Recording sales calls under the GDPR: what EU teams need to know

Recording sales calls is legal in the EU, but the GDPR decides how you do it. You need a lawful basis, you have to tell people, and you can only keep what you need for as long as you need it. This guide walks through the rules that matter for B2B sales and service teams, with a checklist you can use before you switch recording on.

Is it legal to record sales calls in the EU?

Yes, in principle. A call recording that captures a person's voice and what they say is personal data, so the General Data Protection Regulation (GDPR) applies. The GDPR does not ban recording. It sets conditions: a lawful basis, transparency, limits on purpose and storage, and respect for people's rights.

Your organisation is the controller. That means you decide why calls are recorded and how the recordings are used, and you carry the responsibility for getting it right. A recording tool cannot make that decision for you.

National rules can add to the GDPR, for example on employee monitoring or on specific sectors. Always check the law in the countries where you and your callers are.

Choosing a lawful basis

Article 6(1) of the GDPR lists six lawful bases. Processing is only lawful if at least one applies. For call recording, three come up most often.

Performance of a contract (6(1)(b)) can sometimes apply, for example when an agreement is concluded on the call, but only where recording is genuinely necessary for that contract.

If you rely on legitimate interests, do the balancing test and write it down before you start. The European Data Protection Board's Guidelines 1/2024 on legitimate interest set out the three conditions: a legitimate interest, necessity, and a balancing of interests. People also have the right to object to processing based on legitimate interests under Article 21.

Telling callers the call is recorded

Article 13 requires you to give people information at the time you collect their data. That includes who you are, the purposes and legal basis, any legitimate interest you rely on, how long you keep the data and what rights people have.

In practice, most teams combine two layers:

1. A short statement on the call. For example: "This call is recorded for quality and training purposes."
2. A full privacy notice that the caller can easily find, with the details Article 13 requires.

The Dutch data protection authority, the Autoriteit Persoonsgegevens, says organisations must inform people at the start of the call that it is being recorded, and that a mention on a website or in general terms and conditions is not enough.

The statement is easy to forget on outbound calls, which is where a consistent check helps.

Keep only what you need

Article 5 sets the principles that shape how long and how much you record.

• Purpose limitation: record for specified, explicit purposes, and don't reuse recordings for something unrelated.
• Data minimisation: collect what is adequate, relevant and limited to what is necessary. Ask whether you need every call, or whether some lines or teams can be left out.
• Storage limitation: keep recordings in an identifiable form no longer than necessary. Set a retention period per purpose, document it and delete on schedule.

When you need a DPIA

Article 35 requires a data protection impact assessment (DPIA) when processing is likely to result in a high risk to people's rights and freedoms, particularly with new technologies. Recording calls at scale, analysing them with AI, and monitoring employees' performance are all factors that can point that way. National supervisory authorities publish lists of processing that needs a DPIA, so check your own authority's list.

A DPIA describes the processing and its purposes, assesses necessity and proportionality, and sets out the risks and the measures you take to address them. Ask your data protection officer for advice when you carry it out, as Article 35(2) requires where you have one.

Your recording vendor is a processor

If a provider stores or transcribes recordings for you, it acts as your processor. Article 28 requires a binding contract, usually called a data processing agreement (DPA), that covers the subject matter, duration, nature and purpose of processing, the types of data, and your rights and obligations. Check where the data is hosted, which sub-processors are used, and whether the vendor uses your call data for its own purposes, such as training AI models.

People can ask for their recordings

Recordings fall under data subject rights. Under Article 15, a caller can ask for access and a copy of their personal data, which includes recordings and transcripts of their calls. You must respond without undue delay and within one month, as Article 12(3) sets out, extendable in some cases. Article 15(4) adds that a copy must not adversely affect the rights and freedoms of others, which matters because a recording also contains your agent.

So you need to be able to find every call with a given person quickly. Searchable call history makes this a routine task rather than a scramble.

When the law requires recording

In some sectors recording is not optional. Under Article 16(7) of MiFID II, investment firms must record telephone conversations relating to dealing on own account and to the reception, transmission and execution of client orders, even if no transaction follows. Firms must tell clients in advance that these calls are recorded, and keep the records for five years, or up to seven where the competent authority requests it.

Where a rule like this applies, legal obligation is the likely lawful basis for those calls.

Your employees are recorded too

Every recorded call includes your own people. Their data is protected by the GDPR as well, and Article 88 allows member states to set more specific rules for employment. Tell staff clearly what is recorded, why, who can access it and how it is used in coaching or evaluation.

In the Netherlands, Article 27(1)(l) of the Wet op de ondernemingsraden (Works Councils Act) requires works council consent for arrangements suited to observing or checking employees' attendance, behaviour or performance. Call recording used for quality review can fall under this.

Be careful with emotion analysis. The EU AI Act, Article 5(1)(f), prohibits AI systems that infer the emotions of people in the workplace, except for medical or safety reasons. This has applied since 2 February 2025.

Checklist before you start recording

• Define the purposes of recording, per team or call type.
• Choose and document the lawful basis for each purpose. For legitimate interests, record the balancing test.
• Check for sector rules that require recording, and their retention periods.
• Write the on-call statement and make sure agents use it on inbound and outbound calls.
• Update your privacy notice with the Article 13 information.
• Set retention periods and a deletion routine.
• Assess whether a DPIA is needed, and carry one out if so.
• Sign a DPA with every processor, and check hosting location and sub-processors.
• Limit access to recordings by role and team.
• Prepare a process to find, review and supply recordings for access requests.
• Inform employees, and involve the works council where required.

How VOIX helps

VOIX records and transcribes the calls it receives from your phone system, hosted in the EU, with a data processing agreement available. You can set a check such as "Did the agent state that the call is recorded?" and VOIX answers it on every call, with evidence from the call behind every answer. Full-text search and a contact history make it practical to find a person's calls for an access request, and organisation and team scopes control who sees what. VOIX does not analyse tone of voice or emotion and does not create voiceprints, and call data is not used to train AI models. Read more about compliance and QA, checks and lenses and security.

This article is general information, not legal advice. Check the rules that apply to your organisation with your legal adviser or data protection officer.

New to a term? See the glossary.

VOIX for sales teamsCoach from every call, not the one you heard.