Recording sales calls in Germany: what the law requires

This article is a general overview, not legal advice. Check your specific situation with your data protection adviser or a law firm.

Recorded sales calls are the most honest source of what happens in sales: which objections come up, where deals stall, and what separates strong calls from weak ones. Before you record the first one, two things have to be right: criminal law and data protection.

In short

• As a rule, you may only record a call if everyone on it agrees.
• Consent has to be given before recording starts, on an informed basis, and you must be able to prove it.
• Whoever records must explain the purpose, retention period and people's rights (Art. 13 GDPR).
• If there is a works council, it has a say before call analysis software is introduced.
• If a provider processes the recordings for you, you need a data processing agreement (DPA).

Criminal law: § 201 StGB

Under § 201(1) of the German Criminal Code (StGB), it is an offence to record another person's privately spoken words without authorisation, or to use such a recording or make it available to others. The penalty is up to three years' imprisonment or a fine.

A sales call by phone or video conference counts as private, even when it is purely about business. Recording it is authorised when everyone on the call has agreed. That is why the consent question belongs at the start of the call, before recording begins. A general sentence in your terms and conditions or email signature usually does not replace it.

Data protection: the recording is personal data

A person's voice and what they say are personal data (Art. 4(1) GDPR). The recording, the transcript and the analysis all need a legal basis under Art. 6 GDPR.

For calls with customers and prospects, that basis is in practice usually consent (Art. 6(1)(a) GDPR). Whether legitimate interest (point (f)) can justify recording a full call is disputed. Since § 201 StGB already requires you to ask, it makes sense to ask in a way that also meets the GDPR's standard.

Valid consent is:

• freely given: someone who says no still gets the call, just without a recording.
• informed: the person knows who is recording and why.
• specific: for example, for training and quality purposes.
• provable (Art. 7(1) GDPR): note when and how consent was given.
• revocable at any time (Art. 7(3) GDPR).

How the question can sound at the start of a call

"Before we start: we record our calls to train our team and keep improving. We only use the recording internally and delete it after 90 days. Is that all right with you?"

Adjust the purpose and period to what you actually do. If the person says no, don't start recording and carry on with the call as normal. On video calls this applies to every participant, including the customer's colleagues who join later.

Information duties under Art. 13 GDPR

Besides consent, you have to inform the people on the call, at the latest when recording starts, about things such as:

• who is responsible and how to reach you,
• the purpose of the recording and its legal basis,
• how long the recording and transcript are kept,
• which recipients or service providers receive the data,
• their rights, for example to access, erasure and withdrawal of consent.

A two-step approach works well: a short notice on the call, and the full privacy information as a link, for example in the meeting invitation.

Your own employees

It isn't only the customer who is recorded, but your sales team too. § 201 StGB applies to them as well: your employees also have to agree to being recorded.

The works council's say. Under § 87(1) no. 6 of the Works Constitution Act (BetrVG), the works council has a right of co-determination over technical systems that can monitor employees' behaviour or performance. The courts hold that it is enough for software to be capable of this, and call analysis typically is. The usual route is a works agreement that sets out purpose, access rights and deletion periods.

Consent at work. Because employees depend on their employer, their consent only counts as freely given to a limited extent. Put in writing what recordings are used for, such as coaching, and what they are not used for, such as automated performance ratings.

When software processes the recordings

If you upload recordings to a transcription and analysis tool, its provider processes the data on your behalf. Art. 28 GDPR requires a data processing agreement for that. Before you start, also check:

• whether the provider uses your recordings for its own purposes, such as training AI models,
• what happens to recordings and transcripts when the contract ends.

Set a retention period

Recordings may only be kept for as long as the purpose requires (Art. 5(1)(e) GDPR). Set a fixed period and delete the recording and transcript once it ends. Keeping them "just in case" is not allowed.

Austria and Switzerland have their own criminal law rules on audio recording. If your team speaks with customers there, check the rules in each country separately.

Checklist

1. Define and document the purpose of recording.
2. Word the consent question and record every agreement.
3. Provide privacy information under Art. 13 GDPR, for example in the meeting invitation.
4. Involve the works council, if there is one.
5. Sign a DPA with the software provider.
6. Set a deletion period and stick to it.

Where Klarruf fits in

Klarruf transcribes and analyses the recordings you upload. We act as a processor under a DPA and never use your recordings or transcripts to train AI models. Getting consent from the people on your calls stays your responsibility, as our FAQ also says. How Klarruf handles your data is set out on the Transparency page.