Call recording compliance for UK recruitment agencies
Almost every recruitment agency we review has call recording switched on. Very few have the governance that is supposed to sit around it. Recordings of candidate conversations are personal data, and recruitment calls routinely stray into information that needs careful handling — health, criminal record declarations, right-to-work status, salary history. This page sets out what good looks like, in practical terms you can actually implement.
- Call recordings of candidates and contacts fall within UK GDPR scope
- Personal dataCall recordings of candidates and contacts fall within UK GDPR scope
- The standard time limit for responding to a subject access request
- 1 monthThe standard time limit for responding to a subject access request
- Access to recordings should be restricted, logged and reviewable
- Role-basedAccess to recordings should be restricted, logged and reviewable
- A defined lawful basis and a retention period, rather than “record everything, keep it forever”.
- Transparency built into the call flow so candidates and clients are properly informed.
- Encrypted storage with role-based access, so not everyone on the floor can listen to everything.
- A workable process for finding and producing a recording when someone asks for their data.
What agencies typically get wrong
These are the findings that come up repeatedly when we review an existing recruitment telephony estate.
- Recording enabled by the previous supplier with no policy, no documented lawful basis and no retention rule.
- Recordings retained indefinitely because nobody configured deletion, which quietly increases both risk and storage cost.
- Every consultant able to listen to every recording, including calls about pay, health or grievances.
- No practical way to locate the recordings relating to one named individual within the statutory response window.
- No notification to the caller at all, or a notification that was recorded years ago and no longer reflects what you do.
- Recordings held in a provider portal that you would lose access to the day you left them.
The components of a defensible setup
None of this is exotic. It is configuration and documentation — and it is far easier to do at the point of deploying a new phone system than to retrofit later.
- What we configure
- Documented reason for recording, per call type
- Why it matters
- You have to be able to state why you record, not just that you do
- What we configure
- Announcement or in-call notification, and matching privacy wording
- Why it matters
- Data subjects must be informed clearly and consistently
- What we configure
- Recording on by desk, direction or call type rather than blanket-on
- Why it matters
- Recording only what you need reduces risk and storage
- What we configure
- Automatic deletion after a set period you choose
- Why it matters
- Indefinite retention is hard to justify and easy to avoid
- What we configure
- Role-based permissions, with access events logged
- Why it matters
- Limits who can hear sensitive candidate conversations
- What we configure
- Encrypted storage, with export available to you
- Why it matters
- Protects the data and stops supplier lock-in
- What we configure
- Search by number, user, date and record
- Why it matters
- You can actually find what you are asked for, in time
- What we configure
- Access revoked as part of the offboarding process
- Why it matters
- Ex-consultants should not retain access to recordings
Want this looked at on your own setup?
A review is free, there is no obligation, and you keep the written summary either way.
Where recruitment is different from other sectors
Generic call-recording advice underestimates recruitment, because of what recruitment conversations contain.
- Candidate calls can include health information, disability and adjustment discussions, and criminal record declarations — categories requiring extra care.
- Right-to-work and immigration status conversations are routine on temp desks.
- Pay, bonus and counter-offer discussions sit in recordings that a large number of staff may be able to access by default.
- Candidates are individuals, so subject access requests are a realistic prospect rather than a theoretical one.
- Placement disputes and client complaints are frequently resolved by producing what was actually said — which is a strong argument for recording well, not for recording loosely.
The upside: recordings you can safely use
Governance is not only about risk reduction. Once recordings are properly controlled, you can use them.
- Coaching new consultants on real calls instead of role-play.
- Resolving “that is not what we agreed” disputes with clients in minutes.
- Quality-checking candidate experience across desks.
- Feeding AI call summaries and next actions into the CRM through Atom Insight, with the same access controls applied.
Call recording review checklist
- Do you have a documented lawful basis for recording, per call type?
- Are callers informed, and does the wording match your privacy notice?
- What is the retention period, and is deletion automatic?
- Who can access recordings today, and is that list justified?
- Is access logged and reviewable?
- Could you locate all recordings relating to one named person within a month?
- Is storage encrypted, and can you export your own recordings?
- Is recording access removed when a consultant leaves?
Frequently asked questions
Do we have to tell candidates we are recording?
Data protection law requires transparency with the people whose data you process, so callers should be clearly informed. We build the notification into the call flow and make sure the wording is consistent with your privacy notice. The exact wording is something to agree with whoever advises you on data protection.
How long should a recruitment agency keep call recordings?
There is no single statutory figure. The requirement is that retention is no longer than necessary for the purpose you have documented, so the answer follows your purpose — coaching needs weeks, dispute resolution may need longer. What matters is that you choose a period, can justify it, and that deletion actually happens automatically.
Can we stop consultants listening to each other’s calls?
Yes. Access is role-based, so you decide whether a consultant can hear only their own calls, whether desk managers can hear their team’s, and who can access everything. Access events can be logged for review.
What happens to our recordings if we leave you?
They are your data. Recordings are exportable, and we would rather compete on service than hold your data hostage.
Is this legal advice?
No. It is practical guidance from deploying recording for UK businesses, including regulated sectors. Your specific obligations should be confirmed with your own data protection adviser — we will configure the platform to whatever policy you set.
Related recruitment guides
Have your recording setup reviewed
We will tell you what is currently recorded, who can access it, how long it is kept — and what to change. No obligation to buy anything.
- Full audit of every line, number and contract you hold
- Honest view of what your CRM will and will not integrate with
- The call data you are not currently seeing, including missed inbound
- A written summary — yours to keep either way