Why call recording needs a legal basis

Anyone who records telephone calls processes personal data within the meaning of the GDPR. Any such processing requires a legal basis pursuant to Art. 6 GDPR — without it, the recording is inadmissible. For contact centers that record calls for quality assurance, training, or documentation purposes, the selection and clean implementation of this legal basis is the crucial point.

Consent as the central legal basis

For pure quality or service recording, consent (Art. 6 para. 1 lit. a GDPR) is generally the only legal basis that can be considered with regard to callers. A "legitimate interest" usually does not support this recording because the data subject's interest in protecting their spoken word outweighs it.

What effective consent must fulfill

A call recording is only permissible if the caller is informed before the recording starts, the declaration is made voluntarily, the consent is obtained through an active action, and the right to withdraw consent is pointed out. In practice, this means: a clear announcement at the start of the call, understandable information about the purpose and processing — and an active "yes" or pressing a specific key to consent.

No opt-out: Why "objection possible" is not enough

A common mistake: callers are only informed that a call is being recorded and that they can object to the recording. This is not valid consent under the GDPR. Valid consent requires active agreement — not merely the absence of an objection.

§ 201 StGB: the limit under criminal law

In addition to data protection, criminal law applies: the unauthorized recording of the non-publicly spoken word is punishable under § 201 of the German Criminal Code (StGB) — with imprisonment of up to three years or a fine. Important: § 201 StGB also protects the voice of employees. Therefore, not only the consent of the customer but also that of the employee is required for the recording.

Exception: legal obligation

In certain areas, recording is not a matter of consent but is required by law — such as the MiFID II obligation to record investment-related telephone calls. In these cases, processing is based on a legal obligation (Art. 6 para. 1 lit. c GDPR), and no consent is required. Nevertheless, the data subjects must be informed transparently.

Retention period, purpose limitation, and data subject rights

Even with a valid legal basis, GDPR principles apply: purpose limitation (use recordings only for the specified purpose), storage limitation (keep only as long as the purpose requires, then delete), and data subject rights (information under Art. 15, copy, withdrawal of consent with future effect). Recording systems should enforce retention periods automatically and enable targeted deletion.

Implementation in practice

For smooth operations, a clear process is recommended: First, determine the legal basis for each use case (consent or legal obligation). Next, set up a clear announcement and an active opt-in, obtain employee consent, and respect co-determination rights. After that, store the recording in an encrypted and audit-proof manner, enforce retention periods automatically, map the revocation technically, and answer data subject requests quickly.

How onsoft supports this

onsoft provides legally compliant call and screen recording for contact centers with encrypted, audit-proof storage, automated retention periods, and targeted recovery. Consent and announcement processes can be mapped cleanly, access is documented, and deletion deadlines are enforced — keeping proof of data protection compliance and service quality in one system.

Frequently Asked Questions (FAQ)

Does recording telephone calls require consent?

For pure quality or service recording, yes: Consent under Art. 6 para. 1 lit. a GDPR is generally the only viable legal basis for callers.

Is a notice saying "This call is recorded, objection possible" sufficient?

No. Such an opt-out is not effective consent. Active consent is required, such as a spoken "yes" or pressing a specific key.

Does the employee also have to agree to the recording?

Yes. § 201 StGB also protects the voice of the employees, so their consent is additionally required; furthermore, workplace co-determination rights must be respected.

When is consent not required?

When there is a legal obligation to record — for example under MiFID II. In this case, the legal basis is the legal obligation (Art. 6 para. 1 lit. c GDPR).

How long may recordings be stored?

Only as long as the respective purpose requires. After that, they must be deleted; retention periods should be enforced automatically.