Quick answer
A UK business can legally record its phone calls provided it has a lawful basis under UK GDPR, tells people it is happening, keeps the recordings secure and for no longer than needed, and can find and produce them when someone asks. Businesses regulated by the FCA in relevant activities must record certain calls and keep them for at least five years (seven in some cases); many other firms record for training, dispute resolution or because a contract or insurer requires it. On a hosted telephony platform recording is a per-user feature switched on in the portal, with retention rules and access controls built in, which is why the compliance conversation has moved from "how do we record" to "how do we govern what we record".
I am not a lawyer and this is not legal advice; it is the practical guide we give customers before they switch recording on, and it reflects the rules as they stand in 2026. If your set-up needs the recording layer designed properly, get a no-obligation quote and we will include it.
Is it legal to record calls in the UK?
Yes, for a business, subject to data-protection law. The rules that matter:
- UK GDPR and the Data Protection Act 2018. A call recording that identifies someone is personal data. You need a lawful basis, you must tell people what you are doing and why, you must keep it secure, and you must not keep it longer than necessary.
- PECR (the Privacy and Electronic Communications Regulations) covers interception of communications; recording your own business calls for legitimate purposes is permitted provided you take reasonable steps to inform the parties.
- Consent is not usually the basis. It is hard to obtain and easy to withdraw. Most businesses rely on legitimate interests (training, quality, evidence of transactions, complaint handling) after a documented balancing test; regulated firms rely on legal obligation.
- Tell people. The standard "calls may be recorded for training and quality purposes" announcement on inbound calls, a line in your privacy notice, and staff awareness for outbound calls. Employees must also be told, and the policy should cover their personal calls.
Who must record: regulated sectors
| Sector | Requirement | Retention |
|---|---|---|
| Financial services (FCA) - firms carrying out relevant activities such as receiving, transmitting or executing client orders, and much advice and sales activity | Must record telephone conversations and electronic communications relating to those activities, including on mobiles and messaging apps used for business | At least five years; seven where a regulator requests it or under certain MiFID provisions |
| Insurance brokers and intermediaries (FCA) | Recording often required or expected for sales and advice, and standard for complaints handling | Typically the FCA five-year baseline, and longer for some policy types |
| Debt collection, claims management, consumer credit (FCA) | Widely expected for evidence of fair treatment and disclosures | Align with FCA and complaint timescales |
| Legal services | Not mandated by regulation; commonly recorded for evidence, with client confidentiality obligations to manage | Set by firm policy |
| Healthcare, care, public bodies | Recording for safety and safeguarding, with heightened sensitivity of the data | Set by policy, subject to records-management rules |
| Everyone else | Optional; recorded for training, quality and dispute resolution | Six to twelve months is common; justify anything longer |
If you are FCA-regulated, your compliance function will know exactly which activities are caught. The practical implication for telephony is that recording must cover every channel staff use for those activities - desk phones, the app, mobiles and Teams - and must be tamper-evident, searchable and retrievable within regulatory timescales. Consumer-grade recording does not meet that bar.
Retention: the part most businesses get wrong
Recordings are cheap to store and expensive to keep. Every month of retention beyond what you can justify is a month of personal data you are holding without a reason, and a month more that a subject access request or a breach could reach. Set a retention period per purpose - for example, training recordings deleted after six months, transaction evidence kept for the life of the contract plus the limitation period, regulated calls kept for five or seven years - and have the platform apply it automatically. Manual deletion never happens.
Security and access
Treat recordings like the payroll file:
- Encrypted at rest and in transit, hosted in the UK or EU, with a provider who can evidence it.
- Role-based access. Supervisors hear their teams; nobody else does; the finance director does not need to hear sales calls.
- Audit trail of who listened to what and when. Regulators ask for this; so do employment tribunals.
- Payment data. If callers read out card numbers, either pause recording during payment (PCI DSS "pause and resume") or, better, take payments through a compliant channel so card data is never spoken on a recorded line.
- Subject access requests. Individuals can ask for recordings of themselves. You need to be able to search by number and date and produce the recording within one month.
How recording works on hosted telephony
On a hosted platform recording is a feature, not a project. Typical capabilities:
- Per-user or per-group rules: record everyone in sales, nobody in HR, inbound only for reception.
- Automatic announcements on inbound calls, configurable per number.
- Retention policies applied automatically, per rule.
- Search and playback in the portal by number, user, date and duration, with download and audit logging.
- Pause and resume for payment details.
- Storage in the provider's UK or EU data centres, with export to your own archive if a regulator requires it.
Recording is usually a higher seat tier or a bolt-on of roughly £2 to £5 per user per month as an illustrative September 2026 guide, with long-retention or compliance-grade options priced higher; see what hosted telephony costs. For FCA firms, ask the provider specifically about compliance-grade recording: tamper evidence, retention guarantees and how mobile and Teams calls are captured.
Recording on Microsoft Teams
Teams' built-in recording is designed for meetings and does not meet compliance requirements for call recording. Businesses using Teams Phone in a regulated context need a certified third-party compliance recorder that captures Teams calls, chats and meetings under policy. Businesses that run a hosted system alongside Teams often route regulated teams through the hosted platform for exactly this reason.
Writing the policy
Ten lines that cover most businesses:
- What we record (which calls, which channels) and why (the lawful basis, with the balancing test filed).
- How we tell customers (announcement, privacy notice) and staff (policy, training, personal-call guidance).
- How long we keep each category, and that deletion is automatic.
- Who can access recordings, for what, and how that is logged.
- How we handle payments on recorded calls.
- How we handle subject access requests and regulator requests, and within what time.
- Where recordings are stored and how they are secured.
- What happens when someone leaves.
- How we review the policy, and when.
- Who owns it.
Our guide to call analytics covers the legitimate business uses that sit alongside recording - the point of recording calls, after all, is to make the next ones better.
The bottom line
Recording business calls in the UK is legal and, in regulated sectors, mandatory, provided you have a lawful basis, tell people, keep recordings secure and delete them on a schedule you can justify. Hosted telephony handles the mechanics - announcements, rules, retention, search - so the work that remains is writing the policy and choosing a provider whose recording meets your sector's standard.
If recording is part of what you need, we will design it in from the start: get a no-obligation quote or call 0333 006 9399. Our hosted telephony service page explains how the set-up works.
Not sure who is calling one of your numbers? Our free UK phone number checker shows which network or provider Ofcom allocated any number to, and whether the range is in service — no sign-up.
Frequently asked questions
Is it legal for a business to record phone calls in the UK?
Yes, provided the business has a lawful basis under UK GDPR (usually legitimate interests, or legal obligation for regulated firms), tells the people on the call that recording is happening, keeps recordings secure and retains them no longer than necessary. Consent is not normally the basis relied on.
Do I have to tell customers that calls are recorded?
Yes. Transparency is a requirement of UK GDPR and PECR. The standard approach is an announcement at the start of inbound calls, a statement in your privacy notice, and staff awareness for outbound calls.
How long should a business keep call recordings?
As long as the purpose requires and no longer. Six to twelve months is common for training and quality. Transaction evidence may justify the contract term plus the limitation period. FCA-regulated activities require at least five years, seven in some cases. Apply the period automatically.
Do FCA-regulated firms have to record calls?
Firms carrying out relevant activities - notably receiving, transmitting or executing client orders, and much advice and sales - must record telephone and electronic communications relating to those activities and retain them for at least five years. Your compliance function will confirm which activities apply to you.
Can employees ask for recordings of their calls?
Yes. Recordings are personal data, and both customers and employees can make a subject access request. You need to be able to find recordings by number and date and provide them within one month, redacting other people's data where necessary.
Does Microsoft Teams meet call recording compliance requirements?
Not natively. Teams' built-in recording is for meetings and lacks the policy-based capture, tamper evidence and retention controls regulators expect. Use a certified third-party compliance recorder with Teams Phone, or route regulated teams through a hosted platform with compliance-grade recording.
How much does call recording cost on a hosted phone system?
As an illustrative September 2026 guide, roughly £2 to £5 per user per month as a bolt-on or the difference between seat tiers, with compliance-grade, long-retention options priced higher. Storage is usually included up to a retention limit.