Recording and transcribing calls with AI: stay lawful
By Keith Hamilton · · 4 min read
Recording calls with AI makes them far more useful: instead of hours of audio nobody listens to, you get searchable transcripts, summaries and notes added straight to the customer record. It also makes those recordings more sensitive, because more people and systems can find what was said. This guide explains how to record and transcribe calls with AI lawfully and sensibly, whether the calls are handled by your team, by an AI voice agent or in online meetings. It is general guidance, not legal advice.
Is recording and transcribing calls processing personal data?
Yes. A call recording contains personal data: the caller's voice, name, contact details and whatever they talk about. A transcript and a summary hold the same information in a more searchable form, so UK GDPR applies to AI call transcription as much as to the audio.
Before you start, be clear about:
- Purpose. Why are you recording? Training, quality checks, resolving disputes, keeping accurate notes and meeting regulatory requirements are all common reasons. Record only for the purposes you need.
- Lawful basis. For many businesses this is legitimate interests or a legal obligation. Consent is not always the right basis, and if you rely on it, people must be able to say no without losing the service.
- Necessity. Do you need every call recorded, or only some? Do you need the audio, or would a checked summary do?
If you are recording at scale, using AI to analyse calls or handling sensitive conversations, carry out a data protection impact assessment. Depending on the processing, UK GDPR may require one, and our UK GDPR and AI checklist explains when.
Do you have to tell callers a call is recorded?
Yes. UK GDPR requires you to be open about how you use people's personal data, so callers should know a call is being recorded before the conversation gets going. A short message at the start of the call is the usual approach.
If AI is transcribing or analysing the call, say so in your privacy information, and explain how long you keep recordings and transcripts. If the caller is speaking to an AI voice agent, tell them that too. Our guide to AI voice agents for customer calls covers how to introduce one.
Separate UK call recording law on intercepting communications also applies to recording calls on business systems. It permits recording for certain business purposes, but the conditions are specific. If you are unsure how they apply to you, take advice.
What does AI change?
AI adds four points to plan for: a supplier handling the data, transcription errors, sensitive information and voice identification.
Your supplier is handling the data
Unless transcription runs on your own systems, the audio goes to an AI supplier. Treat that supplier as your processor: check where the data is processed, whether it is used to train their models, how long it is kept and whether a data processing agreement is in place.
Transcripts can be wrong
Transcription mishears names, numbers and accents, and a summary can leave out or misstate what was agreed. UK GDPR requires personal data to be accurate. Make it easy for staff to correct transcripts, and do not treat an AI summary as the definitive record of a disputed conversation without checking the audio.
Sensitive information turns up unexpectedly
Callers mention their health, finances or family circumstances without being asked. Some of this is special category data under UK GDPR, which needs extra care. Limit who can search and read transcripts, and use AI analysis, such as sentiment scoring, only where it is genuinely needed.
Voice identification is different
Using voice recognition to identify or verify callers involves biometric data, which is special category data when used for identification. That needs a specific condition under UK GDPR and a careful impact assessment. Transcribing what someone says is not the same as identifying them by their voice.
How do you keep card details out of recordings?
Pause the recording while card details are taken, use a secure keypad entry system, or send the customer a secure payment link instead. Payment card details should not end up in call recordings or transcripts, and the PCI DSS standard, which applies to businesses that take card payments, sets strict rules here.
Check that your AI transcription does not capture card numbers if a pause is missed.
What about AI meeting note-takers?
AI meeting note-takers record and transcribe too, so the same rules apply. Tell everyone in the meeting before it starts, give people a chance to object, and do not use them for sensitive conversations such as disciplinary or health discussions.
If you record or analyse staff calls, read the ICO's guidance on monitoring workers: staff need to know what is monitored and why.
How long should you keep call recordings?
Keep audio, transcripts and summaries only as long as their purpose requires, and set call recording retention periods for each. A recording kept for training does not need the same life as one kept to meet a regulatory requirement. Set deletion to happen automatically where your system allows it.
People can ask for a copy of their personal data. Recordings and transcripts are included, so you need to be able to find them.
What should a call recording checklist include?
Seven items cover the essentials:
- Purpose and lawful basis written down
- Callers told at the start, and privacy information updated
- Supplier checks done and a data processing agreement in place
- Card details kept out of recordings and transcripts
- Access to recordings and transcripts limited
- Retention periods set and deletion automated
- A way to find and correct records when asked
Where Forwardcycle fits
Our safe adoption service includes data protection impact assessments, vendor checks and staff guidance for AI uses such as call recording and transcription. If you are planning to add AI to your calls, take the free AI Readiness Assessment or arrange a free call.