"This call may be recorded for training and quality purposes." You have heard it a thousand times. But why do companies actually record calls, what does UK law require of them, and what rights do you have over a recording of your own voice? This guide explains the reasons behind call recording and, just as importantly, the protections you can rely on.
This is general information, not legal advice. For your specific situation, see the ICO's guidance or take professional advice.
Why companies record calls
Recording calls is routine across banking, insurance, utilities, retail and beyond. The reasons are mostly practical and, in regulated industries, sometimes mandatory.
- Training and quality. Recordings let firms coach staff, check that customers are treated fairly, and improve scripts and processes.
- Dispute resolution. If a customer and a company disagree about what was promised, a recording is an objective record. It protects customers as much as firms — "you told me there was no fee" is far easier to resolve when the call exists.
- Compliance and regulation. In sectors overseen by bodies such as the Financial Conduct Authority, firms may be required to record certain conversations and keep them for set periods. Recordings demonstrate that rules were followed and that advice or information was given correctly.
- Fraud prevention and security. Recordings help verify identity, investigate suspicious activity and protect both sides against fraud.
- Accuracy. A recording captures exactly what was agreed — account changes, instructions, consents — reducing costly mistakes.
Call recording cuts both ways. The same recording a firm keeps to protect itself is also the evidence that protects you if a promise is broken or a mistake is made.
Many firms explain this openly. UK lender Credicorp, for example, sets out why it records its calls — covering training, dispute resolution and compliance — which is a useful illustration of the standard reasons a regulated business gives, and of the kind of transparency customers should expect.
A recording is personal data
Here is the crucial legal point: a recording of an identifiable person is personal data. Your voice, combined with what you say (your name, account details, circumstances), identifies you. That means call recording is governed by the UK GDPR and the Data Protection Act 2018, and firms must handle recordings accordingly.
In practice, that imposes several duties on the organisation doing the recording.
A lawful basis
A firm cannot record simply because it wants to. It needs a lawful basis under the UK GDPR — often "legitimate interests" (for example, training and dispute resolution) or "legal obligation" (where a regulator requires recording). Where the recording captures special category data, additional conditions apply.
Transparency
Firms must process personal data fairly and transparently, which means telling you that the call is being recorded and why. This is the reason for the announcement at the start of a call or a clear notice beforehand. Recording people secretly, without a clear basis and notice, is where organisations get into trouble. This duty of openness mirrors the wider principles in our guide to UK GDPR for marketers.
Purpose limitation and retention
Recordings should be used only for the purposes customers were told about, kept securely, and held only for as long as necessary. Storing recordings forever "just in case" is not compliant; firms should have a retention schedule and delete recordings when the purpose has passed (unless a regulator requires longer retention).
Security
Because recordings are personal data, they must be protected with appropriate security — controlled access, encryption where appropriate, and safeguards against leaks. This is the same discipline that underpins identity verification and other sensitive data handling.
Your rights over recordings
You are not a passive subject here. The UK GDPR gives you meaningful rights over recordings that feature you:
| Right | What it means in practice |
|---|---|
| Be informed | You must be told a call is recorded and the purpose |
| Access | You can request a copy of a recording of your own call |
| Rectification | You can ask for inaccurate related personal data to be corrected |
| Erasure | You can ask for deletion in certain circumstances |
| Object | You can object to certain processing based on legitimate interests |
The right people use most is the right of access: a recording of you is your personal data, so you can make a subject access request to receive a copy. There are limited exemptions — for instance, where a recording also contains another person's personal data or relates to an ongoing investigation — but the starting point is that you can obtain it, usually free of charge.
If you want a recording, ask the firm in writing, identify the call as precisely as you can (date, time, number called), and confirm your identity. The firm normally has one calendar month to respond.
When recording goes wrong
Problems arise when organisations record without a clear basis, fail to tell people, keep recordings indefinitely, or store them insecurely. If you believe a company has mishandled a recording of you, you can:
- Complain to the company first, asking it to explain its basis and put things right.
- Escalate to the Information Commissioner's Office (ICO), the UK regulator for data protection, if you are not satisfied.
For consumers, it is also worth knowing that recordings can support a separate complaint — for example, if a recorded call shows you were given wrong information by a financial firm, that recording can strengthen your case.
The bottom line
Companies record calls for sound reasons — training, quality, dispute resolution, fraud prevention and, in regulated sectors, compliance — and the practice is entirely lawful when done properly. But a recording of you is personal data, so the firm must have a lawful basis, tell you clearly that the call is recorded and why, keep it secure, and not hang on to it longer than necessary. In return, you have real rights, including the right to request a copy of a recording that features you. If a firm gets it wrong, the ICO is the authority to turn to.