Should law firms record client calls? The case and cautions

Many law firms do record calls, and there is a real operational case: a recording settles disputes about what a caller was told and helps train reception. But recordings at a law firm are personal data, and often contain special category or criminal offence data. Published guidance expects callers to be told at the start, a lawful basis to be documented, and retention to be limited. Your DPO, or whoever leads on data protection, should decide, with your COLP.

This page is not legal advice. It sets out the operational reasons firms record, what the published sources say, and the decisions a firm needs to make, so the conversation with your DPO or COLP starts from the right place. It covers calls answered by your own receptionist, an answering service or software alike. For the wider question of who answers the firm's phone, see our pillar guide to law firm answering services in the UK.

Why do law firms record calls?

• Disputes about what was said. A caller later says they were told a deadline had not passed, or that someone would ring within the hour. A recording answers it.
• Training and quality. Listening to real calls is the fastest way to improve a receptionist's or answering service's handling, and to find the questions your script is missing.
• Accurate records. Names, numbers and dates can be checked rather than guessed from a hurried note.
• Oversight of outside services and software. If an answering service or an AI system answers in your name, recordings and transcripts are how you check it is doing what you agreed.

A worked example: the dispute a recording settles

A hypothetical case, invented for illustration. A caller rings a firm on a Friday evening about an employment dispute. The answering service takes a message. Three weeks later the caller complains that they were told "not to worry about the deadline" and has now missed it. The message says only "called re dismissal, please call back". Without a recording, the firm has the caller's word against an operator who handled hundreds of calls that week. With one, the firm can hear exactly what was said, and either show the operator declined to comment on deadlines or find out that the script needs fixing. Either answer is more useful than an argument.

The same example shows the other side. That recording contains a named person's employment dispute and possibly their health. It has to be protected, found on request and deleted on schedule, for every call, not just the one that became a dispute.

What are the reasons not to record every call?

• Sensitivity. People ring a law firm about their health, family, finances and alleged offences. The ICO lists health data as special category data, and describes criminal offence data as separate but subject to similar safeguards.
• Volume and risk. Every recording kept is something that can be lost, breached, or requested. More data kept means more to protect and more to search when someone asks for their information.
• Chilling effect. Some callers speak less freely when told they are being recorded, particularly about sensitive matters.
• Confidentiality. The SRA Code of Conduct requires solicitors to keep client affairs confidential. Recordings held by a supplier need the same care as any other client information.

A recording is evidence for you and a record about them. Both are true at once, and the policy has to respect both.

Is it legal for a UK business to record phone calls?

Recording by businesses of calls on their own systems is covered by more than one set of rules. Two published sources are worth reading directly, with your adviser.

Interception rules. The Investigatory Powers (Interception by Businesses etc. for Monitoring and Record-keeping Purposes) Regulations 2018 list purposes for which a business may lawfully intercept communications on its own system, including establishing facts, checking regulatory compliance and assessing standards. Regulation 4 sets conditions, including that the system controller has made all reasonable efforts to inform every person who may use the system that communications may be intercepted.

Data protection. A recording of an identifiable person is personal data under UK GDPR. The ICO's guidance on lawful basis sets out the bases available, including consent and legitimate interests, and says your privacy information must include the lawful basis and the purposes. How those apply to call recording at your firm, and whether special category conditions are also needed, is for your DPO or adviser.

Do we have to tell callers we are recording?

The ICO's guidance on the right to be informed says people must be given privacy information at the time their data is collected, covering the purposes, retention periods and who it will be shared with, in clear and plain language. In practice, firms usually do this with a short line at the start of the call and fuller detail in the privacy notice. For example, and only as a starting point for your DPO to review:

Calls are recorded for record-keeping and training. You can read how we use and keep your information in the privacy notice on our website.

If an answering service or software takes your calls, check that its greeting includes the same line, and that the privacy notice names the supplier's role. Our call handling script for law firms shows where this line fits.

How long should a law firm keep call recordings?

The ICO's storage limitation guidance says personal data should be kept no longer than necessary for its purposes, with a documented retention policy, and should be reviewed and deleted or anonymised when no longer needed. It does not set a period for call recordings. The period is a decision for your firm based on why you record. A hypothetical way of thinking about it: if recordings exist mainly for training and short-term disputes, a short period may be defensible; if a recording becomes part of a matter file, the matter file's retention may apply. Your DPO should set and document it.

Ask any supplier what its default retention is, whether you can change it, and whether deletion also covers transcripts, summaries and backups.

Who can access call recordings?

Decide this before you switch recording on. A reasonable starting point is that recordings are available to the person responsible for call quality, the COLP or DPO, and the fee-earner handling that caller's matter, and not to everyone at the firm. Check whether your phone system or supplier can restrict access by role, whether access is logged, and who at the supplier can listen. Our post on AI and client confidentiality for solicitors covers the supplier questions in more detail.

What if a caller asks for their recording?

A recording is personal data, so it may be covered by a subject access request. Your firm needs to be able to find a caller's recordings, review them, and provide or withhold them as the law allows, within the statutory time limit. Ask your supplier how quickly you can search and export by caller number or name. If the answer is "contact support", plan for that.

Does it change if AI answers or transcribes the call?

The same principles apply, and there are more parts to check. A transcript and an AI-generated summary are also personal data. Ask where the audio is processed and where the text is stored, which sub-processors are involved, whether call data is used to train anyone's models, and whether retention covers audio, transcript and summary alike. We cover the wider question in can a UK law firm let AI answer client calls, and what the software does on a call in AI receptionists for law firms.

What should a law firm call recording policy cover?

A checklist for the conversation with your DPO and COLP. It is a list of questions, not answers.

• Scope. Which lines are recorded: the main line, direct dials, mobiles, out-of-hours? Are calls to an answering service or software included?
• Purpose. Written down: disputes, training, record-keeping, supplier oversight.
• Lawful basis. Chosen and documented, with any assessment it requires, and whether special category or criminal offence data conditions apply.
• Telling callers. The exact wording at the start of the call and in the privacy notice.
• Opt-out. What happens if a caller asks not to be recorded.
• Retention. A period per purpose, and what happens when a recording joins a matter file.
• Access. Who can listen, and whether access is logged.
• Suppliers. Where recordings are stored and processed, and the supplier's own retention and deletion.
• Requests. How the firm finds and handles recordings for a subject access or erasure request.
• Review. A date to review the policy, particularly after changing supplier.

What about fee-earners' mobiles and direct lines?

This is the gap most recording policies leave. The main line is recorded and announced; the fee-earner's mobile, where much client contact actually happens, is not, or is recorded by an app nobody reviewed. Decide explicitly whether direct lines and mobiles are in scope, and if a fee-earner uses a personal recording app, bring it inside the same policy or stop it.

Should the receptionist mention recording on every call?

If the firm records, the caller should be told at the start, whoever answers. The simplest way to make that reliable is to put it in an automated message before the call is answered, or as a fixed line in the greeting. A law firm receptionist should also know how to answer a caller who asks why the call is recorded, and where to point them. The wider role is described in legal receptionist duties.

Where does WasilX fit?

Cam, our AI Engagement Coordinator, takes calls on the firm's line at any hour, says it is AI, asks the firm's own qualifying questions, books the call back and sends the firm a summary. How we handle call data is set out on our confidentiality page. If you want to go through it with your DPO or COLP in the room, we are glad to.

Frequently asked questions

Is it legal for a law firm to record phone calls in the UK? Businesses can lawfully record calls in some circumstances, and the rules include the Investigatory Powers interception regulations of 2018 and UK GDPR. How they apply to your firm is a question for your DPO or adviser.

Do we have to tell callers a law firm call is being recorded? ICO guidance on the right to be informed says people must be given privacy information when their data is collected, and the 2018 interception regulations require reasonable efforts to inform users. Firms usually do this at the start of the call.

How long should call recordings be kept? No fixed period is set by the ICO. Its storage limitation guidance says data should be kept no longer than necessary, under a documented retention policy. Your DPO should set the period based on why you record.

Can a caller ask for a copy of their call recording? A recording is personal data, so it can be covered by a subject access request. Make sure your phone system or supplier lets you find and export recordings by caller.

Are call transcripts and AI summaries personal data too? Yes. If they identify the caller they are personal data, and they need the same decisions on retention, access and storage as the audio.