{"id":69072,"date":"2026-07-21T07:24:00","date_gmt":"2026-07-21T04:24:00","guid":{"rendered":"https:\/\/kavkom.com\/useful-information\/gdpr-and-telephone-recordings-under-what-circumstances-can-a-company-record-calls-what-is-the-legal-basis-and-what-specific-measures-should-be-implemented\/"},"modified":"2026-07-21T20:25:12","modified_gmt":"2026-07-21T17:25:12","slug":"gdpr-and-telephone-recordings-under-what-circumstances-can-a-company-record-calls-what-is-the-legal-basis-and-what-specific-measures-should-be-implemented","status":"publish","type":"post","link":"https:\/\/kavkom.com\/en\/articles\/telephony\/gdpr-and-telephone-recordings-under-what-circumstances-can-a-company-record-calls-what-is-the-legal-basis-and-what-specific-measures-should-be-implemented\/","title":{"rendered":"GDPR and Telephone Recordings: Under What Circumstances Can a Company Record Calls, What Is the Legal Basis, and What Specific Measures Should Be Implemented?"},"content":{"rendered":"\n

You record calls at your customer service department, or you’re considering doing so. But one question remains unanswered: Do you actually have the right to do so, and on what legal basis? <\/p>\n\n

The GDPR does not prohibit telephone recordings in the workplace. It simply requires that each recording be justified by a specific purpose, a valid legal basis, clear notification to the caller, and a strictly defined retention period. Without this framework, your system exposes the company to a CNIL penalty, litigation for invasion of privacy, or the outright invalidation of your recordings as evidence in court. <\/p>\n\n

This guide translates the CNIL’s requirements into concrete actions: what legal basis to cite depending on your specific use, how to inform your callers and employees, how long to retain audio files, and what settings to configure in your business phone system.<\/p>\n\n

\n\n \n
\n
\n \n \n <\/path>\n <\/svg>\n\n \n

I recommend without hesitation<\/h3>\n \n

With Kavkom, I was able to easily resolve the issue of communication costs to my regular customers. My agents, too, were no longer restricted in their mobility, because even when on the move, communications are managed. <\/p>\n <\/div>\n\n \n

\n \n \"SEIZA\n \n
\n <\/span><\/span><\/span>\n <\/div>\n\n
\n Ben Cauchois<\/span>\n VP Sales & Operations @ SEIZA<\/span>\n <\/div>\n <\/div>\n <\/div>\n\n \n
\n

Rated 4.7\/5<\/strong> by 3,000+ sales teams<\/p>\n \n

How about you?<\/p>\n \n Request a demo now<\/a>\n <\/div>\n\n<\/div>\n\n

GDPR and Phone Recordings: Under What Circumstances Is It Legal?<\/h2>\n\n

You record your customer service calls, or you\u2019re considering doing so. But one question is holding you back: Do you actually have the right to do so, and if so, on what legal basis? The short answer is that the GDPR does not prohibit telephone recording<\/strong>. It simply requires that each recording be justified by a specific purpose, supported by a valid legal basis. <\/p>\n\n

Before going into detail on each case, here\u2019s the key principle to remember: no clear purpose, no recording. This is the principle of necessity and proportionality. Recording all calls \u201cjust in case\u201d does not hold up with the CNIL. Each recording must address an identified and documented need that is proportionate to the intended purpose. <\/p>\n\n

Purpose of the recording<\/th>Applicable Legal Basis<\/th>A concrete example<\/th><\/tr><\/thead>
Evidence of the Formation of a Contract<\/td>Performance of the Contract (Art. 6.1.b GDPR)<\/td>Signing Up for a Subscription by Phone<\/td><\/tr>
Quality Control \/ Training<\/td>Legitimate interest or explicit consent<\/td>Listening to a sample of coaching calls<\/td><\/tr>
Sector-Specific Legal Requirement<\/td>Legal obligation (Art. 6.1.c of the GDPR)<\/td>Record-keeping Requirements Under MiFID II in Finance<\/td><\/tr><\/tbody><\/table><\/figure>\n\n

This table summarizes the three main scenarios. Each is based on a distinct legal framework<\/strong>, with its own limitations and conditions. Let\u2019s take a look at what this means in practice for your business. <\/p>\n\n

Evidence of the Formation of a Contract<\/h3>\n\n

When a customer subscribes to a service or confirms an order over the phone, the recording can serve as proof that the contract was formed<\/strong>. This is most common in distance selling, telecommunications, and insurance. The legal basis here is Article 6.1.b of the GDPR: processing is necessary for the performance of the contract. <\/p>\n\n

But be careful\u2014that doesn\u2019t mean you can record the entire conversation. The principle of minimization applies: only the part where the customer gives their consent should be recorded. The rest of the exchange (preliminary questions, hesitations, side discussions) is not intended to be retained as contractual evidence. <\/p>\n\n

What about information? The caller must be informed, before the recording begins, that the call is being recorded and why. The caller must also be informed of the alternatives: Can the contract be concluded in person at a branch, online, or by mail? The law on the recording of telephone conversations<\/strong> requires this transparency. If you do not offer an alternative to recording for concluding the contract, your system is legally vulnerable. <\/p>\n\n

With a business VoIP solution like Kavkom, you can configure call<\/a> recording to start only at the exact moment the contract is confirmed\u2014not for the entire call. This type of granular control makes all the difference in ensuring compliance. <\/p>\n\n

Quality Control and Team Training<\/h3>\n\n

Your quality manager wants to listen to calls to identify areas for improvement. Your manager wants to coach a new agent on response techniques. This is a legitimate use ofcustomer service call recordings<\/strong>, provided that a specific framework is followed. <\/p>\n\n

The most common legal basis here is the company\u2019s legitimate interest (Art. 6.1.f GDPR). But this is not a blank check. You must demonstrate that the recording is proportionate to the purpose and that the rights of the data subjects (customers and employees) are not overridden by this interest. In certain cases, the explicit consent of the employee or the caller may be required, particularly when,according to the CNIL, the telephone recording<\/strong> involves a targeted sample for training purposes. <\/p>\n\n

What makes all the difference: not recording 100% of calls. The CNIL recommends working with a representative sample, not a continuous stream. Systematically recording every call for \u201cpotential\u201d use in training does not meet the proportionality test. <\/p>\n\n

Access to recordings must be restricted to authorized personnel<\/strong> only: trainers, quality managers, and designated supervisors. Kavkom allows you to manage this access using user profiles with granular permissions<\/a>, ensuring that each role has access only to the data relevant to it. <\/p>\n\n

Sector-Specific Legal Requirements<\/h3>\n\n

Some industries have no choice: recording is required by regulation, period. This is particularly true in the financial sector, where the European MiFID II directive requires investment firms to record and retain telephone conversations related to trade orders. The required retention period is up to five years. <\/p>\n\n

Emergency services (police, fire department, SAMU) are also subject to systematic record-keeping requirements for the purposes of traceability and public safety.<\/p>\n\n

In these cases, the applicable legal basis is the legal obligation<\/strong> within the meaning of Article 6.1.c of the GDPR. The company does not need to obtain the caller\u2019s consent, since it is the law on the recording of telephone conversations<\/strong> itself that requires the recording. However, the obligation to provide notice remains: the caller must be informed that the call is being recorded, even if their consent is not required. <\/p>\n\n

If your company operates in one of these sectors, your phone system must be able to ensure systematic recording, secure archiving<\/strong>, and a retention period that complies with regulatory requirements. As a 100% cloud-based solution, Kavkom securely stores recordings using encryption and allows you to configure retention policies tailored to each industry\u2019s specific requirements\u2014all in compliance with the GDPR and accessible through centralized call management<\/a>. <\/p>\n\n

Caller Information and Rights Management: Rules to Follow<\/h2>\n\n

You\u2019ve identified your legal basis and defined your purpose. But none of that matters if the caller isn\u2019t informed before the recording begins. That\u2019s the cornerstone of GDPR compliance for customer calls<\/strong>: transparency. And in practice, it all comes down to a few seconds\u2014the message your switchboard plays before connecting the caller to an agent. <\/p>\n\n

The following provides a ready-to-use message template, followed by the procedures you should implement to handle your callers’ requests for access and to opt out.<\/p>\n\n

The Preliminary Information Voice Message (with an example)<\/h3>\n\n

The GDPR and the CNIL are clear:the caller<\/strong> mustbe informed that the call is being recorded<\/strong> before any recording takes place. Not during, not after. Before. And this message must contain specific details, not just a vague \u201cthis call may be recorded.\u201d <\/p>\n\n

Here is what your advance notice<\/strong> must include:<\/p>\n\n