Recording a phone call is not forbidden, but it is processing of personal data: it needs a legal basis, it has to be announced to the caller and it cannot sit in storage forever. Here is what to settle before you switch recording on.
Recording, transcript and note are three different things
A caller's voice is personal data, and so is the transcript you make of it. The weight differs: audio carries the tone, the noise in the room and everything the customer says by accident, a transcript carries only the words, a note with a name, a number and a time the minimum needed to fix the appointment.
So the first question is not how to record, but whether you need to. To take a booking a name and a number are enough: keeping the audio of every call is an extra choice, and it has to be justified.
The legal basis you record on
Article 6 requires a legal basis for every processing operation. For calls two routes work: the caller's consent, collected before recording starts, or legitimate interest, which you have to write down in a short assessment: the purpose, why a less intrusive means would not do, how the caller's interest weighs against yours.
Consent has to stay free: if someone who says no cannot get an appointment, it is not consent. Leave a second route, carry on without recording or call the person back.
What the caller must hear before speaking
Article 13 wants the information at collection, so at the start of the call and not at the end. Ten seconds hold four items: who processes the data, why you record, how long you keep it and where the full privacy notice can be read, usually one page on your site.
The announcement only holds up if that page exists and is current. Callers can ask for a copy of the recording, ask for erasure and, under legitimate interest, object: name the address to write to. With Rispondly the first sentence already says a virtual assistant is speaking.
How long you may keep the audio
The GDPR gives no number of days. Article 5 says data stays for as long as the stated purpose needs, and the period has to be announced in advance. In practice quality checks are measured in days or a few weeks; proof of an order or a cancellation runs into months, and then you keep only the calls of that case.
The period you publish becomes a promise: it needs automatic erasure at the deadline, not a reminder in your calendar. If the supplier cannot tell you when it deletes, the problem becomes yours.
The record of processing and the supplier contract
Article 30 asks for a record of processing activities. The exemption below 250 employees falls away once processing is not occasional, and recording incoming calls is not occasional. The entry names the purpose, the categories of people and of data, the recipients, any transfer outside the European Union and the retention period.
If the assistant on the phone is an outside service, that supplier is a processor and the contract under Article 28 is mandatory. Ask where the servers sit and whether calls end up training models.
When it is wiser not to record
If employees answer the phone, a system that records everything becomes a tool that can monitor them from a distance: Article 4 of the Italian Workers' Statute then requires a union agreement or clearance from the labour inspectorate.
When the reason for the call reveals health, as at a medical or a psychology practice, Article 9 comes in: the safe choice is to keep no audio and stop at a name, a number and a time. Recording a conversation you take part in is not a crime, but doing it daily for your business is still data processing.