Is it legal to record business calls in the UK?

If you run a small business and you've ever hovered over the record button wondering whether you're allowed to press it, the short answer is yes. A UK business can record its own calls, and you don't need every caller to say "I agree" first. The longer answer is "yes, with conditions", and the conditions are where the UK law on recording business calls actually lives.

The short version: two rules apply. The Telecommunications (Lawful Business Practice) (Interception of Communications) Regulations 2000 let a business record calls on its own system for listed business reasons, training and checking facts among them. UK GDPR then treats the recording as personal data: you need a lawful basis, you tell people, and you delete it when you're done.

I'm not a lawyer, and this isn't legal advice. If you're handling something sensitive (health data, legal privilege, a dispute already in motion) talk to a solicitor. What I can tell you is how these rules look from inside a business that has lived under them for a decade.

Why I've had to understand this properly

Selling and installing business phone systems has been my job since 2012, and circle.cloud, the UK telecoms company I started in 2015 that installs and supports phone systems for small businesses, has recorded its own calls for training since it began as a telemarketing operation: a script doesn't teach anyone to sell, listening back to a real call does. Evalua, which my team built, goes a step further and grades those recordings against rules an administrator sets, which could be as simple as "did they say the recording line at the start?". Once you build software whose whole job is to process other people's call recordings, you can't get away with a vague sense of what the law allows. You have to know which rule lets you record, and which rule governs the audio afterwards. They aren't the same rule.

What UK law says about recording business calls

People ask this as if there's one "is it legal" answer. There are two rules stacked on top of each other, and you need to satisfy both.

The first says you're allowed to record at all. The Telecommunications (Lawful Business Practice) (Interception of Communications) Regulations 2000 give a business the right to record calls on its own system for a specific list of business reasons: checking facts, monitoring standards and training, keeping the system running properly, preventing or detecting crime, and working out whether a call is even relevant to the business in the first place. A sales call recorded so a new starter can hear how it went sits squarely inside that list.

The second governs what you do with the recording once it exists. UK GDPR treats a call recording as personal data the moment a person's voice is identifiable in it. That means you need a lawful basis for keeping it, you have to be upfront about what's happening, and the person on the other end of the line has real rights over it, including the right to ask for a copy.

Satisfying the first rule and ignoring the second is the mistake that gets businesses in trouble. The 2000 Regulations get you as far as "you're allowed to record". UK GDPR decides whether you're doing it properly.

Do you have to tell people you're recording?

Yes. The 2000 Regulations put it as making "all reasonable efforts to inform every person who may use the telecommunication system" that calls may be recorded. In practice that's the line everyone recognises at the start of a call, or a briefed team who say it themselves when the automated version isn't practical. It doesn't need to be dramatic. It needs to happen every time, not just on the days somebody remembers.

UK GDPR's transparency principle carries the same expectation: people have a right to know their call might be recorded, roughly what it's used for, and where to find out more. A line in the greeting plus a plain-English paragraph in your privacy notice covers most of it for an ordinary small business.

Which lawful basis fits (and why consent usually doesn't)

Every use of personal data under UK GDPR needs a lawful basis, and the instinct is to reach for consent from every caller. For everyday recording that's usually the wrong one. Consent has to be freely given and easy to withdraw, which doesn't sit well with "the call is already being recorded and there's no real way to opt out halfway through".

The basis that fits most ordinary business call recording is legitimate interests: it's a genuine interest of the business to train its people and keep an accurate record, it's a reasonably expected part of dealing with a business by phone, and it doesn't override the caller's rights when it's done transparently and kept no longer than needed. If you're recording specifically for direct marketing, that's a narrower question under separate marketing rules and worth treating on its own.

How long can you keep call recordings?

There's no fixed number in the law. No "six months maximum" you'll find written down anywhere. UK GDPR's storage limitation principle says keep it only as long as you need it for the reason you recorded it, then delete it. If the reason was training, that's weeks, not years. If the reason is an ongoing dispute or a regulatory record-keeping duty, it's legitimately longer.

The trap is "storage is cheap, keep everything". That isn't a policy, it's the thing that gets flagged in an audit. Pick a period that matches the reason, write it down, and delete on schedule.

What it looks like when this goes wrong

The ICO doesn't reach for enforcement over a business that records calls with a proper announcement and a sensible retention period. It reaches for it when people had no idea it was happening. Surrey Police and Sussex Police were formally reprimanded by the ICO after more than 200,000 phone calls were recorded without the people on the other end knowing. "Nobody raised it as a problem" isn't the same as "nobody noticed".

The gap between a compliant setup and a complaint is rarely the recording itself. It's the skipped announcement, the deletion date nobody set, or having no answer when someone asks for a copy of their own call.

The practical version

For most small UK businesses it comes down to a short list:

• Record for a real business reason (training, quality, an accurate record of what was agreed).
• Tell people it's happening, at the start of the call or through a briefed team, and say roughly why.
• Pick legitimate interests as your basis for the ordinary case, and write the reasoning down.
• Set a retention period that matches the reason, and stick to it.
• Be ready to hand someone a copy of their own call within a month if they ask, and to delete it if they have a valid reason for you to.

None of that needs a legal team on retainer. It needs deciding once, on purpose, rather than defaulting to "we've always recorded everything and never really thought about it".

That's why recording and transcription are built into Olatti from day one rather than left as a setting nobody switches on, with the audio on infrastructure we run ourselves, not a third-party AI vendor's. If you're going to record calls anyway, you may as well be able to search back through what was actually said. A decade in, I can tell you the record button was never the hard part. If that's the kind of tool you'd choose rather than the one you were handed, join the waitlist and I'll let you know when it's ready.