Last updated: 24 September 2026
Two sets of rules, not one
Recording a company’s phone calls falls under two separate bodies of law, and clearing only one of them is not enough.
The first is data protection: a recorded conversation is personal data belonging both to the customer and to the employee speaking. The second is Article 4 of the Italian Workers’ Statute, as rewritten by Legislative Decree 151/2015, which governs remote monitoring of employees. It is the one most often overlooked, and the one that can render recordings unusable precisely when they are needed.
What the GDPR requires
Where recordings involve employees, consent is not an adequate legal basis: in an employment relationship there is no genuine freedom to refuse without consequence. The Italian supervisory authority’s guidance has settled on the controller’s legitimate interest, tied to concrete organisational and business needs, which must be documented in a written balancing test and, for processing of this kind, assessed against the impact assessment required by Article 35.
Notice is owed to two different groups: to employees under Article 13, and to the external party through an automated message before the conversation begins. Access to recordings must be limited to named, formally authorised individuals, and the retention period must be set in advance — in the authority’s guidance the recurring reference for call recordings is a short period, no longer than six months.
Article 4, the part that slips through
Article 4 provides that tools from which the possibility of remote monitoring of employees also arises may be installed only with a trade union agreement or, failing that, prior authorisation from the national labour inspectorate.
The second paragraph exempts tools used by the employee to perform their work, and this is where the misunderstanding starts: a phone system is plainly a work tool, so the conclusion is that nothing is needed. But the recording function is not necessary in order to make a phone call: it adds a monitoring capability that goes beyond the tool itself, and the prevailing reading brings it back under the general rule.
The consequence is blunt: a recording collected without those steps is not merely irregular, it is unusable. The company has the audio and can do nothing with it.
What is actually configured in 3CX
Technically the phone system allows the granularity needed to stay inside the perimeter decided beforehand.
- What gets recorded. Recording is set per extension and per queue, not necessarily across the whole system: customer service can be recorded while administration is left out.
- Always or on demand. In on-demand mode the operator starts the recording during the conversation — the more proportionate choice when the purpose is documenting an order rather than monitoring work.
- Announcement and access. An opening message informs the other party; playback and download rights are separate from other permissions and are assigned to individual users.
- How long they stay. Recordings can be archived or deleted automatically once a time or storage limit is reached: that is what turns the retention period stated in the privacy notice into practice.
- Where they physically sit. On premises the audio stays on your own servers; in the cloud it sits on the provider’s infrastructure, which changes who the processors are. That is a choice to make deliberately, not one to inherit from how the phone system happened to be bought.
What I do and what I don’t
I start from the purpose — what the company actually needs to be able to do with those recordings — and from there we define what to record, who listens and for how long. Then I configure extensions, queues, announcements, permissions and automatic deletion, and hand over a document describing how the system is set up, to be filed with the company’s data protection records.
I do not draft the privacy notice, assess the legitimate interest balancing test, or handle dealings with trade union representatives or the labour inspectorate: those sit with the employment adviser, the lawyer or the data protection officer. If none of those are in place, that has to be addressed before recording is switched on, not after. This page sets out the framework for orientation and is not legal advice.
If you are considering call recording
Whether you already run a 3CX phone system or are still choosing one, tell me what you need to achieve: the purpose alone usually makes it clear in a few lines whether you need to record everything, part of it, or nothing.