Business call recording: laws, consent and privacy
Separate permission to record from privacy obligations. A sourced checklist for notices, retention, employee calls and CRM exports.
Recording a business call requires two separate checks: whether recording is permitted under the laws applying to the conversation, and how you may process the personal data it contains. A recorded announcement alone does not settle either question. This guide helps you prepare a recording policy; it does not determine whether your particular use is lawful.
Editorial review: 11 October 2026. Prepared by the Heilo team using the official sources linked below. We supply recording software and have a commercial interest in this topic. We have not obtained legal opinions covering every country or US state.
Start with the real conversation
Write down where the business, employee and other participant are located, whether the call is inbound or outbound, and why you need to record it. An international call may be subject to more than one set of rules. The customer's area code is not reliable proof of their location.
| Question | What to decide before recording |
|---|---|
| Purpose | A specific purpose such as documenting an agreed order; avoid an unrestricted “future use” |
| Permission to record | Applicable confidentiality, interception and employment rules |
| Lawful basis | The lawful basis for collecting, storing, transcribing and analysing the data |
| Information to give callers | Who is recording and why, how long data is kept, who receives it, callers' rights and who to contact |
| Alternatives | How callers can continue without being recorded, where your process requires this choice |
| Access | Who can listen to recordings, read transcripts or export the data |
| Deletion | What happens in the recording platform, telephony provider and destination CRM |
EU and EEA: check the lawful basis and consent requirements
The GDPR and national rules on recording conversations address different issues. Having a lawful basis for processing personal data does not, by itself, override national restrictions on recording. Likewise, permission to record does not give you unlimited permission to use the recording for other purposes.
If your process relies on consent, it must meet the applicable requirements for freely given, specific, informed and unambiguous consent. The EDPB explains that silence or simply continuing to use a service does not count as affirmative consent. Do not assume that saying “this call is recorded” and continuing the conversation establishes valid consent in every case. See EDPB Guidelines 05/2020 on consent.
Where appropriate, an organisation may consider another lawful basis. It must document that assessment and separately establish whether recording is permitted. A software supplier cannot choose a lawful basis that covers every customer's conversations.
Country examples: why one script does not fit everywhere
Germany: §201 of the Criminal Code addresses unauthorised recording of another person's non-public spoken words. Do not treat your participation in a conversation as blanket permission to record it.
Austria: the relevant criminal provision is §120 StGB. The rules depend on the circumstances and how the recording is used; “one-party recording is always allowed” is not a safe basis for a business policy.
Switzerland: the Federal Data Protection and Information Commissioner explains the consent requirements for non-public conversations under Articles 179bis and 179ter of the Criminal Code, and limited exceptions under Article 179quinquies. These exceptions concern particular transactions, not every business call.
United States: Do not rely on a static list of “one-party” and “two-party” states to approve recording nationwide. Review the current rules for the relevant jurisdictions, the circumstances of the call and any conflict between states' laws. This article does not validate a policy for all fifty states or establish that an announcement is sufficient everywhere.
For other countries, seek advice on the workflow you plan to use. Offering an interface in a language does not mean a product has been legally approved for every country where that language is spoken.
Employee calls and AI analysis need their own review
Recording a call to keep a customer record, using it for sales coaching and monitoring employees are different purposes. Assess employment obligations, access and whether each use is proportionate. Do not turn an AI assessment into an automated disciplinary decision.
The EU AI Act also sets out specific restrictions. Article 5 covers, among other practices, certain uses of AI to infer emotions in workplaces and education, with specified exceptions. These rules do not mean that every description of a caller's mood is banned throughout the EU. Whether a particular audio-analysis feature is permitted depends on its design and use.
Put the policy into the recording workflow
- Obtain approval for the jurisdiction, purpose and recording procedure.
- Check the greeting, how any required consent is obtained and what happens when the caller declines.
- Set access permissions by role and limit how much audio or transcript content appears in notifications.
- Set a retention period justified by the purpose; there is no universal period for all companies.
- Review the processor agreement, subprocessors and any international transfers. Server location alone does not establish compliance.
- Test how you would fulfil a request for access or deletion across the recording platform and CRM, including copies exported by an integration.
- Record the date of the review and who is responsible for it. Repeat the review when the purpose or processing changes.
What Heilo does in this process
Heilo listens to and records calls through supported telephone setups, then produces transcripts and summaries. It does not hold a conversation with the caller. Missed-call forwarding captures messages; adding Heilo to a call captures supported live calls; a dedicated number captures calls routed through it. Outbound calls must start through Heilo.
The customer remains responsible for the recording policy and use of the data. Heilo's greeting and deletion functions are tools within that policy, rather than a legal guarantee. Review business call recording and the API documentation when designing the technical workflow.
FAQ
Is playing a recording notice enough?
It informs the caller, but does not by itself establish permission or consent in every case. The answer depends on the applicable rules and the procedure you use.
Does forwarding a call to voicemail remove privacy obligations?
No. A caller's recorded message, phone number, transcript and extracted details can contain personal data.
Can I keep recordings indefinitely because storage is cheap?
Storage cost does not justify indefinite retention. Define a retention period and deletion process that fit the approved purpose.
Does an AI summary replace the audio for a disputed agreement?
No. A summary can omit qualifications or misread a number. Check the source and use the evidence required by your policy before relying on it.
