Recording your customer calls: what the GDPR actually asks for
This question stops more teams than the technology does. What to announce, which legal basis to rely on, how long to keep the file, and what the regulator recommends.
Updated on September 29, 2026
Most teams hesitating to analyse their calls are not stuck on the tool. They are stuck on a simpler question nobody ever settled: are we allowed to record, and on what terms.
The short answer is yes. The useful answer comes down to four things to put in place, and they cost almost nothing once you know which ones.
Recording is not forbidden. Recording without announcing it, without knowing why, and without knowing when it is deleted, is.
1. Announce before, not during
The notice has to come at the start of the exchange, before anything is captured. It is the most visible part and the simplest: one sentence when the call opens, or a line in the invite when the meeting is scheduled.
That sentence must say three things: that the call is recorded, why, and where the person can learn more. I am recording this so I can listen back and prepare the next step. Tell me if you would rather I stopped. It takes eight seconds and settles most of it.
The part not to miss: the person must be able to decline without the conversation ending. A notice that leaves no choice is not information, it is paperwork.
2. Pick the legal basis, and know which one
This is where most articles contradict each other, because the answer depends on what you do with the recording. Consent is not always required: it is for marketing purposes, while other bases can hold when the recording serves the performance of a contract.
In practice, for a sales or discovery call, consent is the safest and the most legible basis. It has the advantage of being verifiable: the person heard the notice and did not ask you to stop.
| What you do with the call | What it implies |
|---|---|
| Listen back to prepare the next step of the deal | A precise purpose, easy to announce and to justify |
| Draw lessons about your market | The same purpose if you announce it, as long as you do not re-judge the person |
| Assess a salesperson on your team | A process touching an employee, with prior notice and internal consultation |
| Feed a model or a lasting profile | A purpose of its own, which has to be announced as such |
The third row is the one people forget. Analysing your own reps' calls is not the same as analysing a market: it becomes an assessment mechanism, with its own duties of notice and internal dialogue.
3. Decide how long you keep it
A limited retention period is part of the conditions, and the published guidance ranges from six months to five years depending on the purpose. The number matters less than having fixed one and sticking to it: a period nobody decided is an unlimited one, and that is what creates the problem.
- Set the period before recording, not the day someone asks for it.
- Separate the audio from what you drew out of it. The raw file is the most expensive thing to keep, and often the least useful after a few weeks.
- Write it somewhere another person can read. A privacy policy, an internal note, the medium does not matter.
- Delete for real. A file moved to an archive folder is not deleted.
4. Be able to answer when asked
A recorded person can ask what you hold about them, and ask you to erase it. That sounds heavy; it only is if you planned nothing. You need to be able to find a person's calls and to delete them.
The French regulator also recommends pseudonymising before any human annotation phase, and encrypting storage. Put plainly: if a human reads excerpts back, they do not need to know who is speaking.
What it changes when choosing a tool
What complicates things
- A bot that joins the meeting and announces itself for you, or does not
- Transfers outside the European Union that nobody has listed
- Recordings kept by default, with no stated period
- No way to find what you hold about one person
What simplifies things
- A recording or an import you start yourself, call by call
- Sub-processors and transfers outside the EU listed and safeguarded
- A retention period decided and written down
- A deletion that covers everything, including what was extracted
The difference between the two columns is not technical, it is about who decides. A tool that records for you decides for you. A tool where you start the recording yourself, or import a call you chose to record, leaves the decision, and the responsibility, on the right side.
Where Meidly helps
No bot joins your meetings. You start recording a Google Meet call yourself from the Chrome extension, or you import an audio or video file, after telling the participants. The exchange joins the customer file, and you keep control of what remains. Sub-processors and how transfers are safeguarded are described in the privacy policy, and deleting an exchange also erases what was extracted from it.
In short
Announce at the start, know why you are recording, set a period and hold to it, and keep the means to answer a request. Four decisions, taken once. Far cheaper than giving up on understanding why your calls go the way they go.
This article describes principles and is not legal advice. If your use goes beyond the ordinary sales case, in particular if it touches employee assessment, have it reviewed.
Frequently asked questions
Can you record a sales call without saying so?
No. The notice has to come before the recording, and the person must be able to decline without the exchange ending. A notice given afterwards, or buried in terms and conditions, does not meet that condition.
Do you need written consent to record a call?
Not necessarily in writing. What matters is that the person was informed beforehand and could object. For a sales call, a clear notice at the start of the exchange, left unopposed, is the most legible route.
How long can a call recording be kept?
Published guidance ranges from six months to five years depending on the purpose. The important part is to have fixed a period, written it down, and to actually delete when it expires. An undecided period is the real risk.
Is analysing your own salespeople's calls allowed?
It is possible, but it is no longer the same processing: it touches employees and counts as assessment. It calls for prior notice to the people concerned and internal dialogue, and it deserves a legal review before being put in place.
Does a call analysis tool have to host data in Europe?
It is not an absolute obligation, but hosting in the European Union removes the question of transfers outside the EU, which otherwise has to be framed and justified. For the same use, that is one constraint fewer.