Business call recording: laws, consent and privacy
Separate permission to record from privacy obligations. A sourced checklist for notices, retention, employee calls and CRM exports.
Recording a business call requires two separate checks: whether recording is permitted under the laws applying to the conversation, and how you may process the personal data it contains. A recorded announcement alone does not settle either question. This guide helps you prepare a recording policy; it does not determine whether your particular use is lawful.
Editorial review: 20 October 2026. Prepared by the Heilo team using the official sources linked below. We supply recording software and have a commercial interest in this topic. We have not obtained legal opinions covering every country or US state.
Start with the real conversation
Write down where the business, employee and other participant are located, whether the call is inbound or outbound, and why you need to record it. An international call may be subject to more than one set of rules. The customer's area code is not reliable proof of their location.
| Question | What to decide before recording |
|---|---|
| Purpose | A specific purpose such as documenting an agreed order; avoid an unrestricted “future use” |
| Permission to record | Applicable confidentiality, interception and employment rules |
| Lawful basis | The lawful basis for collecting, storing, transcribing and analysing the data |
| Information to give callers | Who is recording and why, how long data is kept, who receives it, callers' rights and who to contact |
| Alternatives | How callers can continue without being recorded, where your process requires this choice |
| Access | Who can listen to recordings, read transcripts or export the data |
| Deletion | What happens in the recording platform, telephony provider and destination CRM |
EU and EEA: check the lawful basis and consent requirements
The GDPR and national rules on recording conversations address different issues. Having a lawful basis for processing personal data does not, by itself, override national restrictions on recording. Likewise, permission to record does not give you unlimited permission to use the recording for other purposes.
If your process relies on consent, it must meet the applicable requirements for freely given, specific, informed and unambiguous consent. The EDPB explains that silence or simply continuing to use a service does not count as affirmative consent. Do not assume that saying “this call is recorded” and continuing the conversation establishes valid consent in every case. See EDPB Guidelines 05/2020 on consent (checked 20 October 2026).
Where appropriate, an organisation may consider another lawful basis. It must document that assessment and separately establish whether recording is permitted. A software supplier cannot choose a lawful basis that covers every customer's conversations.
Country examples: why one script does not fit everywhere
Germany: §201 of the Criminal Code (checked 20 October 2026) addresses unauthorised recording of another person's non-public spoken words. Do not treat your participation in a conversation as blanket permission to record it.
Austria: the relevant criminal provision is §120 StGB (checked 20 October 2026). The rules depend on the circumstances and how the recording is used; “one-party recording is always allowed” is not a safe basis for a business policy.
Switzerland: the Federal Data Protection and Information Commissioner (checked 20 October 2026) explains the consent requirements for non-public conversations under Articles 179bis and 179ter of the Criminal Code, and limited exceptions under Article 179quinquies. These exceptions concern particular transactions, not every business call.
United States: Do not rely on a static list of “one-party” and “two-party” states to approve recording nationwide. Review the current rules for the relevant jurisdictions, the circumstances of the call and any conflict between states' laws. This article does not validate a policy for all fifty states or establish that an announcement is sufficient everywhere.
For other countries, seek advice on the workflow you plan to use. Offering an interface in a language does not mean a product has been legally approved for every country where that language is spoken.
Employee calls and AI analysis need their own review
Recording a call to keep a customer record, using it for sales coaching and monitoring employees are different purposes. Assess employment obligations, access and whether each use is proportionate. Do not turn an AI assessment into an automated disciplinary decision.
The EU AI Act also sets out specific restrictions. Article 5 (checked 20 October 2026) covers, among other practices, certain uses of AI to infer emotions in workplaces and education, with specified exceptions. These rules do not mean that every description of a caller's mood is banned throughout the EU. Whether a particular audio-analysis feature is permitted depends on its design and use.
Put the policy into the recording workflow
- Obtain approval for the jurisdiction, purpose and recording procedure.
- Check the greeting, how any required consent is obtained and what happens when the caller declines.
- Set access permissions by role and limit how much audio or transcript content appears in notifications.
- Set a retention period justified by the purpose; there is no universal period for all companies.
- Review the processor agreement, subprocessors and any international transfers. Server location alone does not establish compliance.
- Test how you would fulfil a request for access or deletion across the recording platform and CRM, including copies exported by an integration.
- Record the date of the review and who is responsible for it. Repeat the review when the purpose or processing changes.
What Heilo does in this process
Heilo listens to and records calls through supported telephone setups, then produces transcripts and summaries. It does not hold a conversation with the caller. With Heilo Voicemail, missed-call forwarding at your carrier captures the messages callers leave. With Heilo Select you keep your own number and add Heilo to a chosen call (your carrier must support conference calling); Heilo records from the moment it joins. Heilo Line gives each rep a +48 business number: inbound calls and outbound calls started with “Call via Heilo” are recorded automatically, with a transcript, a summary and suggested tasks, and on two-sided calls notes from the conversation coach. Once you set up an integration, the API, webhooks, Zapier or Make send the results to your own CRM.
The customer remains responsible for the recording policy and use of the data. Heilo gives you the tools to inform the caller (a notice, your own wording, a call label). Your company, as the data controller, provides the legal basis and meets the duty to inform. New numbers start in the “Announcement before the call” mode: the caller hears a notice before Heilo connects them to you, and you can change the wording or write your own. The other modes are “You tell them during the call” and “No announcement”. In every mode recording starts when the call is answered; in “You tell them during the call” Heilo marks afterwards whether the notice was given and flags the call for review if it was missing or the caller objected, but it does not delete the recording, because that decision is the controller's. With Heilo Select you inform the other party yourself. Heilo keeps a recording for 365 days by default and then deletes it; the transcript stays, and customers cannot change this period in the dashboard. A call moved to the trash is erased 30 days later together with its recording, transcript and summary; an entry with the number, date and notes remains. Heilo uses the subprocessors listed in the terms, including Twilio (telephony, a US company), Supabase (database in the EU), Vercel (hosting) and Google Gemini (transcription and analysis). Plans and prices are on the pricing page.
Review business call recording and the API documentation when designing the technical workflow.
FAQ
Is playing a recording notice enough?
It informs the caller, but does not by itself establish permission or consent in every case. The answer depends on the applicable rules and the procedure you use.
Does forwarding a call to voicemail remove privacy obligations?
No. A caller's recorded message, phone number, transcript and extracted details can contain personal data.
Can I keep recordings indefinitely because storage is cheap?
Storage cost does not justify indefinite retention. Define a retention period and deletion process that fit the approved purpose.
Does an AI summary replace the audio for a disputed agreement?
No. A summary can omit qualifications or misread a number. Check the source and use the evidence required by your policy before relying on it.
Your country
Heilo not in your country yet?
Leave your email and choose your country. We will write once, when we launch there.
