Recording calls: the rules and how to do it properly

Before you start: what recording a call means

A recording contains a person's voice, often their name and number, and sometimes information about health, debts or legal matters. Under Regulation (EU) 2016/679, the GDPR, it is personal data, and keeping it is processing. The GDPR applies across the EU; each country adds its own national law on top. In Italy, for example, it applies together with the Privacy Code, Legislative Decree 196/2003 (D.Lgs. 196/2003) as amended by Legislative Decree 101/2018.

This does not mean recording is forbidden. It means that, before you flip the switch, you must be able to answer a few questions: why you record, on what basis, who knows about it, how long you keep the files and who can listen to them. If the answers are clear and written down, you are on the right track.

The checklist in six questions

Try filling in this table for your business. If a row stays empty, that is where the work is.

The accountability principle (Art. 5(2)) also requires you to be able to demonstrate the choices you made: keep a written record of your answers, for example in the record of processing activities required by Art. 30, where your organisation is obliged to keep one.

Purpose and legal basis: the choices to make first

Art. 6 of the GDPR lists the bases on which processing can be lawful. For phone recordings four routes come up most often, and none of them fits everything.

• Legal obligation: some activities must record by law. The well-known case is investment services, where the EU's MiFID II rules require conversations about orders to be recorded.
• Performance of a contract: the recording documents an agreement made over the phone, such as an order or a change to a service.
• Consent: the person agrees to be recorded. Consent must be freely given and specific, and can be withdrawn: if the person says no, you must be able to carry on the call without recording.
• Legitimate interest: for example checking service quality. It requires balancing your interest against the rights of the caller, and that balancing must be documented.

The choice of basis changes practical things: what you write in the notice, what happens if the person objects, how long you can keep the files. This is where your privacy adviser's opinion is worth most, because it depends on your sector.

One practical rule always helps: one purpose, one scope. If you record to check orders, record the order line. Switching recording on for every line «just in case» is the opposite of data minimisation.

The privacy notice: what to say, and when

Art. 13 requires you to inform the person at the time you collect the data. On the phone that means at the start of the call, before the conversation gets going. In practice a two-layer notice is used.

1. A short message on the line, which the caller hears before speaking to anyone: who is recording, why, and where to find the rest.
2. The full notice, easy to reach (a page on the website, a document sent on request), with everything Art. 13 requires: controller, purposes, legal basis, recipients, retention periods and rights.

An example of a short message, to adapt with your adviser:

Rossi & Partners. To check orders taken over the phone, this call
is recorded. The full privacy notice is at rossipartners.eu/privacy.
If you prefer not to be recorded, please tell the operator.

For outbound calls there is no automatic message: the person calling says it out loud at the start. It is worth writing a standard sentence and making sure everyone uses it in the same way.

Retention, access and security

The GDPR does not set a number of days that applies to everyone: it requires data to be kept for as long as the purpose requires. A recording made to settle disputes about an order makes sense as long as a dispute is possible; a recording made to train operators may be needed for much less. Decide the period, write it in the notice and stick to it.

On Vohippo the platform does not delete recordings by itself: the retention period is your rule, and you need to organise yourself to apply it, for example with a periodic check of downloaded files and a person in charge of doing it.

On access, the question is simple: who can listen? One or two people authorised in writing are usually enough. Portal credentials should be personal and strong, and downloaded files should not end up in folders shared with the whole office or attached to emails. Art. 32 talks about security measures appropriate to the risk: for recordings that means at least limited access, protected archives and a list of who consults them. You will find practical advice on credentials in the VoIP security guide.

If the files pass through external suppliers (the provider, a cloud archive, an agency doing quality checks), consider with your adviser whether you need a data processing agreement, as Art. 28 requires.

The rights of people who are recorded

People who are recorded keep their rights, and your process must be able to handle them.

• Access (Art. 15): the person can ask whether there are recordings concerning them and obtain a copy.
• Erasure (Art. 17) and restriction (Art. 18), in the cases the regulation provides for.
• Objection (Art. 21), particularly when the basis is legitimate interest.

In practice you need to know how to find a recording: if calls in your report are sorted by date and number, an access request can be handled in a few minutes. Note who asked for what and when you replied: the GDPR generally sets one month for the reply.

Supervisory authorities, and employees: the Italian rules

Each EU country has its own data protection authority. In Italy it is the Garante per la protezione dei dati personali (the Italian Data Protection Authority). It handles complaints, carries out inspections, publishes decisions and guidelines and can impose fines. Its decisions on recording in call centres and on telemarketing are good reading to see how the principles are interpreted: look for the ones in your sector, or ask your adviser to point them out. Outside Italy, look at what your own national authority has published.

There is also an aspect that is often forgotten: recording calls means recording the people who work for you too. In Italy, the Workers' Statute (Statuto dei lavoratori, Law 300/1970, Art. 4) governs tools that may allow remote monitoring of employees' work. Before switching recording on for a department, talk to your employment adviser as well as your privacy adviser: the Italian rules on union agreements or authorisations are a chapter of their own, and other countries have their own employment rules on monitoring.

If recording concerns many people or sensitive data, also consider with your adviser a data protection impact assessment (Art. 35), which is mandatory for some processing.

How to switch on recording on Vohippo

Recording is turned on in two different places, depending on the direction of the call.

This split helps data minimisation: you can record only the order line and leave the other lines alone, or record the outbound calls of a single operator and not those of the rest of the office.

A call is recorded only if it is answered, and only then do you pay: €0.02 per recorded call, as shown in the rates. Files are in WAV format. You listen to them and download them from the call report, next to the call's row.

Giving the notice with «Play a message» before the phone rings

For inbound calls the simplest way is to put a message read by a synthetic voice before the phone rings, in the number's routing. The «Play a message» module reads a text of up to 1000 characters and then moves to the next step; text-to-speech is included.

1. Open the number in the portal and turn on «Record incoming calls».
2. In the routing, add «Play a message» as the first step and write the text of the short notice.
3. Choose the voice (the standard one is nova) and listen to the result.
4. Add «Ring SIP accounts» as the next step, with the extensions that answer.
5. If you like, add a «Voicemail» at the end for callers when nobody answers.

The caller hears the message, then the phone rings. Remember that recording starts only when someone answers. If the number is new, the guide on how to set up an inbound number takes you through it from the start, and for an office that receives many calls the page on VoIP for call centres is worth reading too.

If after the ringing you want a voicemail or an AI secretary, remember that callers leave personal data there too: the initial notice must cover the whole path, not just the conversation with the operator. For recorded outbound calls, make sure the caller ID shows a recognisable number, so the person receiving the call knows straight away who they are talking to.

In professional firms the caution is twofold, because of professional secrecy: we cover it in the pages on VoIP for professional firms, law firms and accountants. If you need a number dedicated only to calls that are recorded, you can choose one from the virtual numbers.

If you need something the platform does not do, such as a «press 1 to accept recording» menu or transcription of the files, you need a PBX: your own, connected with a SIP trunk, or the virtual PBX from our partner robottino.ai.

Frequently asked questions