Recording business phone calls: the practical and legal basics

Why businesses record calls

The common reasons are training new staff, checking quality, confirming what was agreed on a sale or booking, and resolving disputes about what was said. Some regulated industries have their own record-keeping expectations, and some businesses record to protect staff who deal with abusive callers. Each of these is a legitimate purpose, but you need to decide which applies to you before you switch recording on.

Recording everything forever because the system allows it is not a purpose. A defined reason helps you decide which calls to record, who can listen, how long to keep recordings and what to tell callers. It also makes it easier to answer a customer who asks why their call was recorded.

Telling callers

In general terms, New Zealand law allows a party to a conversation to record it, but privacy principles require you to be open about collecting personal information and why. In practice that means a short message at the start of calls, such as letting callers know calls may be recorded for training and quality. Put a matching line in your privacy policy, explaining what you record, why and how long you keep it.

For outbound calls, staff should tell the person early in the call if it is being recorded. If a caller objects, have a plan, such as pausing recording or offering another way to deal with their request. Never record calls secretly to gather evidence about staff or customers without proper advice, as that raises legal and employment issues.

The Privacy Act angle

A call recording contains a person's voice and usually details such as their name, account or health information, so it is personal information. The Privacy Act 2020 expects you to collect only what you need, keep it secure, let people access information about themselves on request, and not keep it longer than necessary. A customer can ask for a copy of their recordings, so you need to be able to find them.

If recordings are leaked or accessed by someone who should not have them, and the breach is likely to cause serious harm, you may need to notify the Privacy Commissioner and the affected people. Treat recording storage with the same care as your customer database. The Office of the Privacy Commissioner has plain-language guidance worth reading.

Storing recordings securely

Cloud phone systems usually store recordings with the provider, sometimes with an option to export them to your own storage. Check where the data is held, who at the provider can access it, and how it is protected. Limit who in your business can listen; managers who coach staff may need access, but the whole team does not. Use strong passwords and multi-factor authentication on the phone system admin portal, because it holds every recording. If recordings are exported to file storage, put them in a restricted folder rather than a shared drive. Keep a simple record of who has access and review it when staff leave.

How long to keep recordings

Set a retention period that matches your purpose. Training recordings might only need a few weeks or months. Recordings kept to resolve disputes over agreements may need longer, in line with how long such disputes typically arise. Some industries have specific record-keeping rules; check yours. Once the period ends, recordings should be deleted automatically if the system supports it. Long retention costs money in storage fees and increases the harm if there is a breach. Shorter is usually better unless you have a clear reason. Write the retention period into your privacy policy and configure the system to match it, so practice and policy do not drift apart.

Sensitive information on calls

Avoid taking full card numbers over recorded calls. If you must take payments by phone, ask your payment provider about pausing recording during card capture or using a secure payment link sent by text or email instead. Recorded card details create a security and compliance problem that is much harder to fix later.

Health, legal and financial businesses should think carefully about what is said on recorded lines and who can listen. In some cases, recording only certain queues, rather than every call, is the better balance. Take legal or privacy advice when setting the policy, then train staff so they know what is recorded and how to handle a caller who asks.