Compliance

GDPR call recording UK 2026: the rules in plain English

Compliance2026-05-078 min readBy Silux Call team

What UK GDPR + the Data Protection Act 2018 actually require for call recording. Lawful basis, the exact words to play, two-party-consent regions, and retention.

You need a lawful basis

Under UK GDPR Art. 6 you need one of: contract, legitimate interest, legal obligation, or consent. For most B2B "quality and training" recording, legitimate interest is the right answer.

You must notify the caller

A one-sentence pre-call announcement is sufficient. The default Silux Call prompt: "This call may be recorded for training and quality purposes. If you would prefer not to be recorded, please let us know."

Two-party consent regions

Some US states (California, Florida, Maryland, Massachusetts, Montana, Nevada, New Hampshire, Pennsylvania, Washington) require positive consent from both parties. If your business takes calls from those regions, switch to require explicit DTMF consent on the Recording Settings page.

Retention

UK GDPR says "no longer than necessary". The sweet spot for most B2B is 90 days. HIPAA tenants get locked to 2,190 days (6 years). Insurance and FCA tenants typically pick 6 years too.

What you can never do

  • Record without notification (criminal under RIPA in some scenarios).
  • Sell call recordings to third parties.
  • Use recordings to train AI without explicit consent for that purpose.
  • Refuse a data-subject access request for a recorded conversation.

One-click compliance

Dashboard → Compliance Reports → Generate produces an auditor-ready PDF in 5 seconds: 12 months of consent events, recording inventory, retention proof, and a SHA-256 of the document for tamper-evidence.

More on the blog

Move to Silux Call today.

Free seat tier. UK GBP. UK support. 24-hour porting.

Start free →