Recording a conversation means processing personal data, often that of a third party who isn't your employee. The feature is simple to turn on; compliance takes four decisions.
1. Why are you recording
The purpose must be written down before you record, and it limits everything else. Training staff, proving an instruction, handling a complaint: these are not the same purpose, and they don't justify the same retention period. Recording "just in case" is not a purpose.
2. Who must be informed
Both sides. Your caller, through an announcement at the start of the call, and your staff, through clear information and consultation with employee representative bodies where they exist. An automatic announcement at the start of the call flow settles the first point in a minute.
3. How long do you keep recordings
As short as possible given the purpose. For training, a few weeks is enough. For a dispute, the duration of the dispute. Keeping recordings indefinitely is the most common mistake, and the easiest to fix.
4. Where recordings go, and who processes them
This is the question people forget to ask. A recording transcribed or summarised by an online artificial intelligence service leaves your infrastructure, often for a country outside the European Union. That can be acceptable, provided you know it, put safeguards in place, and state it in your register.
What helps in practice
- Record by exception rather than systematically, when the purpose allows it
- Put the information announcement in the call flow, not in a procedure nobody follows
- Be able to delete a specific recording, not just all recordings at once
- Write down, in black and white, where the processing takes place
The register, and what goes in it
Call recording must appear in your record of processing activities, with four pieces of information: the purpose, the categories of people concerned, the retention period, and the recipients. That last line is the one people forget: if a third-party service transcribes or analyses the audio, it is a recipient, and it must be listed.
Consent isn't always the right legal basis
For a recording used as commercial evidence, legitimate interest can be enough, provided you have assessed and documented it. For training, informing staff and consulting employee representative bodies matter more than individual consent, which isn't freely given in an employment relationship.
The blind spot: transcription
Many companies think they've dealt with the recording question, then discover that the audio is sent to a provider to be transcribed or summarised. That transfer changes the nature of the processing, and often the country where it takes place. Ask your supplier the question directly: where does the processing happen, and who keeps the file.
What to remember
- Write down the purpose before turning on the feature
- Inform both sides; an announcement in the call flow is enough
- Set a short retention period, and be able to delete a specific recording
- Know where transcription is processed, and write it down
At Axivox, transcription and analysis run on our own infrastructure: this is detailed on our infrastructure and GDPR page.
These four decisions get made in a single meeting, and they avoid a painful compliance fix later on.
Talk to us about itAlready recording, without being sure of the framework?
We'll tell you what the platform does with your recordings, where the processing happens, and what you need to write in your register.