May I record a sales call under the GDPR?

Yes, in most cases, as long as nobody is recorded without knowing it. Under the GDPR you need a lawful basis (usually legitimate interest, sometimes consent), you tell every participant before the recording starts, you keep only what the purpose needs for a set period, and your recording vendor signs a processor agreement. National rules can add conditions. This is general information, not legal advice.

Which lawful basis covers recording a sales call?

For most B2B sales teams it is legitimate interest under Article 6(1)(f) of the GDPR, backed by a written balancing test. Your interest is concrete: accurate notes, a better follow-up and coaching reps on real conversations. You weigh it against what the people on the call reasonably expect and what the recording reveals about them. A discussion about a software rollout weighs differently from a call where someone’s health or personal finances come up.

The balancing test is a document, not a feeling. Write down the purpose, why recording is necessary for it (could written notes do the job?), which safeguards you apply (limited access, a retention period, no secret recordings) and how a participant can object. Under Article 21, anyone can object to processing based on legitimate interest, so decide in advance what happens when a buyer says “please don’t record this”.

Consent under Article 6(1)(a) is the other route. It has to be freely given, specific, informed and as easy to withdraw as to give (Article 7). It fits when you would stop recording anyway if someone says no, which in sales is often the honest default. It is a weak basis for your own employees: European regulators consider consent within an employment relationship rarely free, because saying no to your employer is not a neutral choice.

Then check the national rules that sit next to the GDPR. In Belgium, the Gegevensbeschermingsautoriteit states that recording electronic conversations is prohibited in principle, with exceptions such as the consent of everyone in the conversation, keeping evidence of commercial transactions, and quality control in call centres. For calls with Belgian participants, many teams therefore ask everyone to agree at the start of the call, which settles both layers at once.

Who has to be told, and when?

Everyone on the call, before the recording starts. Articles 13 and 14 require you to tell people who processes their data, why, on what basis, how long it is kept and which rights they have. A clause in your general terms does not cover a recording that starts the moment a call opens.

The Dutch Autoriteit Persoonsgegevens is explicit: an employer must tell the person an employee is calling, such as a customer, in advance that the call will be recorded and what the recordings are used for. In practice that takes three layers: a sentence in the meeting invite, an announcement when the recording starts, and a link to your privacy notice for the details.

If someone objects, stop recording that call. One missing recording costs less than the trust you would lose by pushing on.

What about your own sales reps?

Your reps are data subjects too, and the rules for monitoring employees apply to them. The Autoriteit Persoonsgegevens says employees have the right to know when their calls are recorded, that telling them once at hiring is not enough, and that an employer may not covertly record calls to supervise, train or assess employees. Coaching on recorded calls is fine; coaching on secret recordings is not.

In the Netherlands, two more points. If your organisation has a works council (ondernemingsraad), you must first ask for its consent to rules for monitoring personnel. And systematic monitoring of employees calls for a data protection impact assessment (DPIA) under Article 35, with advice from your DPO. In Belgium, the Gegevensbeschermingsautoriteit expects the employer to inform employees concretely, for example in the work regulations (arbeidsreglement), and warns against excessive monitoring.

Tell reps what is recorded, who can listen, what the scorecards are for and what they are not for. Reps who know the rules use their recordings to get better instead of working around them.

How long may you keep a recording?

As long as the purpose needs it, and no longer. Article 5 sets the principles of data minimisation and storage limitation. The GDPR names no fixed number of days for sales calls, so you choose a period per purpose and enforce it automatically.

A workable split: keep audio and video only as long as coaching and dispute handling need them; keep the transcript, scorecard and CRM notes longer when they are part of the deal record; delete everything about prospects who never became customers after a set time. Put the periods in your record of processing activities and your privacy notice, and let software do the deleting instead of relying on someone remembering.

What must your recording vendor sign?

A data processing agreement under Article 28. The vendor processes recordings on your behalf, so the contract limits processing to your instructions, sets security measures, lists subprocessors and covers deletion when the contract ends.

Ask where the data is processed, not only where it is stored. Transfers outside the European Economic Area fall under Chapter V of the GDPR and need a basis such as an adequacy decision or standard contractual clauses. Transcription and AI models count: a vendor that stores files in Frankfurt but sends the audio to a model hosted elsewhere is transferring data. And ask, in writing, whether your calls are used to train anyone’s models.

What should you check before you press record?

Eight things, most of them a one-off:

1. Write down the purpose: notes, follow-up, coaching, or all three.
2. Choose the lawful basis and document it: the balancing test for legitimate interest, or how you collect and log consent.
3. Check the national rules for the countries your participants are in, such as the Belgian rules on recording electronic communications.
4. Announce the recording in the invite and again when it starts; stop when someone objects.
5. Inform your reps in writing and, in the Netherlands, ask the works council for consent where one exists.
6. Assess whether you need a DPIA, and involve your DPO.
7. Set retention periods per type of data and automate deletion.
8. Sign a processor agreement, review the subprocessors and confirm where storage, transcription and AI models run.

How does Drummer handle consent and data?

Drummer covers the parts of that list a tool can cover. The meeting bot announces itself and the recording when it joins a Google Meet, Microsoft Teams, Zoom or Webex call, so everyone hears it before anything is said on the record. In the phone app for in-person meetings, the rep confirms consent with a toggle before recording starts. Retention controls set how long recordings, transcripts and scores are kept.

Everything is processed in the EU: AWS Frankfurt, EU transcription and EU-hosted models. We don’t train models on your data, members see only their own calls, every change Drummer makes is in an audit trail, and a DPA is available on request. The details are on the security page, how calls are captured is on Capture, and the short definition is in the glossary under call recording consent.

This is not legal advice. This article explains the general rules as we read them in October 2026. Rules differ per country and per situation, and regulators update their guidance. Check your own setup with your data protection officer or counsel, and see the Gegevensbeschermingsautoriteit (in French, Autorité de protection des données) in Belgium and the Autoriteit Persoonsgegevens in the Netherlands.