Recording Professional Phone Calls: What Are the GDPR Rules?

Do you record your calls to get a transcript and minutes? This is the only case on which the CNIL has published detailed guidance, and it is more demanding than for other meetings.

It rules out permanent recording, requires you to inform the other party of their right to object before the end of the conversation, and sets the retention periods.

Can you record a professional phone call?

Yes, but not without a framework for the processing.

A call recording contains a voice, a number and the content of a conversation. It therefore constitutes processing of personal data within the meaning of the GDPR.

In particular, you must:

• inform the other party at the start of the call;
• mention their right to object;
• determine your legal basis;
• define the purpose of the recording;
• limit the retention period;
• consult employee representatives before deploying the system.

Recording without the other party's knowledge also falls under the French Criminal Code, which punishes "with one year's imprisonment and a fine of €45,000 the act of wilfully violating the privacy of another person by any means whatsoever: 1° by capturing, recording or transmitting, without the consent of their author, words spoken in private or confidentially" (Article 226-1).

Is a call recording personal data?

Yes.

The GDPR defines personal data as "any information relating to an identified or identifiable natural person" (Article 4, point 1).

A voice, a number and the statements made during a call can identify the other party.

The transcript and the minutes are also covered.

Why are calls more regulated than other meetings?

Because the CNIL devotes a specific guidance sheet to them.

It is the only type of professional exchange with such detailed guidance, and it serves as the reference for the other meeting formats.

You also carry out several successive processing operations:

call → recording by the telephony system → transcript → minutes → CRM record.

Can you record every call?

No.

The CNIL states that "the employer may not set up a permanent or systematic listening or recording system".

A configuration that records every call with no possible exception therefore falls outside the framework, even when the tool is able to do it.

What data is recorded?

Depending on the tools used, you may keep:

• the audio of the call;
• the transcript;
• the number called or calling;
• the date and duration;
• the minutes;
• the commitments made;
• the next steps.

---

Do you have to inform the other party before recording a call?

Yes.

The information must be given before or at the time the data is collected, so at the start of the call.

For calls, the CNIL requires broader information than elsewhere.

What should you tell them?

The CNIL states that "employees as well as the other parties (clients, for example) must in particular be informed: of the existence of the system; of the identity of the data controller; of the purposes pursued".

It also specifies that the information covers "the legal basis of the system (an obligation arising from a legal text, for example, or the employer's legitimate interest)".

You must therefore be able to explain simply:

who is recording → why → on what basis → what will be done with the data.

Do you have to mention the right to object?

Yes, and this is a requirement specific to calls.

The CNIL states that "the other parties must be informed of their right to object before the end of the telephone conversation".

The information is therefore not limited to announcing the recording: it tells the person that they can object to it, and it is given during the call.

Do you have to consult employee representatives?

Yes, before deploying the system.

The CNIL states that "employee representative bodies must be informed and consulted before any decision to install a call listening or recording system".

This is a step prior to deployment, not a call-by-call formality.

Do you have to say that an AI transcribes the call?

Yes.

The audio recording and the processing then carried out by the AI are two operations that are worth distinguishing.

The European AI Regulation provides that "providers shall ensure that AI systems intended to interact directly with natural persons are designed and developed in such a way that the natural persons concerned are informed that they are interacting with an AI system" (Article 50, paragraph 1). These obligations have applied since 2 August 2026, and they target the provider of the system; your obligation to inform comes from the GDPR and the CNIL's guidance.

You can, for example, announce:

"This call is being recorded and an AI assistant automatically writes the minutes."

---

Which legal basis should you use to record a call?

The legal basis depends in particular on the person recorded and the purpose pursued.

Two bases mainly come into play here: the employer's legitimate interest and the other party's consent.

Can you rely on legitimate interest?

Yes, the CNIL cites it as a possible basis for the system.

Article 6 of the GDPR authorises processing "necessary for the purposes of the legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject" (paragraph 1, point f).

You must therefore in particular carry out a balancing test and inform the people concerned.

Can you rely on consent?

Yes, in particular for a call with a client or a prospect, as in a sales meeting.

Consent is defined as "any freely given, specific, informed and unambiguous indication of the data subject's wishes by which he or she, by a statement or by a clear affirmative action, signifies agreement" (GDPR, Article 4, point 11). The controller must also "be able to demonstrate that the data subject has consented" (Article 7, paragraph 1).

Which purpose should you choose?

The one you will be able to justify.

The CNIL lists staff training among the accepted purposes for recording calls.

The purpose you write down then determines the rest: the retention period, access, and what you can do with the file.

Can you record an employee during their calls?

Yes, this may be possible as part of an occasional system, communicated and presented to employee representatives.

Permanent recording, on the other hand, is ruled out by the CNIL.

---

How long should you keep the recording of a call?

For as long as necessary for the purpose pursued, and no longer.

The GDPR requires data to be "kept in a form which permits identification of data subjects for no longer than is necessary for the purposes for which the personal data are processed" (Article 5, paragraph 1, point e). The CNIL also gives numerical benchmarks.

How long should you keep the audio?

Six months at most. The CNIL states that "recordings may be kept for a maximum of six months".

That is the period it retains for recordings of calls in the workplace.

How long should you keep a transcript?

The CNIL states that "analysis documents may be kept for up to one year".

Is the maximum period the normal period?

No.

The CNIL describes a shorter sequence: listen to the recordings in the following days, write the necessary analysis documents, then delete the raw recordings without waiting for the six months.

An effective policy must therefore provide for:

recording → prompt analysis → deletion of the audio → retention of the analysis document.

---

Who can access the recording of a call?

Only the people who need it for their work.

The employee concerned, their manager, and the people in charge of training when that is the purpose chosen.

Who can view the audio, the transcript and the minutes?

The three files do not necessarily meet the same need.

You can, for example:

• share the minutes with the team concerned;
• limit access to the transcript;
• keep the audio only for genuinely justified needs.

What happens when the call is pushed to the CRM?

A copy then exists in a second system, with its own access rights.

The two policies must remain consistent, otherwise the restriction set on one side is lifted on the other.

Should the data be encrypted?

Security must be appropriate to the risk.

The GDPR requires "appropriate technical and organisational measures to ensure a level of security appropriate to the risk, including inter alia as appropriate: (a) the pseudonymisation and encryption of personal data" (Article 32, paragraph 1).

---

What are your contact's rights?

The people recorded have the rights provided for by the GDPR.

Can they request access to their data?

Yes.

The data subject has "the right to obtain from the controller confirmation as to whether or not personal data concerning him or her are being processed" (GDPR, Article 15, paragraph 1). This may concern the audio, the transcript and the minutes.

Can they request rectification?

Yes.

The data subject has "the right to obtain from the controller without undue delay the rectification of inaccurate personal data concerning him or her" (GDPR, Article 16).

This is particularly important with an automatic transcript.

An AI can mistranscribe:

• a proper name;
• an amount;
• a number;
• a date;
• the identity of the person who spoke.

Can they request erasure?

Yes, under the conditions laid down by the GDPR.

The data subject has "the right to obtain from the controller the erasure of personal data concerning him or her without undue delay" (GDPR, Article 17, paragraph 1).

Can they object to the recording?

Yes, and the CNIL requires that this right be announced to them before the end of the conversation.

The data subject has "the right to object, on grounds relating to his or her particular situation, at any time to processing of personal data concerning him or her which is based on point (e) or (f) of Article 6(1)" (GDPR, Article 21, paragraph 1).

This implies that it can be exercised during the call, and that you stop the recording at their request.

How quickly must you respond?

In principle, within one month. The controller responds "without undue delay and in any event within one month of receipt of the request" (GDPR, Article 12, paragraph 3).

---

What obligations apply when the AI transcribes the call?

The AI adds a processing operation on top of the simple recording.

The way it works can be summarised as follows:

audio → transcript → analysis → minutes → CRM record.

What does the AI actually do?

It can:

• transcribe the call;
• identify the speakers;
• extract the commitments;
• identify the next steps;
• produce minutes;
• attach the call to the right contact.

How many processors are involved in a call?

At least two, often three.

The telephony tool, the transcription tool, then the CRM when the minutes are sent there.

That is what is specific to the phone call: the chain is longer than for a video conference, and every link must be governed.

Where is the data stored?

This is one of the first questions to ask your providers.

At Leexi, recordings, transcripts and minutes stay in the Paris region, on AWS. Above a certain volume of licences, hosting at Scaleway can be chosen.

Your telephony tool, for its part, stores the original recording: the two locations are checked separately. Leexi's compliance file details hosting, processors and certifications.

Do you need a DPA with each provider?

Yes, when the provider acts as a processor.

Article 28 of the GDPR provides that "processing by a processor shall be governed by a contract or other legal act […] that is binding on the processor with regard to the controller and that sets out the subject-matter and duration of the processing, the nature and purpose of the processing, the type of personal data and categories of data subjects and the obligations and rights of the controller" (paragraph 3).

Does the AI use your conversations to train its models?

That depends on the provider.

At Leexi, conversations do not train any model, on all accounts.

---

How do you inform the other party that a call is being recorded?

You can use simple, precise wording.

At the start of an outgoing call

"Before we start: this call is being recorded and an AI assistant writes the minutes. You can object to that — just tell me and I'll stop the recording."

For an incoming call

"I should let you know that this call is being recorded, so that I can answer you without taking notes. If you'd rather it wasn't, I'll stop the recording."

For a call between colleagues

"I'm recording for the minutes, as usual. Tell me if you want me to stop at any point."

---

What mistakes should you avoid?

1. Recording every call by default

The CNIL rules out a permanent or systematic system.

2. Not mentioning the right to object

This is the requirement most specific to calls, and the one most often missing from greeting messages.

3. Deploying without consulting employee representatives

Information and consultation take place before the decision to install the system.

4. Keeping raw recordings until the maximum period

The CNIL describes the opposite: analyse promptly, then delete the audio without waiting.

5. Forgetting the copies in other systems

A call recorded in the telephony system, transcribed elsewhere and pushed to a CRM exists in three places.

6. Assuming a third-party recording will be transcribed automatically

A recording produced by another tool does not necessarily enter your transcription chain.

---

How do you record a call with Leexi?

Once the GDPR framework is defined, using the tool comes down to a few steps.

1. Connect your telephony tool

Leexi can connect to calling tools such as Aircall or Ringover.

2. Transcribe the call

After the call, you get the transcript alongside the minutes.

3. Generate the minutes

The minutes cover in particular the points discussed, the commitments and the next steps.

4. Attach the call to the right contact

The minutes can be synchronised with your CRM and attached to the contact concerned, in the same way as after a meeting.

5. Control the data

Leexi states in particular hosting in the Paris region, a Scaleway option, model execution via Azure France in a closed circuit, encryption of data in transit and at rest, and no training on your conversations.

---

What difficulties do users actually encounter?

Legal questions are not the only difficulties encountered in practice.

Out of 1,141 support tickets received between January and June 2026, 7 concern recording or transcribing calls. The most frequent reasons include the minutes not being pushed to the CRM, call transcripts that cannot be found, and an incoming call interrupting the recording of a meeting in progress.

This gives another reading of the problem:

the question is not only "am I allowed to record?"

You also need to know:

which tool records → who transcribes → where the minutes land → how long each copy stays.

---

Recording a professional call: what to remember

Before recording your calls, check these six points:

• Information: does the other party know the system exists, and know their right to object?
• Scope: is the system occasional, rather than permanent?
• Legal basis: the employer's legitimate interest or the other party's consent?
• Employee representatives: were they informed and consulted before deployment?
• Retention: is the audio deleted promptly after analysis?
• Processors: do you know the three links of your chain?

If an AI is involved, add a seventh point:

does the other party know that an AI system processes the recording to produce the minutes?

Frequently asked questions

Is it legal to record a professional call?

Yes, provided you comply with the applicable framework: informing the other party, mentioning the right to object, legal basis, purpose and retention period in particular.

Can you record every call of a department?

No. The CNIL rules out a permanent or systematic system, unless a specific legal text provides otherwise.

Do you have to inform a client who calls in?

Yes, at the start of the call, mentioning their right to object.

Do you have to consult the works council?

Employee representative bodies must be informed and consulted before the decision to install the system.

How long should you keep a call recording?

Six months at most according to the CNIL in the context concerned, and up to one year for analysis documents. The practice it describes is to analyse promptly, then delete the audio without waiting.

Can a client ask for the recording of their call to be deleted?

Yes, under the conditions laid down by the GDPR's right to erasure.

Can the transcript of a call go into the CRM?

Yes. The minutes can be attached to the contact concerned in HubSpot, Salesforce, Pipedrive or Microsoft Dynamics.

---

In summary

Recording a professional call is possible.

But the right reflex is not only to ask:

"Am I allowed to record?"

You should instead check the whole chain, which has one more link than a video conference:

inform → mention the right to object → record → transcribe → attach to the contact → delete the audio.

It is this complete chain that must be governed by your data protection policy.

Do your calls deserve minutes? See how Leexi connects to your telephony

Sources

Texts taken from primary sources on 22 August 2026.

• GDPR, Articles 4, 5, 6, 7, 12, 13, 15, 16, 17, 21, 28 and 32
• French Criminal Code, Article 226-1
• CNIL, Listening to and recording calls in the workplace
• European Artificial Intelligence Regulation, Article 50

This page describes the applicable framework. It does not constitute legal advice.