If your team takes calls in more than one EU country, you'll notice that recording rules aren't quite the same everywhere. All of them sit on the same base, the GDPR, but each country adds its own layer: criminal law, labour law, consumer law. This guide compares four of the biggest markets so you can set up recording that works across your team.
This is a general overview, not legal advice. Laws change and details depend on your sector, so check your own setup with a lawyer or your data protection officer.
The common layer: GDPR and ePrivacy
Everywhere in the EU, a call recording is personal data. The GDPR asks you to have a lawful basis, inform people before recording, keep recordings only as long as needed and protect them. Our GDPR call recording guide goes through those steps.
The ePrivacy Directive adds the confidentiality of communications. Its Article 5(2) allows recording that national law authorises, carried out as lawful business practice to provide evidence of a commercial transaction or other business communication. How far that goes, and what else is allowed, is decided country by country.
Germany
- Criminal law. § 201 StGB makes it an offence to record another person's non-public spoken word without authorisation, or to use such a recording, punishable by up to three years in prison or a fine. A phone call is non-public. In practice, businesses record only when the other side knows and agrees.
- Works councils. If your company has a works council (Betriebsrat), it has a right of co-determination over technical systems that can monitor employees' behaviour or performance, under § 87(1) no. 6 BetrVG. Call recording usually counts. Agree on it before you switch it on.
- What it means for you: announce recording at the start of the call, give callers a way to say no, and have a works agreement in place where there's a works council.
France
- Criminal law. Article 226-1 of the Code pénal punishes recording words spoken in private or in confidence without the speaker's consent. Consent is presumed when the person knew about the recording and didn't object although they could.
- CNIL guidance. The CNIL's page on listening to and recording calls at work sets the practical rules. Recording must have a recognised need, such as training, evaluation or service quality. Permanent, systematic recording isn't allowed unless a law requires it. Callers must be told and be able to object. Staff must be informed and their representatives consulted first. Employees need a line without recording for personal calls. Recordings are kept at most six months, evaluation documents at most one year. (The CNIL notes the page is being updated, so check it for changes.)
- What it means for you: record selectively, play a notice with an opt-out, and keep a short retention period.
Italy
- Data protection. The GDPR and Italy's privacy code apply, and the Garante enforces them. Its decisions on call centres often turn on whether callers and staff were properly informed.
- Monitoring of staff. Article 4 of the Workers' Statute (Law 300/1970) allows tools that also make remote monitoring of workers possible only for organisational and production needs, workplace safety or protecting company assets. Unless an exception applies, they need an agreement with the unions or authorisation from the National Labour Inspectorate. Employees must be told how the tools work and how checks are done. Whether a recording system falls under this depends on how it's set up, so get advice before you record staff calls.
- What it means for you: inform callers at the start of the call, check the Workers' Statute route before recording employees, and document both.
Spain
- Recording your own call. Spain's Constitutional Court held in a 1984 judgment (STC 114/1984) that a participant who records their own conversation doesn't breach the secrecy of communications. For businesses, though, the GDPR still applies in full: the Spanish data protection authority (AEPD) expects callers to be told about the recording and its legal basis at the start of the call.
- Customer service law. Ley 10/2025 applies mainly to larger companies (250+ staff or €50 million+ turnover) and to providers of basic services. When a customer files a complaint by phone and gives express consent, the company must record the call, tell the customer how to access it, and keep the recording or a transcript at least until the complaint is resolved. Companies have 12 months to adapt.
- What it means for you: a notice at the start of the call, and if the customer service law applies to you, a recording and retrieval process for complaints.
The four countries at a glance
| Germany | France | Italy | Spain | |
|---|---|---|---|---|
| Secret recording | Criminal offence | Criminal offence | Data protection and labour law issues | Participant may record, GDPR applies to businesses |
| Inform callers first | Yes, in practice consent | Yes, with opt-out | Yes | Yes, at the start of the call |
| Staff side | Works council co-determination | Inform staff, consult representatives | Union agreement or labour inspectorate | Inform staff |
| Retention guidance | Purpose-based | Recordings max. 6 months | Purpose-based | At least until a complaint is resolved (Ley 10/2025) |
Sector rules come on top
Some industries must record. Investment firms, for example, have to record certain calls under MiFID II, and those rules set their own scope and retention. If you're in a regulated sector, start from your sector rules and fit the national ones around them.
What this means for you
A setup that holds up across all four countries:
- Record only the lines and calls you have a reason to record.
- Play a short notice at the start of every recorded inbound call, and have agents announce it on outbound calls.
- Give callers and staff a way to say no, and give staff an unrecorded line for personal calls.
- Involve your works council, unions or staff representatives before you switch recording on.
- Set automatic deletion and limit who can listen.
On a Yeastar P-Series Cloud PBX from PBXfactory, recording is part of the plan, and you decide in the admin panel what's recorded and for how long. Setting up recording rules isn't in our included support, but our support packages can help.