In short: Business call recording captures inbound and outbound calls, automatically or on demand, to resolve disputes, train staff and meet regulatory duties. In the UK you should tell callers, have a lawful basis under UK GDPR, keep card details out of recordings under PCI DSS, and set retention and access rules that match your purpose.
On-demand, automatic and compliance recording
There are three common ways to record business calls:
| Type | How it works | Typical use |
|---|---|---|
| On-demand | A user starts and stops recording on a particular call | Capturing an instruction or agreement on an occasional call |
| Automatic | Calls to a queue, team or user are recorded by policy | Call centres, sales teams, quality and training |
| Compliance recording | All in-scope calls are recorded by the system, users cannot opt out, and recordings are retained and protected under policy | Regulated firms and anywhere a complete record is required |
Automatic recording of queue calls is available on all the call centre platforms we supply, although on some it depends on the tier or edition. See call centre phone systems and cloud contact centre for the wider set-up.
The UK rules in brief
This is a summary of the main rules, not legal advice. Take advice for your own circumstances, especially if you are regulated.
- UK GDPR and the Data Protection Act 2018. A recording of an identifiable person is personal data. You need a lawful basis for recording, should record only what you need for a stated purpose, and must give callers clear privacy information. The Data (Use and Access) Act 2025 amended this framework, so check that your privacy notices and policies reflect the current law.
- ICO guidance. The Information Commissioner's Office publishes guidance on data protection and on monitoring workers. Recording staff calls is a form of monitoring, so staff should know what is recorded and why.
- Telling people. The Investigatory Powers (Interception by Businesses etc. for Monitoring and Record-keeping Purposes) Regulations 2018 permit businesses to record in defined circumstances, on condition that they have made all reasonable efforts to inform every person who may use the system that communications may be intercepted. In practice that means a message at the start of inbound calls, a line in your privacy notice and clear staff policies.
- Purpose and access. Decide who can listen to recordings, log access, and do not reuse recordings for purposes callers were not told about.
Staff who handle recordings benefit from data protection training; our sister site covers GDPR training for staff.
Card payments and PCI DSS
If staff take card payments over the phone, the Payment Card Industry Data Security Standard (PCI DSS) applies to the calls as well as your payment systems. PCI DSS does not allow sensitive authentication data, such as the card security code, to be stored after authorisation, and a call recording counts as storage.
There are two common ways to stay out of trouble:
- Pause and resume. Recording pauses while the card details are given, manually or automatically, then resumes.
- Keep card data out of the call. Callers enter their card number on the keypad with the tones masked from the agent and the recording, or are sent to a secure payment link or IVR.
Pause and resume relies on people remembering, so automatic or keypad-based methods are generally more robust. Ask your payment provider which approach fits your PCI DSS assessment.
FCA rules for regulated firms
Firms in scope of the FCA's recording rules in SYSC 10A (for example MiFID investment firms and certain fund managers, for activities such as dealing and arranging deals in financial instruments) must take all reasonable steps to record relevant telephone conversations and keep copies of relevant electronic communications. The key points from the FCA Handbook:
- Clients must be told, before services are provided, that relevant calls will be recorded and that copies are available on request.
- Records must be kept for five years, and for up to seven years where the FCA requests it.
- Firms must take reasonable steps to stop staff using private devices that the firm cannot record for in-scope communications.
Check the current SYSC 10A text and your compliance adviser for exactly which staff and activities are in scope. Mobile apps and softphones need particular care, because in-scope calls must be recorded wherever staff make them.
Retention, storage and search
A good recording policy answers these questions before you switch recording on:
- How long? Long enough for your purpose and any regulatory minimum, and no longer. Retention on hosted platforms is often fixed by tier, so check it matches your policy.
- Where? Which country the recordings are stored in, and whether they are encrypted at rest.
- Who can access them? Role-based access, with managers seeing their own teams and an audit trail of who listened or downloaded.
- How do you find a call? Search by number, agent, date and queue; some platforms add transcription so you can search the words spoken.
- How do you handle requests? Callers can ask for copies of recordings of themselves, and you need to be able to find and supply them.
Recording by platform
How recording works on the platforms we supply:
| Platform | Recording | Notes |
|---|---|---|
| Forever UC Plus and Contact | Inbound and outbound call recording with easy management access | Recordings kept for 180 days; not included in the Standard tier |
| Forever Group Cloud Contact Center | Recording for compliance, training and investigations | Retention periods of up to 7 years |
| Hosted 3CX PRO and AI | Built-in call recording (not in the Basic edition), including queue options that let callers opt in or out of recording | PRO adds AI voicemail transcription; the AI edition adds start and stop recording rights, full call transcription, summaries and sentiment analysis |
| Microsoft Teams Phone | User-started convenience recording of calls, plus policy-based compliance recording through third-party solutions certified by Microsoft | Compliance Recording for Call Queues can record agent-answered queue calls; eligible licences apply |
| Webex Calling | Built-in Webex recording or a third-party recording provider | Call recording is tied to the licence type, so check it before you buy |
| Forever Teams | Optional call recording on Forever Group's Teams calling service | Ask us for retention options |
For BT Cloud Voice, see BT Cloud Voice call recording on the site run by our sister company, Forever Communications Limited.
How we help
We set up recording to match your policy rather than the other way round: which queues and users are recorded, the announcement callers hear, pause and resume or card-safe payment options, retention, and who can search and download. If you are choosing a new platform, we compare recording and retention across the options as part of the quote.
Contact us to talk through your requirements.
Why choose your cloud phone system with Forever Systems
We are vendor-neutral. Forever Group supplies and supports several cloud phone platforms, so we recommend the one that fits how your organisation works rather than the one we happen to sell.
- Side-by-side comparison of hosted 3CX, Microsoft Teams Phone, Forever UC, Forever Teams and Webex Calling for your users
- Contact centre and call recording options matched to your call volumes and CRM
- Number porting, handsets and set-up handled for you, including the move off analogue and ISDN lines
- Connectivity checked so call quality is right from day one
- UK support for moves, adds, changes and faults
- For BT Cloud Voice, see our BT Business Partner site cloudvoice.cloud
We work with businesses, schools, charities and public sector organisations. We do not sell consumer phone services.
Want a vendor-neutral cloud phone system comparison and quote?
Tell Forever Systems what you need and we will come back to you by email with options, not a hard sell.
Contact usFrequently asked questions
Is it legal to record business calls in the UK?
Generally yes, when you meet the conditions. You need a lawful basis under UK GDPR, you must make reasonable efforts to tell people that calls may be recorded, and you should record only for clear business purposes. Regulated firms may be required to record. This is not legal advice.
Do I have to tell callers that calls are recorded?
You should. UK rules on business interception require reasonable efforts to inform people, and UK GDPR requires clear privacy information. Most organisations play a short message at the start of inbound calls and explain recording in their privacy notice.
How long should we keep call recordings?
Only as long as you need them for the purpose you recorded them for, unless a regulation sets a minimum. FCA rules in SYSC 10A require in-scope firms to keep records for five years, and up to seven where the FCA requests it.
Can we record calls where customers pay by card?
Yes, but card security codes must not be stored in the recording. Use pause and resume, or better, keep card details out of the call with keypad entry that masks the tones, a payment IVR or a secure payment link.
Can Microsoft Teams record calls automatically?
Yes, through compliance recording. Microsoft supports policy-based recording through third-party solutions that pass its compliance recording certification program, including recording of call queue calls. Users can also start convenience recordings on calls where policy allows.