Why call recording needs a legal basis

Anyone who records telephone calls processes personal data within the meaning of the GDPR. Any such processing requires a legal basis pursuant to Art. 6 GDPR — without it, recording is inadmissible. For contact centers that record calls for quality assurance, training, or documentation, the choice and clean implementation of this legal basis is the critical point.

Consent as the central legal basis

For pure quality or service recording, consent (Art. 6 para. 1 lit. a GDPR) is generally the only legal basis that can be considered for callers. A "legitimate interest" usually does not support this recording, because the data subject's interest in protecting their spoken word outweighs it.

What effective consent must fulfill

A call recording is only permissible if the caller is informed before the recording, the declaration is made voluntarily, consent is obtained through an active action, and the right to withdraw consent is pointed out. In practice, this means: a clear announcement at the start of the call, understandable information about the purpose and processing — and an active "yes" or pressing a specific key to agree.

No opt-out: Why "objection possible" is not enough

A common mistake: callers are only informed that a call is being recorded and that they can object to the recording. This is not effective consent under the GDPR. Valid consent requires active agreement — not the mere absence of an objection.

§ 201 StGB: the criminal law limit

In addition to data protection, criminal law applies: The unauthorized recording of the non-publicly spoken word is punishable under § 201 of the German Criminal Code (StGB) — with imprisonment for up to three years or a fine. Important: § 201 StGB also protects the voice of employees. Therefore, recording requires not only the consent of the customer, but also that of the employees.

Exception: legal obligation

In certain areas, recording is not a matter of consent but is prescribed by law — such as the MiFID II obligation to record investment-related telephone calls. In such cases, processing is based on the legal obligation (Art. 6 para. 1 lit. c GDPR), and no consent is required. However, the data subjects must still be informed transparently.

Retention period, purpose limitation, and data subject rights

Even with a valid legal basis, the GDPR principles apply: purpose limitation (use recordings only for the specified purpose), storage limitation (keep only as long as the purpose requires, then delete), and data subject rights (information pursuant to Art. 15, copy, withdrawal of consent with effect for the future). Recording systems should automatically enforce retention periods and enable targeted deletion.

Implementation in practice

For smooth operation, a clear workflow is recommended: First, determine the legal basis for each use case (consent or legal obligation). Next, set up a comprehensible announcement and an active opt-in, obtain the consent of employees, and observe co-determination in the workplace. Then, store the recording in an encrypted and audit-proof manner, automatically enforce retention periods, map the withdrawal of consent technically, and respond quickly to data subject requests.

How onsoft supports this

onsoft provides legally compliant call and screen recording for contact centers with encrypted, audit-proof storage, automated retention periods, and targeted recovery. Consent and announcement processes can be mapped cleanly, access is documented, and deletion periods are enforced — keeping data protection compliance and service quality in one system.

Frequently Asked Questions (FAQ)

Does recording phone calls require consent?

Yes, for pure quality or service recording: For callers, consent under Art. 6 para. 1 lit. a GDPR is usually the only viable legal basis.

Is a notice saying "This call will be recorded, objection possible" sufficient?

No. Such an opt-out does not constitute valid consent. Active agreement is required, such as a spoken "yes" or pressing a specific key.

Does the employee also have to agree to the recording?

Yes. § 201 StGB also protects the voice of the employees, so their consent is additionally required; furthermore, co-determination in the workplace must be observed.

When is no consent necessary?

When there is a legal obligation to record — for example under MiFID II. In this case, the legal basis is the legal obligation (Art. 6 para. 1 lit. c GDPR).

How long may recordings be kept?

Only as long as required for the respective purpose. After that, they must be deleted; retention periods should be enforced automatically.

→ Legally compliant call recording with onsoft

→ Call Center Quality Management: Basics, Metrics & Software