Compliance Resource
Access Control for Call Recordings and Enquiry Data
Protecting call data is mostly a question of who can reach it. This guide covers role-based access, the accounts people forget, and how to keep review from becoming surveillance of your own staff.
Start from roles, not people
The Personal Data Protection Act expects reasonable security arrangements to protect personal data in your possession. For call data, the most effective arrangement is usually the least glamorous: restricting access to the people whose work requires it.
Define access by role rather than by individual. A receptionist covering the front desk needs today’s enquiries; a flow owner needs to review a sample of calls; a finance colleague probably needs neither. Individual exceptions accumulate until nobody can say who has access to what.
Then decide separately who can export, who can delete, and who can change the access list itself. Those three permissions cause most of the trouble and are the ones worth keeping narrow.
A workable access model
Adapt this to your organisation. The point is that each row has a reason, and anything not listed is denied by default.
| Role | Typically needs | Typically does not need |
|---|---|---|
| Front desk or reception | Current enquiries and today’s bookings | Historical recordings or bulk export |
| Escalation handlers | The summary for calls transferred to them | Access to unrelated callers’ records |
| Flow owner | A sample of calls for review and correction | Ability to delete records or alter retention settings |
| Follow-up owner | Enquiry records assigned to them | Audio recordings, in most cases |
| Data protection officer | Full visibility for access, correction and deletion requests | Day-to-day operational use |
| Administrator | Account, integration and retention settings | Routine listening to customer calls |
Note how often audio is unnecessary. Where a structured summary does the job, giving access to that rather than the recording reduces exposure without slowing anyone down.
The gaps that open quietly
Shared accounts
A single login used by several people removes any ability to say who did what. Individual accounts cost nothing and make everything else possible.
Leavers
Access rarely gets removed on the last day. Add call systems, shared inboxes and messaging channels to your offboarding list explicitly.
Personal devices
Enquiry alerts forwarded to a personal phone or messaging app sit outside your controls entirely. Decide whether that is acceptable, and say so either way.
Shared inboxes
An inbox that receives every enquiry notification effectively grants full historical access to everyone who can open it, indefinitely.
Contractors and agencies
Marketing agencies and IT contractors are often granted access for one project and keep it for years. Time-limit external access and diarise the review.
Integration credentials
Connections authenticated under one person’s account inherit their permissions and break when they leave. Use an account that belongs to the business, as covered in integration planning.
Review without surveillance
Reviewing calls improves the flow, but the same access can easily become monitoring of individual employees. Separate the two purposes deliberately, and tell your team which one you are doing.
Practical separation: review a sample rather than an individual’s full history, frame findings as changes to wording and routing rather than personal performance, and involve the people who take the calls in the review itself. This is also how you get honest reporting, as set out in our guidance on training your team.
Employee monitoring is its own subject. Where recordings could be used in relation to an individual’s employment, treat that as a workplace and data protection question with its own notification requirements, and take advice before relying on call data in any personnel matter. Grievances and personal HR matters should never be handled through the automated flow in the first place.
Access control checklist
- Access is defined by role, with anything unlisted denied by default
- Every user has an individual account; no shared logins
- Export, delete and permission-changing rights are held by a small named group
- Audio access is granted only where a summary genuinely will not do
- Offboarding covers call systems, shared inboxes and messaging channels
- External parties have time-limited access with a diarised review
- Integrations authenticate under a business account, not a personal one
- The access list is reviewed on a set schedule, and the review is recorded
- Staff know when calls are reviewed and for what purpose
Frequently asked questions
How often should we review who has access?
Set a fixed schedule you will actually keep, and additionally review whenever someone joins, changes role or leaves. A review that happens on a date is more reliable than one that happens when someone remembers.
Should the whole team see call recordings?
Rarely. Most staff need the enquiry summary relevant to their work. Broad access to recordings increases exposure without improving anyone’s ability to do their job.
Is it acceptable to send enquiry alerts to WhatsApp?
It is convenient and it is also outside your access controls and retention schedule. If you do it, limit what the alert contains, and record the decision rather than letting it happen by default.
Who should be able to delete records?
A small group, usually including your data protection officer. Deletion rights spread widely make retention schedules and incident investigation harder, not easier.
What access do you have to our call data?
Ask us directly, and ask every supplier the same question. The answer should be specific about who, for what purpose and under what controls, and it belongs in your vendor due diligence record.
Do we need audit logs?
They are what allow you to answer questions after an incident. Check what logging is available in each system before you need it, not during an investigation.
Related reading
The wider set of data protection guides sits in the AI receptionist resources library.
Set access before the first real call
We will walk through who in your business would see what, and where a summary would serve instead of a recording.