It’s been four years since the General Data Protection Regulations (GDPR) were enshrined into British and European law. Since then, all EU businesses are held to the same standards of data capture and protection – with your call recordings falling under those same regulations.

Under GDPR, call data must be processed with the same care and compliance as any other digital data. After all, it potentially contains sensitive personal data such as names, addresses and finances. Yet it’s not only the content of calls that must abide by GDPR law; callers also have rights when it comes to the consent, storage and sharing of their data.

GDPR – What’s Changed, and What Stays the Same?

The GDPR is an EU legislation; as such, the United Kingdom’s exit from the European Union has raised questions about its relevance. The law has also been renamed the UK GDPR since the exit, causing further confusion.

Yet for many businesses, nothing will change. If your business processes EU citizen data, or offers goods and services to EU residents, you are still beholden to EU GDPR rules. Similarly, while the UK now abides by Data Protection Act 2018 (DPA 2018), the UK GDPR still enshrines EU’s data processing laws into its own; no doubt to avoid conflicts with data sharing overseas.

Our work with Hastings Insurance Brokers is the perfect example of your business GDPR responsibilities 

How Does GDPR Affect Call Recording?

All calls, during and after recording, must comply with the following seven principles of GDPR: 

Lawfulness, Fairness and Transparency – Do you have the user’s consent to record the call? While once it was enough to inform callers that some calls may be recorded, this information, and any consent, now needs to be confirmed by the caller. GDPR is as much about the rights of the individual as it is the responsibilities of the data holder. 

Purpose Limitation – What purpose is there to record the call? If the purpose has not been legally defined, or the decision to record doesn’t match the criteria, it may not be permissible by law – and any new purposes you identify will need the consent of the Information Commissioner (ICO).  

Data Minimization – Whatever data you capture, you must ensure it’s the minimum amount required to complete the data purpose. Would you need home address details to send only an email, for example? Data minimization aims to reduce the likelihood of storing surplus sensitive info- with the benefit of keeping every drop of data you own relevant. 

Storage Limitation – How long are you keeping these recorded calls for? At what point is it irrelevant to keep them on file – and is it relevant to store them at all? A history of customer contact is always useful, and access to full customer conversations is beneficial for any service provider. But over time, that data will become irrelevant, and may need anonymising – or even erasing. 

Integrity and Confidentiality – Are your calls protected? Do your users have the correct permissions to access or playback recordings? Whether protecting VoIP calls via end-to-end encryption, or storing call data securely in the Cloud, you need to ensure only the right ears are listening to your company calls. 

Accountability – GDPR makes data security the responsibility of the company – and demonstrating adequate protection is nothing less than mandatory. Accountability ensures that you take responsibility for all the above actions, principles, and can demonstrate your adherence to GDPR. 

How Do I Comply with GDPR in Call Recording?

GDPR is an organisational challenge, not a technical one; but that doesn’t mean the right technical solution can’t go a long way.  

Solgari is a holistic all-channel business communications solution that adheres to the highest standards of usability, security and compliance. Out-of-the-box compliance ensures peace of mind across all of your technologies. 

If you’d like to find out more about Solgari, including its extensive reporting, security and compliance capabilities, why not take a look at our about page here. Or to request a demo of Solgari, why not get in touch with us at the link below? 

Request a Demo