“This call may be recorded for training purposes.” Most callers know the sentence, and many companies consider it sufficient. Germany’s data protection authorities see it differently. At the same time, the issue is growing, because AI features are turning the occasional recording into a transcript of every conversation.<\/p>\n\n\n\n
This article sets out what service teams should settle before switching anything on: legal basis, announcement, employees, deletion periods and vendors. It applies to the situation in Germany; other EU countries share the GDPR but differ in national criminal and employment law. It is not legal advice, and the decision belongs with your data protection officer.<\/p>\n\n\n\n
Under Section 201 of the German Criminal Code, anyone who records another person’s privately spoken words on a sound carrier without authorisation commits an offence, punishable by up to three years in prison. In 2018, the German Data Protection Conference (DSK) resolved that recording is, as a rule, only permitted with the consent of the external party as well. Callers must therefore be asked and must actively agree, for example by saying “yes” or pressing a key.<\/p>\n\n\n\n
According to this resolution, a mere option to object, after which the call simply continues, is not valid consent. You must also be able to prove consent, and it does not cover biometric analysis of the voice.<\/p>\n\n\n\n
Transcripts make the picture less clear. In its short paper of January 2026, the German Association for Data Protection and Data Security (GDD) puts consent at the centre. Performance of a contract only works in exceptional cases, it says, and balancing of interests is conceivable but must be carefully documented. Authors in the journal Betriebs-Berater (issue 20\/2026), by contrast, regard legitimate interest under Art. 6(1)(f) GDPR as the most relevant basis, because consent is often unsuitable in practice. The guidance from the industry association VATM recommends consent as a safeguard, given the lack of case law.<\/p>\n\n\n\n
In practice, this means that obtaining consent is the more cautious route. If you rely on balancing of interests, write the assessment down before the feature goes live. And a transcript without an audio file is still a body of personal data, one that is easy to search.<\/p>\n\n\n\n
Much is decided in the voice dialogue before the call connects. These points belong in the flow:<\/p>\n\n\n\n
Consent can be withdrawn at any time. Agents therefore need a clear way to stop the recording during a call, and a rule for what happens to the part already captured.<\/p>\n\n\n\n
The DSK points out that recording regularly affects employees as well, and that special requirements apply. Employee consent is considered problematic because of the relationship of dependency. Where there is a works council, co-determination under Section 87(1) no. 6 of the German Works Constitution Act usually comes into play, because the technology can monitor behaviour and performance. VATM recommends a works agreement.<\/p>\n\n\n\n
Set out in writing who may listen to or read which recordings for what purpose, and whether analyses may refer to individuals. This is more than legal protection. Teams accept quality work more readily when they know the rules. We describe how conversation analysis is changing quality assurance in our article on contact centre quality assurance<\/a>.<\/p>\n\n\n\n There is no uniform statutory period for recordings. What matters is how long the purpose justifies keeping them. The GDD recommends routinely deleting audio once the transcript is complete. The VATM guidance considers a maximum of one month defensible. These points count for your deletion concept:<\/p>\n\n\n\n Recording and transcription can noticeably ease training and after-call work, provided the rules are in place first. Ask actively, document the decision, limit access and delete consistently. Involve your data protection officer and, where applicable, the works council before the feature goes live.<\/p>\n\n\n\nSet deletion periods, access and vendors<\/h2>\n\n\n\n
\n
Conclusion: rules first, recording second<\/h2>\n\n\n\n