Call Recording in the UK: Compliance and Best Practice

UK businesses can generally record calls for a defined business purpose, provided they are transparent about it and store the recordings responsibly. The rules are a mix of UK GDPR, the Data Protection Act 2018, and — for regulated firms — sector-specific rules from the FCA, Ofcom or MHRA.

What you must do

• Have a clear, documented lawful basis (legitimate interest is the most common).
• Tell callers you are recording, and why — an IVR message at the start of the call is the norm.
• Give callers a way to object or opt out (transfer to a non-recorded line).
• Store recordings securely, with access limited to those who need it.
• Delete recordings once the business purpose has ended — typically 6 months for training, longer for compliance.
• Include call recording in your privacy notice.

What you should not do

• Record without notice — silent recording is very rarely lawful.
• Keep recordings indefinitely because “they might be useful”.
• Share recordings outside the business without a lawful basis.
• Rely on a single admin password to protect a recording store.

Regulated sectors have extra requirements

• FCA firms — must record client-order calls and keep them for at least 5 years (7 for MiFID II).
• Legal — call recording is common for evidential reasons; strong retention policy required.
• Healthcare — record only where necessary; anonymise where possible.
• Public sector — additional guidance from ICO on surveillance and monitoring.

Retention: how long is right?

For general customer-service recording, 3–6 months is a common baseline. For sales and quality-assurance, 12 months. For regulated financial services, 5 to 7 years. Keeping recordings “forever” is not just costly — it is also a data-protection risk if the store is ever compromised.