Most professional firms fall into one of two camps on call recording. Either they record everything because they assume they have to, and have never thought about how long they keep it. Or they record nothing because they assume the rules make it too difficult. Both positions are usually wrong, and the gap between them is where the actual obligations sit.
This is a plain summary of what to think about before you switch call recording on. It is not legal advice, and your own regulator and data protection adviser have the final say, but it should tell you which questions matter.
Is call recording a legal requirement?
For most solicitors and accountants, no. There is no general rule that a professional firm must record its calls. What exists instead is a patchwork: some regulated activities carry specific recording obligations, most do not, and plenty of firms record voluntarily because it settles disputes about what was said.
The important distinction is that firms carrying out certain financial services activities can face specific requirements around recording and retaining communications relating to transactions. If any part of your practice touches regulated investment or advice work, that is the point to check with your compliance lead rather than assume the general position applies.
The question is rarely "are we allowed to record". It is "what is our lawful basis, who have we told, and how long are we keeping it". Those three have answers you can write down.
What does UK GDPR require?
A recorded call is personal data. It may also contain special category data, for example where a client discusses their health, and it may contain information about criminal offences, which UK GDPR protects separately and more tightly. Financial affairs and legal instructions are not special category data in themselves, though they are obviously sensitive and still personal data. Either way you need a lawful basis for recording, and you need to be able to say what it is.
Consent is the basis most firms reach for, and it is frequently the wrong one. Consent must be freely given, and a caller who has to accept recording in order to speak to you has not freely given anything. Most firms are on firmer ground with legitimate interests, or with contractual necessity where the recording genuinely forms part of delivering the service. Either way, the reasoning should be documented before you start, not reconstructed afterwards.
Do I have to tell people I am recording?
Yes. People need to know, and a recorded announcement at the start of the call is the usual way. It should be clear about the fact of recording and, ideally, why.
The announcement is not the whole job. Your privacy notice should also cover recordings, saying what you record, why, how long you keep it and who can access it. A beep and nothing else is a common shortfall.
Staff need telling too. Recording your own employees engages their rights as well as the caller's, and it is worth being explicit in your internal policy about whether recordings are ever used for performance monitoring.
How long should call recordings be kept?
This is where most firms come unstuck, because the honest answer is "not forever" and the default configuration is often exactly that.
Storage limitation means keeping personal data no longer than necessary for the purpose you collected it for. So the retention period follows the reason. If you record to resolve disputes about instructions, the period should reflect how long such a dispute could realistically arise. If a specific regulatory obligation applies to part of your work, that obligation sets the floor for those calls.
What you should avoid is an unlimited archive that nobody has ever reviewed. It grows, it is discoverable, and if it is ever breached the scale of the problem is the scale of the archive.
Who should be able to listen to recordings?
Fewer people than currently can, in most firms we see. Access should be restricted to named roles with a reason to listen, and there should be a record of who accessed what. Recordings of legal or financial discussions are exactly the material you would least like to see leave the building.
It is also worth knowing where they physically sit. Recordings held in the UK or EEA are simpler to reason about than recordings replicated somewhere unspecified.
What to decide before you switch it on
- Which calls are recorded: all of them, inbound only, or specific teams?
- What is the lawful basis, and is it written down?
- What does the announcement say, and does the privacy notice match it?
- How long is each category kept, and what deletes them?
- Who can listen, and is that access logged?
- How would you respond if a client asked for a copy of their own call?
That last one catches people out. A caller can make a subject access request for a recording of themselves, and you need to be able to find it and provide it without handing over somebody else's data at the same time.
Call recording questions, answered
Do solicitors have to record client calls?
There is no general requirement that solicitors record calls. Many firms choose to, for evidence of instructions given over the phone. If any part of the practice carries out regulated financial services activity, specific recording obligations may apply to that work, so check with your compliance lead rather than assuming the general position covers everything.
Is consent the right lawful basis for call recording?
Often not. Consent must be freely given, and a caller who must accept recording in order to speak to you cannot freely refuse. Most firms rely on legitimate interests, or contractual necessity where recording genuinely forms part of the service. Whichever you choose, document the reasoning before you begin recording.
How long can we keep call recordings?
Only as long as necessary for the purpose you recorded them for, under the storage limitation principle. That means setting a retention period tied to the reason, and having something that actually deletes recordings when it expires. An unlimited archive is both non-compliant and a larger problem if you are ever breached.
Can a client ask for a copy of their own recorded call?
Yes. A recording of a caller is their personal data, and they can make a subject access request for it. You need to be able to locate the recording and provide it, while redacting or withholding anything that would disclose another person's data.
Do we have to tell staff their calls are recorded?
Yes. Recording engages your employees' data protection rights as well as callers'. Be explicit in your internal policy about what is recorded, why, and in particular whether recordings are ever used for performance monitoring, which people tend to feel strongly about.
How we set it up
We configure recording on your hosted phone system to match the decisions above rather than switching everything on by default. That means recording the calls you have decided to record, with retention that expires on its own, access limited to the people you name, and an announcement that matches your privacy notice.
If you are a professional firm weighing this up, we have written more about the wider setup for solicitors and for accountants and IFAs. And if you want to talk it through before committing, that is a conversation worth having with someone who has configured it before.