Yes, in practice you have to tell people you are recording a sales call. UK GDPR says that when you collect someone's personal data from them, you tell them who you are and why at that moment. A recording of their voice is personal data collected from them. The Investigatory Powers Act 2016 lets a business record calls on its own system for set purposes, on condition that it tells its own staff. You do not usually need the other person's consent. You need a lawful basis, a clear statement at the start of the call, and a written privacy notice they can reach.

This is a plain-English summary of the legislation, not legal advice. Every rule below links to its source text.

The short answer

  • Tell the person at the start of the call who you are, that the call is recorded, and why.
  • Point them to your written privacy notice, on your website or in a follow-up email.
  • Tell your own staff, in writing, that their calls on the company system may be recorded.
  • Record only for a purpose you can name, such as a record of what was agreed, training or regulatory compliance.
  • Keep each recording only as long as that purpose needs, unless a regulator sets a period.
  • Be able to find a recording by phone number or contact, because the person can ask for a copy.

Two laws, two different audiences

Most of the confusion about call recording comes from mixing up two laws that speak to different people.

The Investigatory Powers Act 2016 and its 2018 business regulations decide whether a business may record calls on its own phone system at all. Their notice duty is owed to the people who use that system, which means your own staff.

UK GDPR decides what you must tell the person on the other end. A recording of an identifiable person is processing of their personal data, so the transparency rules in articles 12 and 13 apply to it. That is where the duty to tell the prospect comes from.

The answer is the same for a B2B call to a named buyer as for a call to a consumer. The TPS and CTPS split decides which calls you may make; it does not change the recording question when you are speaking to a named person.

What the Investigatory Powers Act allows a business to record

Section 3(1) makes it an offence to intentionally intercept a communication in the course of its transmission in the UK without lawful authority. On indictment the penalty is up to two years in prison, a fine, or both.

Section 4 defines interception by what it does: making the content available to a person who is not the sender or intended recipient. It also counts any time the communication is stored in or by the system, before or after transmission. So the definition reaches stored recordings, and anyone other than the two parties who listens to them, such as a manager or a quality team.

Section 3(2) takes conduct on a private system outside the offence where the person has a right to control the system's operation or use, or has the express or implied consent of someone who does. That removes the criminal offence, but the data protection rules still apply.

Lawful authority comes through section 6, which includes conduct authorised by sections 44 to 52. Two of those matter for sales teams:

  • Section 44(1) authorises interception where the sender and the intended recipient have each consented to it.
  • Section 46 authorises interception by businesses for monitoring and record-keeping, under regulations made for the purpose. The interception must use apparatus or services provided by or to the business.

Those regulations are the Investigatory Powers (Interception by Businesses etc. for Monitoring and Record-keeping Purposes) Regulations 2018. Under regulation 3, recording is authorised if the system controller does it, or another person does it with the controller's express consent, for one of these purposes:

  • establishing the existence of facts
  • ascertaining compliance with regulatory or self-regulatory practices or procedures
  • ascertaining or demonstrating the standards achieved by people using the system in their work
  • national security
  • preventing or detecting crime
  • investigating or detecting unauthorised use of the system
  • securing the effective operation of the system

My reading for a sales team: "what did we agree on the call" is establishing facts, FCA call taping is regulatory compliance, and training and call coaching are about standards.

Regulation 4(1) then sets conditions that must all be met. Three apply to every business. The recording is solely for monitoring or keeping a record of communications relevant to the business. The system is provided wholly or partly for the business. And the system controller has made all reasonable efforts to inform every person who may use the system that their communications may be intercepted. A fourth applies only to interception for national security.

That last condition is about the people who use your system, which in practice means your staff. A line in the employment contract or staff handbook, and a note in your calling policy, is the usual way to meet it. On its text it is not a duty to tell the person you are calling. That duty comes from UK GDPR.

What UK GDPR requires you to tell the person you are calling

Article 5(1) sets the principles. Personal data must be processed lawfully, fairly and in a transparent manner, collected for specified, explicit and legitimate purposes, limited to what is necessary, and kept no longer than necessary. Under article 5(2) you must be able to show you meet them.

Article 13 applies when you collect data from the person themselves, and a recording is exactly that. The information is due at the time the data is obtained, which for a recording means the start of the call. It includes:

  • who you are and how to contact you
  • why you are recording and your legal basis
  • your legitimate interests, if that is your basis
  • who receives the recording
  • how long you keep it, or how you decide
  • their rights, including the right to object, and the right to complain to the regulator

Article 13(4) says you need not repeat what the person already has.

Article 12(1) says the information must be concise, transparent and in clear and plain language. It is given in writing or by other means, including electronic means. It may be given orally when the person asks for that, provided their identity is proven by other means. So a spoken sentence at the start of the call is unlikely to carry the whole notice on its own. The usual pattern is a short spoken statement plus a pointer to the written privacy notice.

On a cold call there is a second notice in play. If you got the number from a bought or researched list, article 14(3)(b) says the person must have the information about that data at the latest at your first communication with them. So the opening line and the privacy notice link do two jobs on the first call: they cover the recording and the list.

Not usually. Article 6(1) lists several lawful bases, and consent is only one of them. The others include contract, legal obligation and legitimate interests. Since the Data (Use and Access) Act 2025, article 6(11)(a) names processing necessary for direct marketing as an example of processing that may be necessary for a legitimate interest.

In practice, recording sales calls for training, quality and a record of what was agreed usually sits on legitimate interests. Legitimate interests does not apply where the person's interests or rights override yours, so you weigh that and write it down. A firm that records because the FCA requires it would normally rely on legal obligation for that recording.

Consent comes back in on the interception side. Section 44 of the Investigatory Powers Act authorises recording where both parties have consented, as an alternative to the section 46 business route. A business recording its own sales calls would normally rely on section 46 and the 2018 regulations.

What to say at the start of the call

No law sets a form of words. Here is a line that covers the points, as an example rather than quoted law. Say it in the first few seconds, before the conversation starts:

"Hi, it's Sam from Acme Supplies. This call is recorded for training and so we have a record of what we agree. Our privacy notice is on our website, and I can email you the link."

That covers who you are, that the call is recorded, and why, and it points to the full notice. Then send the link in your follow-up email, and make sure the privacy notice covers call recording: purpose, basis, who receives the recordings, how long you keep them, and the person's rights. Where the line fits in a full opener is covered in cold calling scripts and rules of thumb.

Call recording and AI transcription

Many teams now pass recordings to a tool that transcribes them, summarises them or scores the call. The transcript and the summary are personal data too, and the same rules apply to them.

  • Name the purpose. Article 5(1)(b) ties use to the purposes you stated. If you told people the call is recorded for training, check that AI scoring and CRM notes fall inside that, and widen the notice if not.
  • Name the recipient. Article 13 asks who receives the data. A transcription vendor receives the recording, so list it, or its category, in the privacy notice.
  • Keep only what you need. Article 5(1)(c) limits data to what is necessary. A short summary on the CRM record may serve the purpose better than a full transcript kept forever.
  • Set retention for every copy. The audio, the transcript and the summary each need a retention period, and deleting the audio does not delete the transcript.

What if they object, or ask for the recording?

Under article 21(2) the person has the right to object at any time to processing for direct marketing, and under article 21(3) you must then stop processing their data for that purpose. Article 21(4) says the right must be brought to their attention at the latest at your first communication with them, clearly and separately from other information. If they say "don't call me again", add them to your do-not-call list. If they ask you not to record, the simplest course is to stop the recording or end the call, and note it on the record.

Under article 15 the person can ask for access to their personal data and a copy of it. A call recording is in scope. Article 15(1A) limits the duty to what you can find after a reasonable and proportionate search, so store recordings against the phone number and the contact record where you can find them.

A recording can also be your evidence when a call relies on consent. How to keep that record is in calling a TPS number with consent.

How long to keep sales call recordings

UK GDPR sets no fixed number. Article 5(1)(e) says data is kept no longer than is necessary for the purposes, so the period follows from your purpose. A recording kept as a record of an agreed order may need to last as long as the contract. A recording kept for coaching may only need a few weeks. Write the period down for each purpose, state it in the privacy notice, and delete on schedule.

The one fixed period in this area is the FCA's, and it applies only to the firms below.

Firms that must record: FCA SYSC 10A

If you sell regulated investments, the question is different: you may have to record. Chapter 10A of the FCA's SYSC sourcebook applies to MiFID investment firms and certain other firms, including AIFMs, UCITS management companies and optional exemption firms, for in-scope investment activities.

  • They must take all reasonable steps to record telephone conversations relating to those activities (SYSC 10A.1.6R), including calls intended to lead to a transaction even if none follows (10A.1.8R).
  • They must tell new and existing clients that those calls will be recorded before providing investment services (10A.1.11R), and that copies are available on request (10A.1.12AR).
  • They keep the records for five years, and up to seven where the FCA asks (10A.1.14R).

SYSC 10A does not apply to an ordinary B2B sales team. How FCA recording sits alongside the calling rules is on the financial services page.

Recording a call is not the same as a recorded call

This article is about recording a live conversation. Playing a recorded or synthetic message to the person is a different thing, governed by PECR regulation 19, and it is covered in AI cold callers and auto-diallers under PECR. Whether you may make the call at all, including TPS and CTPS screening, is a PECR question, set out in PECR explained.

TPSClear does not record calls. It writes the TPS and CTPS verdict to the CRM record before the call, which sits alongside a recording when you need to show what happened on a call.