How to record business calls legally in the UK (2026)

A recording settles what a customer agreed and helps you coach new staff. It is legal in the UK, but many guides still quote laws replaced in 2018, and most skip data protection, which is where small businesses go wrong. This chapter of our complete guide to AI receptionists covers the law, what to say, how long to keep recordings, and five ways to record.

Line wrote this guide, and Line sells an AI receptionist. Line does not record normal calls, so it is not one of the options below. This is general information about UK law on 3 October 2026, not legal advice.

Call recording law in the UK: is it legal to record business calls?

Yes. A UK business may record calls on its own phone system for business purposes, if it makes all reasonable efforts to tell the people on those calls. Three sets of rules apply.

If a guide quotes the Regulation of Investigatory Powers Act 2000 (RIPA) or the Telecommunications (Lawful Business Practice) Regulations 2000, it is out of date. The 2016 Act repealed RIPA's interception sections during 2018 (legislation.gov.uk), and the 2018 Regulations took over from the 2000 Regulations. The Home Office says the new instrument "simply maintains the existing legal position" (explanatory memorandum). The substance is much the same; the citations are not.

What the 2018 Regulations allow

Recording a call as it passes through a phone system is "interception", and doing it without lawful authority is an offence under section 3 of the 2016 Act. The Investigatory Powers (Interception by Businesses etc. for Monitoring and Record-keeping Purposes) Regulations 2018 give a business that authority for purposes including these:

• to "establish the existence of facts", such as what a customer ordered or agreed;
• to "ascertain compliance with regulatory or self-regulatory practices or procedures";
• to "ascertain or demonstrate the standards which are achieved or ought to be achieved", which covers training and quality checks;
• to prevent or detect crime, or to detect unauthorised use of the phone system.

Regulation 4 limits this to calls relevant to the business, and requires that the business "made all reasonable efforts to inform every person who may use the telecommunication system that communications transmitted by means of that system may be intercepted". In practice: your staff and your callers.

Can you record a call you are on without telling anyone?

For business calls, no. The interception rules may not stop you, but data protection law does.

Our reading of the 2016 Act: recording your own call on your own phone is not usually interception, because interception means making the content available to "a person who is not the sender or intended recipient of the communication" (section 4). That is where the UK idea of "one-party consent" comes from.

But UK GDPR only exempts "a purely personal or household activity" (Article 2). Record a customer for your business, as a company or a sole trader, and you process their personal data. The ICO is plain: "You must tell these people that you are recording the call and why" (ICO). A secret recording of a business call breaks that duty.

Call recording and GDPR: what UK data protection law requires

A recording of an identifiable caller is personal data, so UK GDPR applies to every recording you keep. You are the controller. Your phone provider is your processor. Six duties follow.

Have a reason, and a lawful basis

Record only where you need to. The ICO says "it is not usually proportionate to monitor or record the content of calls in all cases", and that you could record business calls "if it is necessary to provide evidence of business transactions, or for training or quality control purposes" (ICO).

Most businesses rely on legitimate interests: you need a record of orders and instructions, and callers expect one. Write a half-page legitimate interests assessment. If a regulator makes you record, your basis is legal obligation. Consent rarely fits, because a caller must be free to say no and still be served; the ICO says "consent is not the only lawful basis that may be available" for call transcripts (ICO).

Tell callers, and tell your staff

The ICO calls a recorded message at the start of the call "good practice". Where you cannot play one, "you must instruct workers to inform callers that calls may be recorded and to explain the reason why". The rest, such as retention and rights, can follow by a link or an email (ICO). That is the ICO's layered approach to privacy information. Tell staff too, in their privacy information and handbook, and do not routinely record personal calls.

Set a retention period

UK GDPR sets no fixed period: "It is up to you to justify this, based on your purposes for processing" (ICO). Choose a period for each reason you record, and delete on schedule. See the retention table.

Answer access requests

A caller can ask for their recording. You must reply "within one month of receipt of the request", extendable by two months if it is complex (ICO). The ICO says workers should know "that you may release call recordings to people, if requested". Choose a system that finds one caller's recordings by phone number.

Keep recordings secure

Limit who can play recordings, and keep them in the phone system, not on personal phones or shared drives. Sign your provider's data processing agreement and ask where it stores recordings. A human answering service is your processor too: ask whether it records your calls.

Watch for sensitive details

Callers to a clinic describe symptoms; callers to a solicitor describe arrests. Health details are special category data and need an extra condition under Article 9; criminal offence details need one under Article 10. The ICO says that if monitoring is likely to capture special category data, "you must carry out a DPIA" (data protection impact assessment), and UK GDPR requires one for large-scale processing of these details (ICO). A clinic or law firm that records calls should write one.

Rules for investment firms and card payments

Two sets of rules go further: one makes some firms record, the other keeps card security codes out of every recording.

FCA SYSC 10A: some firms must record

Firms in scope of SYSC 10A, mainly MiFID investment firms and some fund managers, must "take all reasonable steps to record telephone conversations" about their investment business (10A.1.6R). They must tell clients first (10A.1.11R), keep records "for a period of five years and, where requested by the FCA, for a period of up to seven years" (10A.1.14R), and stop staff using private phones the firm cannot record (10A.1.7R). Do not assume a transcript meets this rule.

PCI DSS: never record a card security code

If you take card payments by phone, PCI DSS reaches your recordings. The PCI Security Standards Council says sensitive authentication data, which includes the card security code, "must not be stored after authorization, even if encrypted" (PCI SSC). Three ways to keep card details out:

1. Send a payment link by text or email, so card details never come up on the call.
2. Pause the recording while the caller reads out their card details, then resume. If staff pause by hand, check a sample of recordings for card details; PCI SSC recommends checking "preferably weekly".
3. Use keypad entry with tone masking, where the caller types the number on their keypad and the system hides the tones from the agent and the recording.

What to say to callers

Say three things at the start of the call: that the call is recorded, why, and where to read more. Play it as a recorded message on calls that come in. Say it yourself at the start of calls you make.

Most businesses need the call recording notice. The privacy paragraph is written for an AI; if people answer your calls, replace its virtual assistant sentence with "We record phone calls to keep a record of what we agree and to train our team."

More greetings for every situation are in business voicemail greetings and receptionist scripts.

How to record business calls: your options compared

There are five ways to record business calls in the UK. For a team, a business phone system with recording built in is the simplest: every call is recorded the same way, and recordings sit in one place. The recorders built into iPhone and Android suit one person who records now and then.

A business phone system with recording built in

Every call on the business number can be recorded, whichever app or desk phone it rings, and you control access and deletion in one place. Three UK examples from their own pricing pages, checked 3 October 2026:

• CircleLoop: both plans include "All CircleLoop features (Including call recording, conference calling & voicemail to text)" (CircleLoop pricing).
• Yay.com: call recording on Core, Standard and Premium. Recordings are stored for 30 days on Core and Standard and 12 months on Premium, with more storage for sale (Yay.com plans).
• Aircall: call recording and pause-resume recording on every plan. Essentials keeps recordings for up to a year: six months in the dashboard, the rest by request (Aircall pricing).

Before you buy, check the default storage period, a pause button for card payments, a recording notice, and an export of one caller's recordings. Our business phone systems guide compares 14 providers on published UK prices.

iPhone call recording

Since iOS 18.1, the iPhone's Phone app can record a call with one other person (Apple). Tap the record button during the call, and "both call participants hear an audio notice that the call is being recorded". The recording saves to the Notes app, with a transcript (Apple). Apple supports English (United Kingdom) transcripts, and its list of places without call recording includes the EU but not the UK (feature availability).

The notice says that you record, not why, so add one sentence. The recording then sits on one person's phone, outside any business system, and still needs a retention period. On company iPhones, you can switch it off under Settings, Apps, Phone, Audio Call Recording.

Android call recording

Google's Phone app can record one call, or always record chosen numbers. "When you start recording, both parties are notified with a disclosure that the call is being recorded", recordings stay on the device, and you can set them to delete automatically (Google). Google says "only certain devices and operators support recording calls", and other phone makers ship their own recorders. Test yours first.

Third-party call recording apps

Apps fill the gap on phones without a recorder. Check three things first:

• The notice. If the app does not tell the other person, you must.
• Where recordings go. If they leave the phone, the app maker is your processor: you need its data processing terms, and a lawful route if data leaves the UK.
• Who controls them. Recordings in each person's own account make retention and access requests hard for a team.

AI note-takers and transcription

Most AI note-takers are built for video meetings. Otter.ai, for example, "Joins Zoom, MS Teams, and Google Meet", and its free Basic plan includes 300 transcription minutes a month (Otter.ai pricing, checked October 2026). For a phone call, you usually need the call on speaker beside the app. A transcript is personal data like audio, so the same rules apply; also check whether the provider trains AI models on your conversations.

Does Line record calls?

No. Line does not record normal calls between your team and your customers today. If you need every call recorded, choose a phone system from the list above.

What Line does keep:

• Voicemails. Line records and transcribes voicemails, so your team can read a message instead of listening to it.
• Calls the AI receptionist answers. Line's AI receptionist takes the caller's details and keeps a transcript of the call, which your team reads in the Line app.
• Demo calls. Calls to the Try Molly demo on our website are recorded and kept for 90 days, and the demo tells you before the call starts.

The rules in this guide apply to those records too: say in your greetings that messages and calls are transcribed, cover them in your privacy notice, and decide how long you keep them. Plans are on the pricing page.

How long should you keep call recordings?

Keep each recording as long as the reason you recorded it lasts, and no longer. UK GDPR sets no fixed period, but some sector rules do, such as SYSC 10A. The periods below are our suggested starting points, not legal rules.

Set your system to delete at the end of each period, and check its default: one that keeps 30 days cannot meet a 90-day policy.

AI receptionists, transcripts and call recording

The same rules apply when an AI answers. A transcript of an AI-answered call is personal data, just like a recording, and the opening line is where you tell the caller: they are speaking to a virtual assistant, and the call is transcribed. An AI also brings rules a recorder does not, such as telling callers it is an AI. Our chapter on AI receptionists, GDPR and UK law covers them, with wording for your greeting and privacy notice.

A checklist before you press record

Do these before you record a real call.

Sources and how we checked them

We checked every source on 3 October 2026: legislation.gov.uk, the ICO, the FCA Handbook, the PCI Security Standards Council, Apple, Google, and the pricing pages of CircleLoop, Yay.com, Aircall and Otter.ai. Where we give our own reading of the law, we say so. If a rule or a price has changed, tell us at hello@useline.io.