The Compliance Hangover After the Record Button: A UK SME's Call Recording Field Guide

Most VoIP portals make call recording look like a free sweet at the counter. One toggle, no extra cost, and suddenly every inbound and outbound call is being archived. It feels efficient. It feels grown-up. Then someone from operations asks where the recordings live, a customer asks for a copy of their call, and the compliance hangover kicks in.

The recording itself is rarely the hard part. The hard part is deciding why you need it, telling people properly, keeping it for a sensible amount of time, and being able to find the right file when someone has a legal right to see it. This is practical editorial, not legal advice, but it is the sort of groundwork every UK SME should do before the record button becomes part of daily life.

The toggle is not the lawful basis

Under UK data protection rules, a recording of a call is personal data. It can include names, account details, opinions, health information, and all sorts of things you did not plan to collect. So you need a lawful basis for processing it, just as you would for a CRM record or an email inbox.

For many small firms, legitimate interests is the most likely fit: you record calls to check quality, resolve disputes, keep a reliable note of what was agreed, or protect staff from abusive behaviour. That does not mean you can record everything forever because it might be useful one day. You need a specific reason, a sensible balance between your interests and the caller's rights, and a clear explanation in your privacy notice.

Sometimes consent may be relevant, but it is rarely the neat answer people think it is. Consent has to be freely given, specific, and easy to withdraw. If a customer cannot realistically use your service without being recorded, consent is on shaky ground. A legal obligation might apply in some regulated areas, but most SMEs should start with a proper legitimate interests assessment rather than borrowing a phrase from a bank's phone menu.

The key point: a recorded message saying 'this call may be recorded' is a notification, not a magic lawful basis. The reason for recording has to exist before the audio starts piling up.

Telling callers without sounding like a call centre

You have probably heard the same clunky announcement a thousand times. 'Calls are recorded for training purposes.' Except many firms are not using recordings for training at all. They are using them for dispute resolution, quality checks or note-taking. If that is the case, say so.

A short, honest message is better than a long legal recital. Something like: 'We record calls so we can check accuracy and sort out any disputes. More detail is in our privacy notice at edentelecoms.co.uk/privacy.' Adjust the wording to your business, but keep it human. The caller should know what is happening, why it is happening, and where to read more.

Do not bury the recording notice only in a website footer. Put it at the start of the call, include it in your privacy notice, and make sure your team can answer a simple question about it without panicking. If you record video meetings or use AI transcription alongside calls, check whether those tools create their own recordings and whether your notice covers them too.

Staff are on the recording as well

Call recording is not just a customer issue. Your employees are being recorded, and that brings employment data considerations into play. If you monitor calls for quality, training or performance, staff should know what is recorded, who listens to it, how it is used, and how long it is kept.

A line in the staff handbook is a start, but it is not the whole job. Make sure managers understand the boundaries. Are recordings used in disciplinary meetings? Can supervisors dip into calls at random? Is there a process for an employee to hear a recording that involves them? If recording is widespread, a data protection impact assessment may be sensible, especially if you handle sensitive information or use automated analysis.

Also think about access. Not everyone in the business needs the keys to the recording archive. Restrict playback and download rights to people who genuinely need them, keep an audit trail where your provider offers one, and make sure leavers lose access promptly.

How long should you keep recordings?

Forever is not a retention policy. It is a storage habit. Decide on a retention period that matches your reason for recording. A common starting point is 30, 60 or 90 days for routine quality and training recordings. If a recording might be needed for a contract dispute or a legal claim, you may need to keep it longer, but that should be an exception with a clear owner, not a default setting nobody reviews.

Write the retention rule down. Set the system to delete automatically where possible. Check that backups and exports follow the same rule, because a deleted recording that lives on in a manager's downloads folder is still personal data. And if someone asks you to preserve a specific call because a complaint is brewing, make sure there is a process to put it on legal hold rather than letting the automatic purge wipe it.

When someone asks for a copy

A subject access request can include call recordings. If a customer or employee asks for their personal data, you may need to provide the audio file or a transcript, along with the other information you hold about them. You generally have one month to respond, though complex requests can sometimes be extended.

This is where sloppy recording habits hurt. If your files are named by date and extension only, finding the right call becomes a treasure hunt. Use sensible metadata: date, time, caller number, agent or team, and a reference number if you have one. Keep a searchable log.

Remember that a recording may contain other people's voices and personal data. You may need to redact or withhold parts, but you still need to handle the request properly. Do not simply refuse because it is awkward. Take advice if the call involves a third party, a dispute, or sensitive information.

A pre-flight checklist before you press record

Before you make recording the default, run through this short list:

• Write down the reason you are recording, in one plain sentence.
• Update your privacy notice so it covers calls, transcripts and any AI tools.
• Agree the caller notification wording and where it appears.
• Tell staff what is recorded, who can listen, and how recordings may be used.
• Set a retention period and switch on automatic deletion.
• Restrict access to the people who need it and review it regularly.
• Check how you would find a specific call for a subject access request.
• Decide what happens if a complaint or legal dispute means a recording must be kept longer.

None of this is glamorous. But it is much easier to sort out before the archive fills up than after a customer asks for a copy of a call you cannot find, or a colleague asks why a recording from eighteen months ago is still sitting in the portal. The record button is the easy bit. The plan behind it is what keeps a small UK firm out of trouble.