Call recording is useful for proving what was agreed, training new team members and settling complaints. It's also personal data: a recording holds voices, names, numbers and often much more. That brings it under the General Data Protection Regulation (GDPR). The good news is that the GDPR doesn't forbid recording. It asks you to record for a reason, say so, and look after what you keep.
This is a practical overview, not legal advice. National laws add their own rules, so for anything sensitive, talk to your data protection officer or a lawyer.
Is call recording allowed under the GDPR?
Yes, with conditions. The core rules come from the GDPR itself:
- A lawful basis for each purpose (Article 6).
- Clear information to the people you record (Article 13).
- Purpose limitation, data minimisation and storage limitation: record only what you need, for the reason you gave, and delete it when you're done (Article 5).
- Security: only the right people can listen (Article 32).
- Rights: people can ask for access to their recordings (Article 15) and, in many cases, for deletion.
On top of the GDPR, the ePrivacy Directive protects the confidentiality of communications. It lets businesses record calls, where national law allows it, as evidence of a commercial transaction. Each country implements these rules a little differently. Our guide to call recording laws in Europe covers Germany, France, Italy and Spain.
Choose a lawful basis for each purpose
Start by writing down why you record. Each purpose needs its own basis. Common combinations:
| Purpose | Basis often used | Watch out for |
|---|---|---|
| Legally required recording (e.g. investment firms under MiFID II) | Legal obligation | Follow the sector rules on scope and retention. |
| Evidence of orders or contract changes by phone | Contract or legitimate interests | Record the relevant calls, not every call. |
| Training and quality | Legitimate interests | Do the balancing test, offer an opt-out, keep it short. |
| Recording a customer at their request | Consent | Consent must be freely given and can be withdrawn. |
Be careful with employee consent. The European Data Protection Board's guidelines on consent point out that, because of the imbalance of power at work, employees can rarely give consent freely. For staff, another basis is usually the right one.
Tell people before you record
Information has to come before the recording starts, in plain words:
- Callers: a short notice at the start of the call. "This call may be recorded for training and quality. If you'd rather not, tell the agent." Then point to your privacy notice for the details: who you are, why you record, how long you keep it, and their rights.
- Outbound calls: your agent says it at the start, or you choose not to record.
- Employees: tell them in writing which lines are recorded, when, why, who listens and for how long. Where you have a works council or staff representatives, many countries require you to involve them first.
On a Yeastar P-Series PBX you can put the notice in the greeting your callers hear first, for example in the IVR or the queue welcome prompt. Since early 2026 Yeastar can also play a tone when someone starts a one-click recording, so the other side hears that something changed.
Keep recordings only as long as you need
The GDPR has no fixed retention period. You set one per purpose and stick to it. As a reference point, France's CNIL recommends keeping training and quality recordings for at most six months, unless a law requires otherwise. Evidence of a transaction may need to be kept longer, until a claim can no longer be brought.
Don't rely on someone remembering to delete. Yeastar P-Series has an automatic clean-up for recordings: set the number of days to keep, and older files are removed on schedule. Also decide which calls to record at all. Yeastar lets you enable recording per extension, queue or trunk instead of for everything.
Control who can listen
- Limit access to recordings to the people who need them, such as team leads and quality managers.
- Give each admin their own account with two-factor authentication. Don't share logins.
- Don't download recordings to laptops or email them around. If you must share one, share the clip, not the archive.
- Write down where recordings are stored and who processes them for you, in your record of processing activities. Anyone who hosts your phone system processes data on your behalf, so you need a data processing agreement with them (Article 28).
- Be ready to answer access requests: find recordings by number and date, and remove other people's data before you hand a copy over where needed.
A quick checklist
- List your recording purposes and pick a lawful basis for each.
- Record only the lines and calls those purposes need.
- Add a notice for callers and inform your staff (and their representatives).
- Set an automatic clean-up per purpose.
- Limit access, use two-factor authentication, keep an audit trail.
- Document it: record of processing and, for large-scale or systematic monitoring, a data protection impact assessment.
On PBXfactory
Your Yeastar P-Series Cloud PBX includes call recording, and you decide in the admin panel what gets recorded and for how long. Configuring recording rules is part of setting up your PBX, so it isn't in our included support, but Yeastar's documentation explains each option and our support packages can help you set it up.