
The GDPR isn't the only rule about call recording.
- UK. The Investigatory Powers (Interception by Businesses etc. for Monitoring and Record-keeping Purposes) Regulations 2018 set out when a business may record communications on its own system: for example, to establish facts, check compliance with regulatory practices or assess standards of service. Regulation 4 adds conditions, including telling the people who use the system. These regulations sit alongside the UK GDPR, so you need both.
- Germany. Section 201 of the German Criminal Code makes it an offence to record someone's non-public spoken words without authorisation. In practice, German businesses ask for agreement at the start of the call and offer an alternative to people who decline.
- Other EU countries have their own rules on top of the GDPR. Check your national data protection authority.
- Sector rules. Some regulated firms are required to record certain calls. Others, such as anyone taking card payments by phone, have to keep card numbers out of recordings.
How long to keep call recordings
The GDPR doesn't give a number. It says "no longer than necessary", and you decide what that means for your purpose, then stick to it. Some reasonable starting points:
| Purpose | A defensible retention period | Why |
|---|---|---|
| Staff training and quality checks | Weeks, not months | Once a call has been reviewed, it has done its job |
| Evidence of quotes or agreements | Until the work is done and any dispute period has passed | Tie it to the job, not the calendar |
| Complaints | Until the complaint is closed, plus a short margin | You may need to show what was said |
| Regulatory requirement | Whatever the regulator sets | The rule decides, not you |
Whatever you choose, write it down in your records of processing and make sure something actually deletes old recordings. A retention policy that nobody enforces is worse than none, because it shows you knew the rule and didn't follow it.
Subject access requests and call recordings
Anyone can ask you for a copy of the personal data you hold about them. If you record calls, that includes the recordings. The ICO's monitoring guidance says it plainly: call recordings are likely to be personal information and could be disclosed in response to a subject access request. Staff should know that what they say on recorded calls may be heard by the caller later.
You normally have one month to respond. If your phone system can't find a call by number and date, you'll struggle. Test that before you need it.
How AI phone answering changes the picture
AI receptionists are a newer question. When an AI answers your phone, what's being "recorded"? It depends entirely on the product, so ask each vendor directly. Here's what to ask, and how Klugon's AI receptionist answers each question.
Does it keep audio?
Some AI phone services store the audio of every call. Klugon doesn't. Calls are not recorded: the audio is streamed to the speech AI so it can understand the caller and reply, and no audio file is saved.
What does it keep instead?
Each call answered by the AI phone receptionist is saved as a conversation in your inbox, marked as a phone call, with its length and a text log of the messages. Be aware that this log isn't a full two-sided transcript. On the default setup it may contain only what the assistant said, not everything the caller said. If the AI captured a lead or made a booking, those details (such as name, contact details and the service booked) are saved as a lead or booking record.
So even without recordings, you're holding personal data about callers. The GDPR still applies, and your privacy notice should mention it.
Who else processes the data?
Every AI phone service relies on other companies: a phone carrier, a speech and language AI, a hosting provider. Under the GDPR those are sub-processors, and you're entitled to know who they are. Klugon is operated by a German company under the GDPR, and its privacy policy lists the sub-processors it uses and the standard contractual clauses that cover transfers outside the EU. Read that list before you sign up for any AI phone service, Klugon included.
Does it tell callers it's an AI?
This matters for transparency, and in the EU the AI Act's transparency rules for systems that interact with people apply from 2 August 2026 (see the Regulation on EUR-Lex). Klugon's default greeting is "Hello! Thank you for calling" followed by your business name, and it doesn't say it's an AI. You can write your own greeting, and we'd suggest you do. Our post on how to write a phone greeting has examples.
A sample greeting that covers both points. The business is made up.
Can you delete and export it?
In Klugon you can download a conversation's transcript, export conversations, leads and customers as CSV, and delete individual records. Full erasure of your account data is by email request, as set out in the privacy policy. Note that deleting a customer record doesn't automatically delete their conversations, leads or bookings, so handle erasure requests across each list.
A sample call where the caller asks about recording
A sample call. The business and caller are made up.
For the AI to answer like this, you add the facts about recording and your privacy notice to its knowledge. Our guide on what to teach your AI receptionist covers how.
Your call recording checklist
Work through this whether you record calls, keep AI call logs, or both.
- Decide the purpose. Training, evidence, complaints? Write it down. If you can't name one, don't record.
- Pick a lawful basis. Usually legitimate interests. Write a short assessment.
- Check for special category data. Health, religion and similar topics need an extra condition.
- Tell callers at the start. A recorded message or a line in your greeting.
- Update your privacy notice. What you keep, why, for how long, and who processes it.
- Tell your staff. In their privacy information, with a policy on personal calls.
- Set retention periods and enforce them. Check monthly that old recordings and logs are going.
- Limit access. Not everyone needs to listen to every call.
- Get processor contracts. Your phone provider and any AI vendor need a data processing agreement with you.
- Test a subject access request. Can you find one caller's calls in under an hour?
- Consider a DPIA. The ICO's guidance on data protection impact assessments explains when one is required. Large-scale monitoring of staff, or recording sensitive calls, are typical triggers.
Do you need to record calls at all?
Plenty of small businesses record calls because the phone system offered it, not because they had a reason. If your reason is "so we know what the customer wanted", a written note of the call may do that job with far less personal data. A text log is what Klugon keeps. When someone needs a person, the AI saves a lead with a note and posts it to Slack or Zapier if you've connected them (on voice Business plans and up). There's no live transfer: your team picks the call up from the note. Our post on handing calls to staff covers that in detail.
If your reason is training or disputes, recording may be justified. Just do it with the checklist above.
Frequently asked questions
Is it legal to record phone calls under GDPR?
Yes, if you have a lawful basis, tell callers, keep the recordings secure and delete them when you no longer need them. National laws add their own conditions, so check those for your country.
Do I need the caller's consent to record a call?
Not always under the GDPR. Many businesses rely on legitimate interests instead. Some countries, such as Germany, have criminal law that makes agreement at the start of the call the practical norm.
What do I have to say at the start of a recorded call?
That the call is recorded and why, and where to find more information. A short recorded message is the ICO's suggested good practice.
How long can I keep call recordings?
As long as your stated purpose needs and no longer. The GDPR sets no fixed period, so set one, write it down and enforce it.
Does Klugon record calls?
No. Klugon doesn't store call audio. It saves each call as a conversation with its length and a text log, which may contain only the assistant's side, plus any lead or booking the AI created.
Is an AI call transcript personal data?
Yes. A transcript or call log that relates to an identifiable caller is personal data, so the same rules on transparency, retention and access apply.
Can a customer ask for a copy of their call?
Yes. Recordings and call logs about a person fall within a subject access request, and you normally have one month to reply.
Is this legal advice?
No. It's a general summary for small businesses. For your specific situation, speak to a data protection adviser or solicitor.
If you're weighing up AI phone answering, the pricing page shows what each plan includes, and you can test the assistant in your browser during the trial before you connect a number.