Privacy and Data Protection on Business Calls

Every business call involves personal information. Before a single word is spoken, there's a phone number and often a name. During the call, people share addresses, account details, dates of birth, and sometimes far more sensitive information about their health, finances, or personal circumstances. After the call, there may be a recording, a transcript, notes, and a record of what was agreed.

All of this is personal data, and how it's collected, used, stored, and shared is governed by privacy and data protection laws. This article explains what data business calls involve, the key principles for handling it responsibly, and the main legal frameworks that apply.

This article is for general information only and isn't legal advice. Data protection requirements vary by country, sector, and situation.

What Personal Data Do Business Calls Involve?

It's easy to underestimate how much personal data a single call can generate. It typically includes:

Contact details. Phone numbers, names, and sometimes email or postal addresses.

Call records. Details about the call itself, such as the time, duration, numbers involved, who handled it, and the outcome. This is often called call metadata.

What's said on the call. Information shared during the conversation, such as account numbers, order details, preferences, complaints, or personal circumstances.

Recordings and transcripts. Audio recordings and written transcripts capture the entire conversation, including anything sensitive that was said.

Notes and summaries. Information recorded by staff, or generated automatically, about the call.

Voice data. A person's voice itself can be personal data, and when it's used to identify someone, as in voice-based security checks, it may be treated as biometric data.

Sensitive information. Calls sometimes involve particularly sensitive data, such as health conditions, financial difficulties, or information about children or vulnerable people.

The Core Principles of Handling Call Data

Data protection laws around the world differ in detail, but many share a common set of principles. These are set out most clearly in the GDPR, used in the European Union and, in its UK form, in the United Kingdom, but they reflect good practice everywhere.

Lawfulness, fairness, and transparency. Have a legitimate reason for using people's data, use it in ways they'd reasonably expect, and be open about what you're doing.

Purpose limitation. Collect data for clear, specific purposes, and don't use it for unrelated purposes later.

Data minimization. Collect only what you actually need. If a call doesn't require someone's date of birth, don't ask for it.

Accuracy. Keep data correct and up to date, and fix errors when they're found.

Storage limitation. Keep data only as long as it's needed, then delete or anonymize it.

Security. Protect data against loss, theft, and unauthorized access.

Accountability. Be able to show how you meet these principles, through policies, records, and decisions.

Being Transparent With Callers

People have a right to know how their information is used. On business calls, transparency usually involves:

• Telling callers when calls are recorded, typically at the start of the call.
• Explaining why data is collected and how it will be used.
• Providing a privacy notice, usually available online, setting out what data is collected, why, how long it's kept, who it's shared with, and what rights people have.
• Being clear about automation and AI, including when callers are speaking with an AI system or when AI is used to analyze their calls.

On a phone call, it isn't practical to read out a full privacy notice. A common approach is to give a short statement at the start of the call, such as mentioning recording and directing people to the full privacy notice on the business's website.

Verifying Identity Without Over-Collecting

Many calls require the business to confirm who it's speaking to before discussing account details. This protects people from having their information disclosed to someone pretending to be them.

Good identity checks strike a balance. They ask enough to confirm identity reliably, without asking for more information than necessary. Common approaches include asking for information the business already holds, sending a one-time code to the person's registered phone or email, or using voice-based verification with the person's consent.

Businesses also need to be aware of social engineering, where fraudsters call pretending to be a customer, often armed with information gathered elsewhere, to gain access to accounts or change contact details. Training staff to follow verification steps consistently, even under pressure, is one of the most effective defenses.

Particularly Sensitive Data

Some types of data require extra care.

Payment card details

When customers pay by card over the phone, the Payment Card Industry Data Security Standard (PCI DSS) applies. It sets strict requirements for protecting card data. In particular, the card security code must never be stored after a payment is authorized, which means it mustn't be kept in call recordings. Businesses often handle this by pausing recordings during payment, using keypad entry with masked tones so card numbers aren't heard, or transferring callers to a separate secure payment system.

Health information

Calls involving health information face additional rules in many places. In the United States, HIPAA governs how healthcare providers, health insurers, and their service providers handle health information, including on calls. In the UK and EU, health data is classed as special category data, which requires additional legal justification and safeguards.

Biometric data

When voice recordings are used to create a voiceprint that identifies someone, this can count as biometric data. In the UK and EU, biometric data used for identification is special category data. In the United States, some states regulate biometric data specifically. Illinois's Biometric Information Privacy Act (BIPA), for example, requires informed written consent before collecting biometric identifiers, including voiceprints, and allows individuals to sue for violations.

Children and vulnerable people

Extra care is needed when calls involve children or people in vulnerable circumstances, such as those experiencing financial hardship, illness, or bereavement. This affects both how calls are conducted and how the information shared is protected.

Privacy Laws Around the World

European Union and United Kingdom

The GDPR (in the EU) and the UK GDPR (in the UK), along with national laws, set out comprehensive rules on personal data. They apply to all the call data described above and give people strong rights over their information. These are explained further below.

United States

The United States doesn't have a single comprehensive federal privacy law. Instead, privacy is governed by a combination of:

• Sector-specific federal laws, such as HIPAA for health information, the Gramm-Leach-Bliley Act for financial institutions, and the Fair Credit Reporting Act for consumer reports.
• Telecommunications laws, such as the TCPA, which governs consent for calls and texts.
• State privacy laws. A growing number of states, led by California with the California Consumer Privacy Act (CCPA), as amended by the California Privacy Rights Act, have passed comprehensive consumer privacy laws. These give residents rights over their personal information, such as the right to know what's collected, to request deletion, and to opt out of the sale or sharing of their data.
• State biometric laws, such as Illinois's BIPA.
• Data breach notification laws, which every state has in some form.

Other countries

Many other countries have their own data protection laws, often influenced by the GDPR. Businesses calling internationally need to consider the laws of the places where the people they call live.

People's Rights Over Their Call Data

Under the GDPR and many similar laws, people have rights over the personal data businesses hold about them. These commonly include the right to:

• Access their data, which can include copies of call recordings and transcripts.
• Correct inaccurate data.
• Have their data deleted in certain circumstances.
• Object to how their data is used, including an absolute right in the UK and EU to object to direct marketing.
• Restrict how their data is used in certain circumstances.
• Not be subject to significant decisions made solely by automated means, in certain situations, without appropriate safeguards.

Businesses need processes to recognize and respond to these requests, including requests made verbally during a call, within the legal time limits.

Sharing Call Data With Others

Call data often passes through several organizations, including phone providers, contact center software platforms, recording and transcription services, AI providers, outsourced call centers, and customer relationship management systems.

When a business shares personal data with service providers who process it on its behalf, it remains responsible for that data. Good practice includes choosing providers with strong security and privacy practices, having written contracts that set out how data must be handled and protected, checking where providers store and process data, and limiting each provider's access to only what they need.

International transfers

Calls are increasingly handled across borders, for example through offshore call centers or cloud services based in other countries. Under the GDPR and UK GDPR, transferring personal data outside the UK or EU is only allowed when appropriate safeguards are in place, such as the destination country being recognized as having adequate protection, or the use of approved contract terms. Businesses using international providers or call centers need to make sure these transfers are lawful.

Using Call Data for AI

Businesses increasingly use call recordings and transcripts to analyze conversations, generate summaries, or improve AI systems. This raises specific privacy questions. Are people told their calls may be used in these ways? Is using their data to train or improve AI compatible with the purpose it was collected for? Are AI providers allowed to use the data for their own purposes?

Being transparent, limiting how providers can use the data, removing personal details where possible, and checking whether additional consent is needed are all important steps.

Keeping Call Data Secure

Call data is valuable to criminals, so security is essential. Key measures include:

• Encryption of recordings, transcripts, and data in transit and at rest.
• Access controls, so only people who need call data for their work can see it.
• Audit trails, recording who accessed what and when.
• Redaction, removing sensitive details such as card numbers from transcripts.
• Secure working practices, such as locking screens, avoiding writing details on paper, and restricting personal devices in areas where sensitive calls are handled.
• Secure remote working, with protected devices and connections for staff handling calls from home.
• Staff training on privacy, security, and recognizing social engineering.

Retention: Keeping Data Only as Long as Needed

Call recordings and data shouldn't be kept indefinitely. Businesses should set clear retention periods based on why the data is held, for example how long recordings are needed for quality reviews, dispute resolution, or legal and regulatory requirements, and delete data when those periods end. Some regulated sectors are required to keep certain call records for set periods.

When Things Go Wrong

Despite precautions, data breaches can happen, such as a lost laptop, unauthorized access to recordings, or a recording sent to the wrong person. Businesses need a plan for responding quickly: containing the breach, assessing the risk to the people affected, and notifying regulators and individuals where required.

Under the GDPR and UK GDPR, certain breaches must be reported to the regulator within 72 hours of the business becoming aware of them. In the United States, state laws set their own breach notification requirements.

Privacy as Part of Every Call

Privacy on business calls isn't just a legal requirement layered on top of the conversation. It's part of how callers are treated. People share personal information on calls because they trust the business to use it properly. Collecting only what's needed, being open about how it's used, protecting it carefully, and respecting people's rights are how businesses honor that trust, on every call and long after it ends.

Related articles

• Monitoring Staff Fairly: Balancing Oversight and Trust