Recording Business Calls
in the UK, Lawfully

Which laws apply

• UK GDPR and the Data Protection Act 2018: a recording of an identifiable person is personal data, so you need a lawful basis, transparency, security, a retention limit and a way to honour access and erasure requests.
• PECR (Privacy and Electronic Communications Regulations): governs marketing calls and messages, including when you need prior consent to call or text someone for marketing.
• RIPA / Investigatory Powers Act and the Telecommunications (Lawful Business Practice) Regulations 2000: allow businesses to record communications on their own systems for defined purposes (evidence of transactions, compliance, training, preventing crime) provided reasonable efforts are made to tell users of the system.
• Sector rules: FCA-regulated firms have specific recording and retention duties for certain conversations.

Consent is usually the wrong basis

Under UK GDPR consent must be freely given and withdrawable. A caller who needs to speak to you cannot realistically refuse, so "this call may be recorded" is not valid consent and should not be relied on as one. Most businesses rely on legitimate interests (quality, training, dispute resolution) or performance of a contract, document that assessment, and give clear notice. The announcement at the start of the call is the notice, not the consent.

What you must do

1. Decide and write down why you record and which lawful basis applies (a short legitimate-interests assessment).
2. Tell callers at the start of the call, and tell staff in writing, that calls are recorded and for what purpose. Put the detail in your privacy notice.
3. Set a retention period that matches the purpose, and delete automatically when it ends. Thirty to 180 days is common for quality and training; longer where a contract or regulator requires it.
4. Control access: only people who need recordings for the stated purpose, with an audit trail.
5. Secure them: encrypted in transit and at rest, stored in the UK or EU or under an approved transfer mechanism.
6. Be able to find and delete a specific person's recordings when they make a subject-access or erasure request.
7. Do not record special-category data (health, for example) unless you have a specific basis, and consider pausing recording when card details are read out.

AI transcription and summaries

Turning a recording into a transcript or summary is further processing of the same personal data. It is normally compatible with the original purpose if your notice says recordings may be transcribed and analysed, the AI provider acts as your processor under a written contract, the data is not used to train the provider's models, and the output is kept under the same retention and access rules as the audio. A summary is also a judgement about the call, so staff should treat it as a starting point and check the audio before acting on anything contentious.

How AymexConnect is built for this

• Call and meeting recording is off by default and switched on per tenant by an admin; a recording announcement can be played to callers automatically.
• Recordings and AI outputs are stored encrypted in the UK and EU, with retention periods set per plan (30 days on Starter, 180 on Professional, 365 on Ultimate) and deleted automatically.
• Access is role-based with access logging, and recordings can be deleted on request.
• AI transcripts, summaries and voicemail transcripts are produced under a processor agreement; your audio is never used to train AI models.