Record business calls legally: simple setup on 3CX, RingCentral and Vonage featured image
Tools, Materials & Tech

Record business calls legally: simple setup on 3CX, RingCentral and Vonage

TrainAR Team 28 days ago 6 min read

Category: Tools, Materials & Tech • Niche: VoIP, call recording, GDPR, Ofcom, small trade teams

Simple VoIP call recording setup for a UK trade business

Contents

Who this is for

  • Owner-operators and small teams who want to record customer calls for training, quality or dispute resolution.
  • Teams moving from PSTN to VoIP and need a compliant, practical setup.
  • Office managers who want a clear policy, scripts and retention rules that stand up if challenged.

Helpful related reads:

Quick answer

  • You can record business calls in the UK without asking for consent each time if you choose a valid lawful basis and tell people clearly. For routine service or training, most small firms use legitimate interests with a short announcement and a clear privacy notice.
  • Do not use call recordings for marketing unless you meet PECR rules. For any automated marketing calls you generally need prior consent.
  • Keep recordings only as long as needed, secure them, and know how to find and export a copy if a customer asks.
  • Choose a lawful basis before recording. For service quality or training, legitimate interests is commonly used if people would reasonably expect it and you minimise the impact. Do a short Legitimate Interests Assessment and file it. See the ICO’s guide to legitimate interests.
  • Be transparent. Tell callers at or before the start that calls may be recorded, why, and where to read your full privacy info. See ICO on the right to be informed.
  • If you rely on consent, it must be freely given, specific and easy to withdraw. See ICO on consent management.
  • Marketing calls are different. Automated marketing calls need consent and live marketing calls have specific PECR rules. See ICO on telephone marketing.
  • Recording employee calls counts as monitoring. Keep it necessary and proportionate, tell staff, and consider a DPIA. See ICO on monitoring workers.

Tip: If your work phones are now VoIP because of the PSTN switch off, double-check 999 access and provider resilience. Ofcom’s guidance on emergency-call access is here: Power cuts and access to emergency organisations.

15-minute setup: 3CX

This gets you basic, compliant recording on a self-hosted or hosted 3CX.

  1. Decide scope
  • Record all inbound to the main number and on-demand for engineers’ extensions. Keep outbound sales non-recorded unless you have a clear basis.
  1. Announcement and privacy info
  • Add an IVR or greeting: “We record some calls for training and quality. See our privacy notice at yoursite.co.uk/privacy.” Put the full privacy notice on your site.
  1. Enable and test recording
  • In 3CX Management Console: Extensions → select extension → Options → Record Calls. Choose Always or On Demand. For queues: Call Queue → Recordings → Enable.
  • Test inbound and outbound and verify files land in your recordings store.
  1. Storage and retention
  • Set a retention rule, for example 90 days for routine calls and longer only for active disputes. Keep access limited to managers.
  1. Access control
  • Create a shared folder with restricted access or use 3CX’s role controls so only approved users can play or download recordings.
  1. Document it
  • Save a one-page SOP describing who is recorded, why, where files are stored, and how long you keep them.

15-minute setup: RingCentral

Solid cloud option with clean admin controls for UK teams.

  1. Set recording mode
  • Admin Portal → Phone System → Auto-Receptionist → Call Recording. Enable Automatic Call Recording for selected users or departments. For sensitive roles keep to On-Demand.
  1. Add announcement and link to privacy
  • Configure your IVR greeting with the short disclosure and point to your website privacy notice.
  1. Retention and access
  • Set retention in Analytics or Recordings settings to match your policy. Restrict download rights to managers. Audit who can access recordings.
  1. Prove it works
  • Make a test call and confirm the call shows in Recordings with the correct user and timestamp. Export one file and store a sample in your audit pack.

Helpful demo:

Alternative: Vonage checklist

Vonage Business Communications supports automatic and on-demand recording with admin policies.

  • Turn on recording at the user or call queue level.
  • Add a front-of-queue announcement that mentions recording and points to your privacy notice.
  • Set a default retention, ensure recordings are stored in the approved region, and restrict access by role.
  • Run a monthly spot-check that a random sample plays, has a timestamp, and can be exported for a subject access request.

Retention, security and access control

  • Retention
    • Routine service calls: 30 to 180 days is typical. Keep longer only for ongoing complaints or legal reasons. Document your schedule.
  • Security
    • Store recordings in provider storage or a secure cloud drive with MFA. Don’t email files around. Encrypt at rest if exporting.
  • Access
    • Least privilege. Only named roles can play or download. Keep an access log where possible.
  • Subject access requests
    • A customer can ask for a copy. Know how to search by date, number and agent, and how to redact third-party data if needed. See ICO guidance on accountability and record keeping in video-surveillance guidance.

No-signal and mobile calls: what actually works

  • Native mobile calls on iPhone and many Androids cannot be auto-recorded for privacy and OS reasons. Use your provider’s VoIP app over data or Wi-Fi if you need recording.
  • Rural jobs with poor data
    • Use Wi-Fi calling or a multi-network SIM in the van router so your VoIP app stays online.
    • If a call drops, your safety net is voicemail to ticket: capture voicemail, auto-transcribe and create a job. See our guide: Voicemail to job.

Outbound calls: avoid silent call issues and show your number

If you use diallers or click-to-call from your CRM:

  • Present a valid, returnable UK number. Ofcom expects a diallable CLI and providers must block spoofed UK numbers from abroad. See Ofcom’s CLI guidance.
  • Avoid silent calls. If a call is abandoned, play an information message promptly and include who called and a basic-rate opt-out number. See Ofcom’s Persistent Misuse policy and advice on abandoned and silent calls.

Troubleshooting and audit pack

Keep a simple folder called “Call Recording Audit” with:

  • Your lawful basis note: one page LIA or the consent approach if you use it.
  • Scripts: the exact announcement text and your privacy notice link.
  • System screenshots: where recording is enabled, where retention is set, and who has access.
  • Test evidence: one exported file per quarter with date, time, number, and agent noted.
  • Issue log: any failures and fixes, e.g., an extension not recording after a change.

Sample announcement scr…