Microsoft Teams has become the central channel for telephony, video consultations and customer communication in many organisations. That brings a question to the fore that used to concern only classic phone systems: how do you record Teams conversations lawfully – completely, tamper-proof, and in line with MiFID II and GDPR? This guide summarises what matters in 2026 and why Teams' built-in tools are not enough in regulated environments.

Note: This article is general orientation and does not replace individual legal advice.

Why native Teams recording is not enough

The built-in recording in Teams is designed for meetings: a participant starts it manually, it lands in the cloud, and everyone sees a notice. For compliance purposes it lacks the decisive properties: no automatic, policy-driven always-on recording (the employee may forget – or deliberately not record), no central governance, no tamper-proof retention with defined periods, and no complete analysability. Regulated firms need exactly that: recording that works independently of any individual's goodwill.

Microsoft addresses this with a dedicated mechanism: policy-based compliance recording via certified partner applications connected through the Teams compliance recording interface. The user does not decide whether to record; a central policy does – automatically, completely and provably.

The MiFID II obligation applies inside Teams too

MiFID II is channel-agnostic. What must be recorded is any communication that leads – or is intended to lead – to a transaction, regardless of whether it runs over the classic phone system, a mobile phone or Microsoft Teams. Anyone conducting transaction-related customer conversations in Teams must record them just as on a fixed line. Recordings must in principle be kept for five years; on request by the competent authority, the period extends to up to seven years.

Completeness is key: an "island solution" that captures only some channels creates exactly the gaps that surface in an audit. BaFin's supervisory practice increasingly requires firms to demonstrate the active detection of off-channel communication – to show that business-relevant conversations do not slip past recording unnoticed.

GDPR: consent, purpose limitation, transparency

Alongside the regulatory duty, data protection always applies. Recording Teams calls processes personal data of customers – and of employees. You need a robust legal basis, clear information under Art. 13 GDPR, purpose limitation (recording only for the purposes named in advance) and defined, documented retention periods. Where statutory retention duties such as MiFID II apply, they provide both the basis and the frame for the storage period.

For the employee layer, the same applies as for any recording in the employment relationship: introducing it is subject to co-determination (§ 87 (1) no. 6 BetrVG), and a works agreement is the robust way to bindingly govern purposes, scope, access and retention. Relying on individual employee consent alone usually does not hold.

Technical and organisational measures

Lawful Teams recording also means protecting the recordings appropriately. Proven measures include encryption in transit and at rest, strict access limitation on a need-to-know basis, audit-proof access logs, WORM storage with fingerprint/hash for tamper resistance, and automated deletion tied to purpose and retention period. Data sovereignty matters just as much: where the recordings sit (on-premise or in an EU cloud) and who can access them is a deliberate compliance decision – not a by-product of the collaboration platform.

Compliant implementation with onsoft

onsoft connects Microsoft Teams via policy-based compliance recording and brings Teams telephony, classic telephony, screen recording and video/online consultation together in one platform. Recording runs automatically and completely, WORM-secured with fingerprint hash and audit trail, with configurable retention and deletion policies and fine-grained access rights. Deploy on-premise or in an EU cloud – vendor-independent and without a forced US-cloud path. This lets you meet MiFID II and GDPR across all channels, including Teams, from a single source.

Frequently asked questions (FAQ)

Is the built-in Teams recording enough for MiFID II?
No. Native recording is manual and meeting-oriented; it lacks automatic, policy-driven always-on recording, central governance and tamper-proof retention. Regulated communication needs policy-based compliance recording via the Teams compliance recording interface.

Does MiFID II really apply to Teams calls too?
Yes. MiFID II is channel-agnostic: any transaction-related communication must be recorded, whatever the channel – including Microsoft Teams.

How long must Teams recordings be kept?
In principle five years; on request by the competent authority, up to seven years. For data protection, the period must be defined, documented and aligned with the purpose.

What does "off-channel detection" mean?
Supervisors increasingly expect firms to actively demonstrate that business-relevant communication does not slip through unrecorded channels – a recording policy alone no longer suffices as proof.

Can the recordings stay in the EU?
Yes. Recordings can run on-premise or in an EU cloud. Location and access are a deliberate compliance decision and should be documented.