Decide why recording is necessary
Explain what the recording should achieve and whether a less intrusive record can meet the need. Quality review, training and transaction evidence are different purposes. The legal basis, transparency and any impact assessment must be considered for the actual arrangement; a generic opening announcement is not a complete compliance process.
Workers also need appropriate information about monitoring. ICO guidance emphasises necessity, proportionality and transparency in worker monitoring. Covert recording is not part of a routine service assumption. Any specialist or sector-specific retention duty requires separate assessment.
Control who can listen and what they can do
Agree whether recording is required, which calls it covers, where the information is held and which roles may listen, export or share it. Download access can create copies outside the normal retention process, so it needs a clear purpose and owner.
Callers may disclose sensitive information unexpectedly. The call guide should tell agents how to handle unnecessary disclosure and route restricted requests. Payment information or other specialist processing must not be assumed safe merely because a recording function exists. Suitable systems and controls need explicit assessment.
Set a retention and request-handling plan
Choose retention according to the purpose and applicable obligations rather than adopting a universal number of days for every business. Identify how deletion is applied and what happens to agreed records when service ends. Restrictions for an investigation or other lawful requirement need an accountable decision process.
An illustrative quality arrangement might allow a restricted reviewer to assess a defined sample and record coaching actions without distributing audio widely. That example does not promise a standard recording system or retention period. Recording availability, configuration, storage, access, costs and responsibility for customer requests are confirmed in the written service scope.
Further guidance: ICO: data protection and monitoring workers. Campaign requirements should be assessed for the actual service. Reviewed 4 November 2026.