Current Location ：
Call Recording and GDPR: Practical Compliance for European Businesses
Call recording sits in an awkward regulatory position. Audio can reveal a customer's health status, financial details, or political opinions, which makes it special category data under some readings. But the same recording is often the strongest evidence when a dispute happens, and in some EU member states recording is the default rather than the exception. For communication platforms, the job is to make the right configuration achievable and auditable.
Legitimate Interest Versus Consent
Two lawful bases are commonly relied on. Consent is the strictest and the most portable across borders, but it must be freely given, specific, informed, and revocable, which is difficult to achieve when the call recording is a condition of being able to call. Legitimate interest is more commonly used for business-to-business contact centre recording, provided the organisation completes and documents a balancing test between the business need and the individual's privacy rights.
Whichever basis is used, the practical requirement is identical: the individual must know recording is happening. That means a spoken or audible announcement, or a clearly communicated equivalent, on the call.
The Configuration Checklist
| Requirement | What good looks like in practice |
|---|---|
| Notice | Audible or recorded announcement that the line may be recorded |
| Legal basis documented | Written legitimate interest assessment or consent record, dated |
| Purpose limitation | Recording used for the stated purpose, not repurposed for monitoring without reassessment |
| Retention limit | Automatic deletion after a defined period, not indefinite storage |
| Access control | Only staff with a defined need can retrieve recordings |
| Integrity | Recordings tamper-evident and exportable in a usable format |
| Subject access handling | A defined process to locate and deliver recordings for an individual |
Employee Monitoring Is a Separate Question
Customer calls and staff monitoring are treated differently. Recording a customer call and retrieving it later for a complaint requires a lawful basis for the recording. Recording staff calls for performance monitoring requires an additional assessment and, in several member states, works council involvement or collective agreement. Many organisations deliberately draw a distinction between quality monitoring and performance management, with recordings accessible only to a defined quality team.
The Right to Erasure Meets Stored Audio
A data subject access request that seeks deletion touches recorded audio directly. The operational difficulty is that recordings contain other people's voices, so a strict erasure request cannot be satisfied without assessing what happens to third-party data in the same file. This is a documented, defensible process requirement rather than a simple delete, and platforms that support granular retention and reliable export make the response far faster.
What a VoIP Platform Should Provide
- Configurable recording scope: by extension, queue, trunk, or schedule, so recording can follow risk rather than blanket coverage
- Mandatory announcement playback that cannot be disabled by local overrides
- Automatic retention expiry with administrative confirmation of deletion
- Role-based access to the recording store and an access log
- Search by caller and date so subject access requests can be answered promptly
- Export formats that preserve metadata and integrity evidence
Practical Mistakes We See Repeatedly
- Recording enabled globally 'just in case', including extensions with no recording need
- Announcements switched off on a few handsets and never switched back on
- Retention set to unlimited because storage was cheap
- Quality team and line managers sharing the same unrestricted access
- No documented balancing test, so the lawful basis cannot be evidenced later
Redstone Approach
Redstone voice platforms provide recording scope control by extension and call group, scheduled recording, configurable announcement behaviour, role-based retrieval, and retention-based automatic deletion. Because the configuration is centrally managed on the platform rather than set handset by handset, compliance settings can be reviewed and evidenced rather than assumed.
Redstone can support a compliance review of your recording configuration across multiple sites, including recording scope, announcement deployment, retention windows, and access control definitions.
Redstone Systems, Inc. founded in Delaware, USA in December 2002, has been the ODM vendor for many well-known communications companies, serving the Southeast Asian market. In 2020, Redstone Systems will begin to return to the North America market with its self-developed brand.
Redstone has a complete product line of intelligent voice gateways, providing IP-PBXs, analog VoIP gateways (FXS/FXO), digital VoIP gateways (E1/T1), border appliances, and session boundary controllers (SBCs).
With advanced technology in digital signal processor (DSP), speech coding and speech processing, as well as efficient operational tools such as cloud remote management, auto provisioning, Redstone gateways are widely used in markets of enterprise communications, cloud communications, call centers, operators’ IMS/SIP trunks, bringing users friendly, efficient and reliable communication experience.
For more information about Redstone, You can follow us on Facebook, Linkedin, and Youtube to be the first to get the latest news.
