Call recording for UK business: why, how, and the GDPR / Ofcom rules

Call recording isn't a vanity feature any more. For a modern UK business, it's the cheapest dispute-resolution tool, the cleanest training feedback loop, and in regulated sectors a legal requirement. With NumberGroup Membership it's included free — no per-extension fee, no per-minute charge, no separate storage bill.

Why every UK business should be recording, the rules that actually apply (UK GDPR, PECR, sector-specific), and how to configure it without becoming a privacy problem.

Why record calls

Five operational reasons that pay back for almost any UK SME:

• Disputes. "You said it would be ready Wednesday." The recording is the answer. One avoided small-claims case pays for the system for a decade.
• Training. The fastest way to coach a sales or support team is to play back actual calls. Anonymous, specific, immediate.
• Quality monitoring. Sample 1–2% of calls, score them against a rubric. Patterns emerge fast — repeated objections, unclear pricing, scripts that aren't landing.
• Compliance. FCA-regulated firms (financial services), some healthcare and legal contexts, and some B2B contracts mandate recordings as evidence of agreed terms.
• AI and analytics. Modern transcription stacks (Whisper, deepgram, AWS Transcribe) turn recordings into structured data — sentiment, common questions, outcomes by agent. Worth doing once you have a body of calls to work with.

The UK legal picture — what actually applies

Three overlapping frameworks govern UK business call recording. The interaction trips most people up, so:

UK GDPR (Data Protection Act 2018)

A call recording is personal data. To process it lawfully you need a lawful basis. For most businesses that basis is legitimate interest (quality and training are recognised legitimate interests) or contract performance(resolving disputes about agreed terms). Explicit consent is occasionally needed but mostly isn't — the ICO has been clear on this.

You must do three things:

• Inform callers. A short recorded announcement at the start: "This call may be recorded for quality and training purposes."
• Have a documented retention policy. Don't keep recordings forever. Pick a period (3 months for training, 6 months for disputes, 5–7 years for FCA), apply it, delete on schedule.
• Secure the storage. Encrypted at rest, access logged, only the people who need to listen can.

PECR — Privacy and Electronic Communications Regulations

PECR sits alongside UK GDPR for electronic communications. The headline points: the disclosed-purpose-and-inform rule is mandatory, and you need to be transparent about who has access.

Sector-specific rules

• FCA-regulated firms (most financial services). Recordings of trades and related conversations must be kept for at least 5 years (7 if specified by ESMA). See FCA SYSC 10A.
• Healthcare. Recording patient-facing calls is sensitive — usually needs explicit consent and tighter retention controls.
• Legal. Solicitor-client privilege interacts oddly with recording. Take advice if you're recording client lines.

How call recording works on NumberGroup Membership

• Per-number / per-extension / global rules. Record everything, or only specific lines. Exclude sensitive extensions (HR, board line) where appropriate.
• Inbound, outbound, or both. Configurable.
• Pre-recording announcement. We can add the standard "this call may be recorded" greeting automatically — or you can use a bespoke recording with your own voiceover.
• Storage in our UK data centres. Encrypted at rest, access logged.
• Web-portal download and search. Filter by number, date range, extension. Listen in-browser or download as MP3.
• Retention policy. Set the auto-delete window — 30 days, 6 months, 7 years.
• No per-minute or per-recording fee. Part of the £149/mo Membership.

Common pitfalls to avoid

• No announcement. Forgetting to inform callers turns lawful recording into unlawful processing. Add the announcement on day one.
• Keeping forever. "Just in case we need them" is not a retention policy. The ICO has fined businesses for indefinite retention of voice data.
• Sharing recordings outside the business. Third-party sharing requires a clear lawful basis and often explicit consent. Don't email a recording to a supplier or post it in Slack.
• Recording sensitive lines. HR lines, whistleblowing lines, occupational-health lines should usually be excluded.
• Ignoring DSARs. Customers have the right to request copies of their own recordings under UK GDPR. Have a process to respond within 30 days.

What about recording calls with people outside the UK?

UK rules apply to you (the recorder) regardless of where the other party is. But the other jurisdiction's rules may also apply. Most EU countries match UK GDPR. Some US states (California, Florida, Maryland) require two-party consent — both parties must consent to be recorded. If you take calls from US customers, the announcement at the start of the call is what gives you that consent.