Why does this matter?
Recording devices, note-takers in video calls and phone systems that transcribe everything: capturing conversations no longer takes any effort. It also delivers a lot. But a voice and everything someone says are personal data. Anyone who records without arranging it properly risks a complaint, a fine and above all the trust of their customers.
In person or on the phone
| In-person conversation | Phone call | |
|---|---|---|
| Which law? | GDPR | GDPR and Article 124 of the Belgian Electronic Communications Act |
| Starting point | Allowed, with a valid legal basis and clear information | Prohibited, unless all participants consent or a statutory exception applies |
| In practice | Ask at the start of the conversation | Announce it in advance and give the chance to refuse |
For video calls, it is best to assume the same rule as for the phone: everyone knows in advance that the call is being recorded. Most platforms show a notice for this themselves.
What the GDPR always requires
- A valid legal basis. With customers that is usually consent. It must be freely given and can be withdrawn.
- A defined purpose. For example an accurate report and good follow-up. If you later use the recordings for something else, such as evaluating employees, that is a new purpose about which you must inform people again.
- Clear information. Who stores it, what for, for how long, and who can you turn to? That belongs in your privacy notice, and briefly also verbally.
- A retention period. "Forever" is not a period. Often it is enough to delete the audio after a few weeks and keep only the report.
- Limited access and security. Not the whole company needs to be able to listen to every conversation.
- The rights of the person recorded. Access, a copy, rectification, erasure. So you must be able to find a recording again.
- A data processing agreement with the supplier of the device, the transcription service or the phone system.
Phone calls: the Belgian rule
Article 124 of the Belgian Electronic Communications Act in principle prohibits taking note of communications or recording them without the consent of all those involved. The Data Protection Authority (the Belgian DPA) applies this to professional phone calls. There are two exceptions that businesses often invoke:
- Proof of a commercial transaction, such as an order or an assignment by phone. Condition: the parties know in advance that the call is being recorded, what for, and how long it is kept.
- Quality control in a call centre. Only for that purpose, the employees are informed in advance, and the recordings are kept for no more than one month.
Recording all calls and having them transcribed "for internal use" is hard to fit into those exceptions. Then one route remains: announce it and ask for consent. The message at the start of the call must also be accurate. Anyone who says they are recording "for quality purposes" may not simply use the transcripts for something else.
Is a single notice enough, or a sentence in the general terms and conditions?
No, a clause in the general terms and conditions or in the first quote is not enough. There are three reasons for that:
- Consent via general terms and conditions is not valid consent. The GDPR requires that consent is given freely, specifically and separately, apart from the contract, and that it can be withdrawn.
- The person who signs is not the person who calls. The managing director approves the assignment, but it is their accountant, their site manager or a new employee who calls you later. One person's consent does not count for another. In addition, suppliers, job applicants and people who are not yet customers also call.
- The information must reach the caller at that very moment. In May 2026 the Data Protection Authority imposed a fine of 85,000 euros on a Walloon water company, not because it recorded calls, but because the information about it was incomplete, fragmented and hard to find.
What does work is a two-layer structure: a short notice at the start of every call, and the full explanation (purpose, retention period, rights, who processes the recordings) in your privacy notice. The general terms and conditions may refer to it, as an extra and not as a replacement.
And with regular contacts?
For people you call or video call regularly, you do not have to repeat it in every conversation, provided you do it properly once. The GDPR does not require you to inform someone again each time when they are already fully informed, and consent remains valid until it is withdrawn. That only works if these conditions are met:
- Per person, not per company. Each contact has been informed personally and has consented personally. If a new colleague joins at the customer, you start again with them.
- Explicit and complete. You say that you record conversations and have them transcribed, what for, how long you keep them and who can access them, with a reference to your privacy notice.
- Demonstrable. You can later prove who consented and when, for example with a short confirmation email after the first conversation.
- Withdrawing is just as easy. Anyone who no longer wants to be recorded says so once, and you exclude that person from the recordings.
- Announce it again when something changes. A new purpose, a new service that processes the recordings, or a long period without contact.
- Everyone else does get the notice. Unknown numbers, new contacts, and anyone joining a video call for the first time. If one person is present who does not know yet, you announce it at the start.
A permanent reminder helps: a sentence in your email signature or in your meeting invitations. This is a defensible reading of the rules, not a way of working that the Data Protection Authority has explicitly approved. Anyone who wants to be certain keeps the notice in every conversation, or submits their way of working to a lawyer.
How long and where do you keep recordings and transcripts?
Audio, transcript and summary are all three personal data. For each of the three you decide yourself how long you need them, and you document that. The law gives a fixed period in only one case: recordings for quality control in a call centre may be kept for no more than one month.
| What do you need it for? | Reasonable period | |
|---|---|---|
| Audio | To check the transcript in case of doubt | Short: a few days to a few weeks, then delete automatically |
| Transcript | To find out what was literally said | As long as the project or assignment runs |
| Summary and agreements | As a report with the customer and the project | As long as the customer relationship lasts, like your other customer data |
The periods in the table are a practical guideline, not a legal one. What the law does require:
- Define the periods and communicate them. They belong in your privacy notice and in your record of processing activities.
- Let deletion run automatically. A period that nobody carries out does not count. The May 2026 fine concerned, among other things, recordings that were kept longer than allowed.
- Limit who can access them. By default a recording is visible only to those who took part in the conversation and to those who need it for their work.
- Know where it is stored. There is a copy with the phone system, with the transcription service and in your own systems. With each of those suppliers you have a data processing agreement, and you know whether the data stays in the EU.
- No training on your conversations. Check that the transcription or AI service does not use your recordings to train its models.
- You must be able to delete and look things up. If someone withdraws their consent or asks for a copy, you must be able to find their recording and transcript, in all copies.
- Secure it. Encrypted storage, and no recordings sent around by email or chat.
Aren't you always allowed to record your own conversations?
Criminal law does not punish someone who records a conversation they take part in themselves. That is where that claim comes from. But a business that systematically records, stores and transcribes is processing personal data, and then the GDPR and the Electronic Communications Act simply continue to apply. Moreover, anyone who uses a recording to harm someone can be criminally liable.
Your own employees
Anyone who records the conversations of their salespeople or their customer service is also recording their own people. Between employer and employee, consent is rarely truly free. So you are better off relying on a clear, legitimate purpose than on a signature. Inform your employees in advance, define what the recordings are and are not used for, and consult about it. Put it in your work regulations or in a policy that everyone knows.
Transcription and AI
- A transcript and a summary are also personal data. The retention period and the access rules apply just as much.
- The transcription service is your processor. Check where the audio is processed and whether the provider uses it to train its models.
- Inferring emotions is not allowed. Since 2 February 2025 the AI Act has prohibited AI that infers emotions at work from the voice or face of employees. Watch out for this with tools that measure the "sentiment" of a conversation.
- Sensitive content. If a conversation is about health or other sensitive data, stricter rules apply. Preferably pause the recording at such a moment.
Were you recorded yourself without knowing it?
Ask about it. You have the right to access and to a copy of what is kept about you, you can object, and you can lodge a complaint with the Data Protection Authority.
When do you choose what?
- A conversation at the customer's premises: ask at the start whether you may record and say what for. If the customer refuses, you take notes yourself.
- Incoming phone calls: a notice in advance, with the option to continue without recording.
- Outgoing phone calls: say it yourself at the start of the call.
- Internal meetings: agree it once with the team, and announce it every time someone from outside is present.
- Regular contacts: once, explicitly and demonstrably per person, and again as soon as someone new joins.
- In doubt? Do not record, or only dictate your own summary afterwards.
Say in advance that you are recording, say what for, and delete on time.
Related terms
- Speech-to-text: how a recording becomes a transcript.
- EU hosting and zero retention: where your recordings and transcripts are best stored.
- AI Act: the ban on emotion recognition at work.
- CLOUD Act: what it means if your recording service is American.
Sources: Data Protection Authority on professional phone calls · Data Protection Authority: decision 102/2026 of 12 May 2026 · GDPR (Regulation 2016/679) · AI Act (Regulation 2024/1689)
This article is not legal advice. The rules were checked on 6 October 2026. For a specific situation, it is best to consult a lawyer.