Recording sales calls in the UK: what the law requires.

I record my sales calls. It also comes with duties, and they come from two different laws that get muddled together.

This is a practitioner's summary, not legal advice.

The legal authority

Businesses can record calls on their own systems under section 46 of the Investigatory Powers Act 2016, and the regulations made under it: the Investigatory Powers (Interception by Businesses etc. for Monitoring and Record-keeping Purposes) Regulations 2018. Both took effect on 27 June 2018.

The regulations allow recording for purposes that include establishing facts, regulatory compliance, and checking "the standards which are achieved or ought to be achieved by persons using the telecommunication system". For a sales team, that last one covers training and quality review.

You'll still see the Lawful Business Practice Regulations 2000 named as the authority. The power they were made under, section 4 of the Regulation of Investigatory Powers Act 2000, was omitted on 27 June 2018.

Recording under these rules doesn't replace data protection law. You still need a lawful basis under UK GDPR, which is where most of the practical duties come from.

Notice duty one: your own team

The 2018 regulations require "all reasonable efforts to inform every person who may use the telecommunication system" that communications may be intercepted. That means the people making the calls, your staff. Put it in their contracts or staff handbook, and mention it when someone joins.

Notice duty two: the person you're calling

This one comes from UK GDPR's transparency rules. The Information Commission (formerly the Information Commissioner's Office, still branded ICO) says: "You must tell these people that you are recording the call and why. A recorded message is good practice."

On an inbound line, a recorded message usually does it. On an outbound sales call, the caller should say it near the start, in plain words: that the call is recorded, and why, for example for training and quality.

The ICO says the rest of the privacy information, like how long you keep recordings and the person's rights, can be given by other means, such as a link to your privacy notice.

How long to keep recordings

Recordings are likely to be personal data, so UK GDPR's storage limitation principle applies: keep them "for no longer than is necessary for the purposes". Decide your retention period, write it down, and delete recordings when it runs out.

Subject access requests

People can ask for their personal data, and the ICO says information from call recording "is likely to be personal information and you could disclose it in response to a SAR." Make sure you can find a recording by the person's name or number when someone asks.

Record with a reason

The ICO also says: "It is not usually proportionate to monitor or record the content of calls in all cases." The ICO says recording for evidence of what was agreed, or for training and quality, can be justified. Have a stated reason, and make it the one you give at the start of the call.

How KIK Studio handles it

KIK Studio records a call when the other person answers, so the recording is the conversation rather than the ringing. Recording can be switched off in settings, and recordings are kept in the workspace that made them. Saying that the call is recorded is still the caller's job.

For the rest of the calling rules, see the full UK cold calling law guide.