Business Call Recording UK: What It Does, Who Needs It, and How It Works
Call recording is one of those features that businesses either overlook entirely or assume is complicated, expensive, or legally fraught. In most cases, none of that is true. This guide covers what call recording actually does, who has a legal obligation to use it, who should be using it regardless, and how to stay on the right side of UK GDPR while doing so.
What Call Recording Actually Does
When call recording is enabled on your phone system, it captures both sides of every call — inbound and outbound — and saves the audio as a file. That file is then stored in your online portal, associated with the relevant extension, date, time, and number dialled or received.
From the portal, you can:
- Search recordings by date, phone number, or user
- Play back audio directly in the browser
- Download files for offline review or compliance submissions
- Set retention periods so recordings are automatically deleted after a defined period
There is no separate app to manage, no physical hardware, and no need to involve IT. If someone in a dispute says "I never agreed to that," you open the portal, find the call, and play it back. That is the core value proposition.
Who Is Legally Required to Record Calls
Some sectors have no choice. Call recording is a regulatory obligation, not an option.
Financial services regulated by the FCA
Under MiFID II, firms that execute client orders or provide investment advice must record all relevant telephone communications and keep those recordings for a minimum of five years. Where the advice relates to pension products, the retention period extends to seven years. This applies whether you are a discretionary fund manager, a stockbroker, a financial adviser, or a firm handling execution-only trades.
Insurance intermediaries
The Insurance Distribution Directive (IDD) imposes recording requirements on insurance intermediaries in certain circumstances, particularly where advice is given over the telephone.
NHS and social care
Some NHS services and social care settings operate under sector-specific frameworks that require call records or recordings to be retained. The specifics vary by service, but the principle — that calls may constitute part of a clinical or care record — applies broadly.
If your business falls into any of these categories, you are not making a choice about call recording. You are choosing a provider that can meet your compliance requirements.
Who Should Be Recording Without a Legal Mandate
Most businesses that record calls do so by choice, not compulsion. The reasons are practical.
Businesses that take instructions over the phone
If a client calls to authorise a transaction, change an order, approve a quote, or give instructions that you act on, having a recording of that conversation protects you. Disputes about what was said are common. Recordings end them quickly.
Professional services with professional indemnity exposure
Solicitors, accountants, architects, surveyors, and consultants all carry PI insurance. If a claim arises from advice given by telephone, a recording of that conversation is far more useful than a set of hastily typed notes made afterwards.
Businesses with frequent client disputes
If your industry generates a disproportionate number of "that is not what we agreed" conversations — recruitment, property lettings, construction, events — call recording reduces the cost and time spent resolving them.
Businesses managing remote or field-based staff
If your team takes customer calls on a mobile app rather than a desk phone, recording still applies. We cover this below.
UK GDPR and Call Recording: What You Need to Know
Call recordings contain the voice of a living individual. Under UK GDPR, they are personal data. That means you need to handle them correctly.
Lawful basis
Most businesses rely on legitimate interests as their lawful basis for recording calls — specifically, the legitimate interest in protecting the business against disputes and maintaining quality. Regulated firms typically rely on legal obligation instead. You need to identify and document your lawful basis before you start recording.
Informing callers
You must inform callers that their call may be recorded before the recording begins. The standard method is an auto-attendant greeting played at the start of the call: "Calls may be recorded for training and quality purposes." This is legally sufficient for most purposes and is precisely why having an auto-attendant matters. You cannot rely on a note in your email footer or on your website alone.
Data Processing Agreement with your provider
Your VoIP provider stores the recordings on your behalf, which makes them a data processor under UK GDPR. You need a signed Data Processing Agreement (DPA) with them before recordings start. Any reputable provider should have one available.
Retention limits
UK GDPR requires that personal data is not kept longer than necessary. You should set a retention period that matches your business need:
- FCA-regulated firms: 5 years minimum (7 for pension advice)
- General business use: 3 to 6 months is typical for dispute resolution purposes
- Longer periods may be justified where litigation is pending or foreseeable
Set your retention period, apply it consistently, and document your decision.
UK-based storage
Recordings that contain personal data should be stored within the UK or, at minimum, within a jurisdiction that provides adequate data protection. Using a provider with UK infrastructure removes this complication entirely.
Handling Common Objections
"Our staff do not want to be recorded."
This is a policy and communication matter, not a technical one. Employees should be informed that calls are recorded as part of their employment terms. The recording applies equally to all staff and is not targeted surveillance. Most employees accept this without issue once it is explained clearly and applied consistently.
"It is an expensive add-on."
It does not have to be. Call recording is included in the VoIPninjas Samurai plan at £14.99 per user per month — alongside an auto-attendant, DDI numbers, mobile app, and 750 UK minutes. There are no per-recording fees, no additional storage charges, and no separate module to activate.
What to Look for in a Call Recording Provider
Not all call recording implementations are equal. When evaluating providers, check for:
- UK-based storage — keeps you within a clear regulatory framework
- Configurable retention periods — so you can align with your legal or operational requirements
- Data Processing Agreement available — a non-negotiable for UK GDPR compliance
- No per-recording fees — storage costs that scale with call volume make budgeting unpredictable
- Mobile app recording — if your staff take calls on their phones, those calls should be captured the same as desk calls
- Searchable portal — finding a specific call quickly matters when you need it
VoIPninjas stores all recordings in UK infrastructure, provides a DPA on request, includes recording in the Samurai plan with no add-on costs, and applies recording to mobile app calls the same as desk extensions.
Call Recording on the Mobile App
Remote and field-based workers are increasingly the norm. If your team uses a VoIP mobile app to handle customer calls from their phones, those calls should be recorded under the same rules as calls made from a desk.
On the VoIPninjas Samurai plan, call recording applies to app-based calls as well as desk calls. The recordings appear in the same portal, under the same extension, and are searchable in the same way. There is no gap in coverage for staff who work outside the office.
Ready to add call recording to your business phone system? VoIPninjas Samurai includes call recording, auto-attendant, DDI numbers, and a mobile app at £14.99 per user per month — no contract, no setup fees, and a free 14-day trial with no card required. Most businesses are live within 10 working days. Start your free trial
Frequently Asked Questions
Is call recording legal in the UK?
Yes. Recording calls for business purposes is legal in the UK provided callers are informed before the recording begins and the recordings are handled in accordance with UK GDPR. The standard method for informing callers is an auto-attendant message played at the start of the call.
How long do I need to keep call recordings?
It depends on your sector. FCA-regulated firms must retain relevant recordings for five years, or seven years for pension-related advice. For businesses without a specific regulatory requirement, three to six months is a common and defensible retention period for dispute resolution purposes. You should document your chosen period and the rationale for it.
Do I need a Data Processing Agreement with my VoIP provider?
Yes. Your provider stores recordings on your behalf and is therefore a data processor under UK GDPR. A signed Data Processing Agreement must be in place before you begin recording. VoIPninjas provides a DPA on request.
Does call recording work on mobile phones?
On the VoIPninjas Samurai plan, call recording applies to calls made and received through the mobile app in the same way as calls made from a desk phone. Recordings appear in the online portal under the relevant extension and are searchable by date, number, or user.