GDPR & Call Recording in 2026: What UK Businesses Need to Know

Recording business calls is legal in the UK — but only if you do it properly. GDPR (and the UK's Data Protection Act 2018) requires a clear lawful basis, transparent notice to callers, and appropriate handling of the data you capture.

For businesses using AI to analyse those recordings — extracting names, phone numbers, sensitive personal data — the compliance bar is higher still. You need to understand how the data is processed, where it's stored, who has access, and how long it's retained.

The good news: modern AI call-intelligence platforms are built with data-protection by design. Access controls, retention policies, subject-access request tooling and export workflows are all standard.

This article covers: the lawful basis to use for business call recording, how to word your caller notification, GDPR-safe retention windows, subject-access request workflows, and what to look for in the data-processing addendum of any call-intelligence vendor.