call-recording-consent-notice

---
name: call-recording-consent-notice
description: Builds the exact wording you say or play before a booking line call is recorded, decides how long the recording is kept and who can hear it, and checks the whole arrangement against the law that actually authorises call recording for a UK business and the transparency duty that sits alongside it. It will not let a notice go out with no stated purpose, no stated retention period and no stated lawful basis, because a recording made without those is not a recording you can defend. Use before you switch call recording on, and before you change what it is used for.
---

# The call recording notice you can actually defend

You give this whether you record calls at all, what you use the recordings for, how long you intend to keep them and who in the business can listen back. You get the exact spoken or texted wording, the retention rule written down, the lawful basis named, and a log entry per version. It will not write you a notice that promises confidentiality it cannot keep, and it will not let "we may record this call" stand alone with nothing behind it.

## What it does

1. **Fix what the recording is actually for, before writing a word of the notice.** Regulation 3(2) of the Telecommunications (Lawful Business Practice) (Interception of Communications) Regulations 2000 authorises interception only where it is "solely for the purpose of monitoring or recording communications relevant to" the controller's business, and only where the telephone system is "provided wholly or partly" for that business. A line recorded to check bookings are taken correctly is covered. A line recorded to catch out a member of staff for an unrelated reason is not, because that is not relevant to the business purpose the regulation names.

2. **Tell the caller before the recording starts, not somewhere in a policy nobody reads.** Regulation 3(2)(b) requires the controller to "make all reasonable efforts to notify every person who may use the telecommunication system in question that communications transmitted by means thereof may be intercepted." Article 13(1) of the UK GDPR adds the content: the notice must be given "at the time when personal data are obtained" and must include, among other things, the identity and contact details of the controller and the purposes of the processing.

3. **State how long the recording is kept, and mean it.** Article 5(1)(e) of the UK GDPR requires personal data to be "kept in a form which permits identification of data subjects for no longer than is necessary for the purposes for which the personal data are processed." A notice that says calls "may be recorded for training and quality purposes" with no end date is not compliant with this on its own; the retention period or the rule for setting one has to exist somewhere in writing, even if it is not read out on the call itself.

4. **Decide the lawful basis separately from the notice, and write it down.** The 2000 Regulations authorise the interception; they do not by themselves supply the UK GDPR lawful basis for processing the resulting personal data. For an ordinary booking line, Article 6(1)(f) usually fits: processing "necessary for the purposes of the legitimate interests pursued by the controller," balanced against the caller's own rights. Consent is a different basis with different conditions, and a notice should not claim consent has been given just because the caller carried on talking after hearing it.

5. **Write the notice itself as one short, factual sentence, said or sent before any question is asked.** It should name the business, say the call may be recorded, say why in a few words, and say where to go with a query. It should not thank the caller for consenting, since a caller on a booking line who wants a table has no real alternative route to reach you, which is exactly why the law relies on notice rather than on freely given consent for this kind of call.

6. **Limit who can play the recording back, and say so in the same document that sets the retention period.** Article 5(1)(f) requires personal data to be "processed in a manner that ensures appropriate security," which includes restricting playback to the people who actually need it for the stated purpose, not the whole team.

## Then it checks

1. The stated purpose of recording is written down, and it matches something regulation 3(2) actually covers.
2. The notice is worded to be given before or at the start of the call, not buried in a separate policy page only.
3. A retention period, or a clear rule for setting one, is recorded in writing, and it is not "indefinitely" or blank.
4. A lawful basis is named for the processing, separate from the recording authorisation, and is not recorded as "consent" unless a real free choice existed.
5. The notice states the business name, the fact of recording, the purpose, and a contact point for queries.
6. Access to recordings is limited to a named list of roles, written down alongside the retention period.

Any check fails: name it, redo that step once. Failed twice: say what is wrong and stop.

## Rules
- Public information only.
- Never invent a fact, a number or a quote.
- Anything sent in someone's name says whose name it is.
- Never describe a recording as covered by the 2000 Regulations where its purpose is not relevant to the business, however convenient that would be.
- Never write "consent" as the lawful basis for a line callers must use to reach the business, unless a genuine alternative route was offered and recorded.
- Never set or accept an open-ended retention period; where none is given, this is logged as a gap, not filled in with a guessed figure.
- Never suggest recordings may be shared externally (reviews, adverts, training materials outside the business) without a separate, specific permission from the person recorded.
- This output is a working document prepared for the owner to check against their own phone system, call-handling process and the current wording of the relevant legislation, and for their solicitor or data protection adviser to check where the lawful basis or an access request is in doubt. It applies published legislation to a draft notice; it is not legal advice and it is not confirmation that a given recording set-up complies.

## Built from
- The Telecommunications (Lawful Business Practice) (Interception of Communications) Regulations 2000, SI 2000/2699, regulation 3, https://www.legislation.gov.uk/uksi/2000/2699/regulation/3/made, made 2000, read 4 November 2026: the business-relevance condition, the notification duty and the permitted purposes behind steps 1 and 2.
- UK GDPR (Regulation (EU) 2016/679 as it forms part of UK law), Article 13, https://www.legislation.gov.uk/eur/2016/679/article/13, read 4 November 2026: the content and timing of the transparency notice behind step 2.
- UK GDPR, Article 5(1)(e), https://www.legislation.gov.uk/eur/2016/679/article/5, read 4 November 2026: the storage limitation principle behind step 3.
- UK GDPR, Article 6(1)(f), https://www.legislation.gov.uk/eur/2016/679/article/6, read 4 November 2026: the legitimate interests basis discussed in step 4.
- UK GDPR, Article 5(1)(f), https://www.legislation.gov.uk/eur/2016/679/article/5, read 4 November 2026: the security principle behind step 6.

# call-recording-consent-notice

## You are given
The exact wording the owner wants to use for each version of the notice (spoken at the start of a call, a voicemail greeting, an SMS, printed signage), with its channel. The stated purpose of recording for each line in use (bookings, complaints, training, other). The retention period decided for each purpose, or the rule used to set one. The lawful basis chosen (`legitimate interests`, `consent`, `contract`, `legal obligation`, `other`) with a one line justification. The list of roles permitted to access recordings. Any previous version of the notice and its log entry.

## Produce
Write into a `./call-recording-consent-notice-output/` folder:

1. `notice-set.csv` with columns: `variant_ref`, `channel`, `notice_text_verbatim`, `characters`, `names_the_business`, `states_recording_fact`, `states_purpose`, `states_contact_for_queries`, `contains_consent_language`. `channel` is one of `spoken`, `voicemail`, `sms`, `signage`, `other`. The last five columns are `yes` or `no`, found by literal search, case insensitive, for the business name, the words `record`/`recorded`/`recording`, a stated reason, a named contact method, and the word `consent` or `agree` respectively.
2. `retention-table.csv` with columns: `purpose`, `retention_period_stated`, `retention_period_days`, `rule_or_justification_verbatim`, `deletion_method`. `retention_period_days` is a number only where one was supplied; otherwise it is blank and the row is also listed in `gaps.md`.
3. `lawful-basis-table.csv` with columns: `purpose`, `lawful_basis`, `justification_verbatim`, `alternative_contact_route_existed`. `alternative_contact_route_existed` is `yes` or `no`; where `lawful_basis` is `consent` and this is `no`, the row is flagged in `gaps.md`.
4. `access-list.csv` with columns: `role`, `purpose_access_is_for`, `has_access`. `has_access` is `yes` or `no`.
5. `gaps.md` - a numbered list of: any notice variant missing a required element from `notice-set.csv`; any purpose with no retention period or an open-ended one (`indefinite`, `forever`, blank); any `consent` basis with no alternative route recorded; any access role with no stated purpose; and any supplied text containing an em dash, flagged but not altered.

## Rules
- Codex counts, matches and records. It never drafts the notice wording, never invents a retention period or a lawful basis, and never decides whether a basis is correct in law.
- Never write marketing, persuasive or thank-you language into any notice text. If the supplied text contains it, copy it verbatim and flag it in `gaps.md`.
- Never mark `contains_consent_language` as the reason a basis is lawful. That judgement belongs to the person who supplied the lawful basis.
- Counts and searches are literal and exact, never estimated. Every quoted notice is copied character for character, including punctuation and emoji.
- Never connect to a phone system, a CRM, or a messaging platform, and never send or play anything.
- Use British English, GBP and DD Month YYYY dates. No em dashes in any file you write; flag rather than correct one in supplied text.
- Every file ends with this line: this is a working document prepared for the owner to check against their own phone system and call-handling process, and for their solicitor or data protection adviser to check where the lawful basis or an access request is in doubt. It applies the supplied rules to a draft notice and is not confirmation that a recording set-up complies.

## Return
The absolute path of each file written and the row count of each CSV. The number of notice variants and how many pass each of the five checks in `notice-set.csv`. The number of purposes with no retention period recorded, listed by purpose. The number of `consent` bases with no alternative route, listed by purpose. The size of the access list and which purposes have no role assigned. The `gaps.md` item count in full.