What the rules say, in one sentence
You can record business calls for a specific, legitimate reason, provided you only record what serves that reason, inform the caller at the outset along with their right to object, keep recordings for a short time and limit access to a few people. Everything else follows from these five conditions.
This guide focuses on recording. The general framework for AI on the phone (announcing the AI, informing callers, the contract with the provider) is covered in our guide to the AI Act and the GDPR. This guide is not legal advice: for a specific case, refer to the pages of the CNIL, the French data protection authority, cited as sources.
Recording, transcript, summary: three different things
When a call is handled by a voice agent, three records may exist, and they don't carry the same weight.
| Record | What it is | Key point |
|---|---|---|
| Summary | The gist of the request: who, what, what next | The most useful day to day, and the lightest |
| Transcript | The full text of the conversation | Complete personal data, to be handled with care |
| Audio recording | The caller's voice | A voice is personal data; this is the record the CNIL's guidelines target |
The GDPR's data minimisation principle settles most cases: if the summary is enough to deal with the request and call the customer back, the audio isn't necessary. Our guide to calling a customer back using the summary shows when the summary and the transcript are enough, and when audio is really useful.
Choosing a purpose, and sticking to it
A recording is justified by what it is used for. The CNIL's guidelines distinguish two uses, with very different retention periods.
| Purpose | Example for a small business | CNIL guideline period |
|---|---|---|
| Training, assessment, quality improvement | Listening back to the agent's first calls to correct its answers, training a new employee | Recordings: 6 months maximum from the date of recording. Analysis documents: intermediate archiving, 1 year maximum |
| Proof of a contract concluded orally | A sale of services concluded over the phone, with nothing in writing | Only if the recording is necessary, neither systematic nor permanent; for example 5 years from when the existence of the contract became known, in intermediate archiving (Article 2224 of the French Civil Code) |
These periods come from the CNIL's reference framework on retention periods in human resources management, in its section on listening to and recording telephone conversations in the workplace, which refers to the CNIL's fact sheets on these two uses. They are ceilings, not targets. And each purpose calls for its own setting: a recording made for training doesn't become, six months later, evidence kept for five years.
Shorter than the maximum: the CNIL's method
The CNIL describes a simple practice: the authorised person listens to the recordings within the following few days and writes the necessary analysis document, then the recordings are deleted shortly afterwards, and only the analysis document is kept.
For a small business starting out with a voice agent, this means:
- a slot each week to listen back to a few calls;
- a short note: what the agent did well, what needs correcting in its instructions;
- correcting the agent's profile;
- deleting the recordings you have listened to.
After a few weeks, once the answers are right, ask yourself frankly: do you still need the audio? Often, the transcript and the summary are enough.
Informing the caller at the right moment
In practice, callers are informed in two stages: a spoken notice at the start of the call, before the conversation really begins, then the details somewhere accessible, your website for example. The spoken notice says that the call is recorded, why, and that the caller can object:
This call is recorded to improve the quality of our answers. You can object by saying so now.
The page on your website adds the rest: who records, for what purpose, who listens, how long the recording is kept, and how to exercise one's rights. Also plan what happens when a caller objects, and test it.
Your employees are affected in the same way: if their calls are recorded, they must be informed beforehand.
The caller's rights
- Objection, at the start of the call, and at any time afterwards.
- Access: the caller can ask what you hold about them, including the recording of their voice. Check their identity before passing anything on.
- Erasure, when keeping the data is no longer justified.
Plan who receives these requests and how you respond: the guide to the AI Act and the GDPR sets out the deadline for responding.
Security: who listens, where it's stored
- Restricted access for the people who need it, yourself and one manager, not the whole team.
- No copies sent through personal messaging apps or left on a shared computer.
- Known hosting, preferably in France or the European Union, and a data processing agreement with the provider.
- A special case for healthcare: in a practice, a recorded call contains health data, and in France its hosting falls under the HDS framework, explained in our guide to health data hosting. The GP surgeries and lawyers pages show how the agent handles calls for a practice bound by professional secrecy; if you are a lawyer, check with your professional body before switching on recording.
What Sayelo does
With Sayelo, you are the controller of your call data, and Sayelo acts as a processor, with a data processing agreement provided to every customer.
- The transcript and the email summary are included on all plans.
- Audio recording is included from the Essentiel plan upwards, but it is never switched on by default: you switch it on knowingly.
- When it is switched on, the announcement at the start of the call says so: the mandatory AI notice is followed by “This call is recorded, you can object”.
- The retention period is limited, in line with the CNIL's recommendations, and you set it according to your needs.
- The right to be forgotten is exercised in one click, from the contact's record.
- Data is hosted in France by an HDS-certified host, with restricted, logged access and communications encrypted in transit.
The security and GDPR page details these safeguards. To compare these settings with those of other solutions, see our comparison of voice agents for small businesses, and the details of each plan on the pricing page.
