Call Centre Compliance: The Complete Guide to Audio, GDPR, PCI DSS & FCA Risk
Most compliance programmes protect call data once it is stored. The risk starts earlier, in what agents and customers can hear on a live call.
Rolled out to more than 15,000 agents at one of Europe’s largest banks | Noise complaints cut to zero at Sopra Steria | 11% higher first call resolution at a UK gaming company
What is call centre compliance?
Call centre compliance is the set of laws, regulations and industry standards that govern how a contact centre handles customer data, records calls and treats customers and staff.
In the UK, that means the UK GDPR and the Data Protection Act 2018, PCI DSS for card payments, FCA rules, including the Consumer Duty, for financial services, and health and safety law for employees. Each of these assumes that calls are clear and private. Background noise and overheard conversations undermine both, which is why audio belongs in a compliance risk assessment alongside storage, access and consent.
Why audio is the compliance blind spot in most contact centres
Most compliance programmes cover three things: where call data is stored, who can access it, and what consent wording agents read out. Those controls matter. None of them governs what happens on the live call itself, before anything is recorded or saved.
Agents read out card numbers, dates of birth, account details and health information on every shift. On an open-plan floor, those details reach the people sitting nearby. At home, they reach housemates and family. On the customer’s end, background noise causes the agent to mishear, ask again, and reconfirm the same details.
ContactBabel’s UK research found that at least half of customer calls involve customers repeating themselves, meaning sensitive information is spoken aloud more often than necessary. The same noise weakens the evidence you rely on later. A recording in which the customer is hard to hear is a poor record of what was said, whether the dispute ends up with the Financial Ombudsman Service, the ICO or an internal complaints review. Speech analytics and transcription tools suffer too, because they can only work with the audio they receive.
The usual fixes only go partway. Noise-cancelling headsets help the agent hear, but they do not stop nearby voices reaching the microphone and the customer’s line. Acoustic panels and sound masking get expensive every time the layout changes, and they do nothing for home workers. Software-based voice isolation works on the audio itself, in both directions, wherever the agent sits.
Regulators do not use the phrase “audio compliance”. They ask for secure processing, accurate records, fair treatment of vulnerable customers and safe working conditions. Clear, private audio supports each of those, and the four risks below show where.
The four audio risks every contact centre should assess
Four risks account for most of the compliance exposure associated with audio. Each one maps to a regulation your team already works to.
1. Verbal disclosure breach
Anyone who overhears a customer’s personal details without a reason to hear them is a potential unauthorised disclosure. UK GDPR defines a personal data breach to include unauthorised disclosure, and the duty to protect personal data applies on a crowded floor and at a kitchen table alike. Card numbers, medical details and account information travel further than they should when background voices bleed into a call.
- Regulation: UK GDPR and the Data Protection Act 2018
- Key figure: GDPR fines across Europe passed €5.88 billion by January 2025 (DLA Piper)
2. Proof of compliance and evidential quality
Firms are expected to show that they did what they say they did. A hard-to-hear recording cannot show what an agent told a customer or what the customer agreed to. That weakens your position in a complaint, an audit or a dispute, however carefully the file is stored.
- Regulation: UK GDPR accountability principle (Article 5(2)) and FCA COBS 11.8 where it applies
- Key figure: COBS 11.8 requires in-scope firms to keep relevant call recordings for at least five years
3. Vulnerability provision
The FCA’s guidance FG21/1 expects firms to design products, services and communications with vulnerable customers in mind. Background noise makes a call harder to follow for customers with hearing loss, anxiety, dyslexia, ADHD or autism. It also makes it harder for agents to pick up the signs that a customer needs extra support.
- Regulation: FCA FG21/1 - the Consumer Duty and the Equality Act 2010
- Key figure: around half of UK adults show at least one characteristic of vulnerability (FCA Financial Lives survey)
4. Health and safety (acoustic shock)
Employers must protect staff from noise-related harm under the Health and Safety at Work etc. Act 1974 and the Control of Noise at Work Regulations 2005. Acoustic shock, a sudden loud sound through a headset, can leave agents with tinnitus, ear pain, sensitivity to sound and lasting anxiety.
- Regulation: Control of Noise at Work Regulations 2005
- Key figure: more than 700 employees have reached out-of-court settlements over acoustic shock since 1999 with awards of up to £3m
Call centre compliance regulations: what applies and where audio fits
GDPR and call recording consent
UK GDPR and the Data Protection Act 2018 treat a call recording as personal data from the moment it is captured. You need a lawful basis for recording, and consent is only one of six. Many firms rely on legitimate interests or a legal obligation, such as FCA recording rules, rather than asking every caller to opt in. The Telecommunications (Lawful Business Practice) (Interception of Communications) Regulations 2000 also allow UK businesses to record calls for defined purposes, including retaining evidence of transactions and checking compliance with regulatory rules, provided they make reasonable efforts to inform callers. Whichever basis you use, tell callers at the start of the call that you record and why.
Data minimisation applies to audio as it does to any other record. Record what you need, set a retention period for each type of recording and restrict access by role. Encryption and permissions protect the stored file. They do nothing for details spoken aloud in a noisy room, which is where most audio risk sits.
Accuracy is the other half. Article 5(1)(d) states that personal data must be accurate, and every CRM note and transcript begins with what the agent heard. If noise causes an agent to mishear an address or an account number, the record is wrong from the first keystroke. A UK BPO using IRIS Clarity saw its analytics accuracy rise by 5%.
The ICO can fine up to £17.5 million or 4% of annual global turnover, whichever is higher, for serious infringements. Across Europe, GDPR fines passed €5.88 billion by January 2025, according to DLA Piper.
PCI DSS and call centre audio
PCI DSS applies to every channel that takes card payments, including the phone. Version 4.0.1 prohibits storing sensitive authentication data, such as the card security code, after authorisation, even if encrypted, including call recordings. Most contact centres handle this with pause-and-resume or DTMF masking, which keeps card details out of the file.
Neither control stops the agent hearing the numbers live, or a colleague on the next desk hearing them too. Voice isolation removes background voices from the agent’s microphone, so card details spoken during one call are far less likely to reach another line or be recorded. PCI DSS is enforced by card brands and acquiring banks rather than by statute, so penalties are contractual: fines, higher fees, and, in the worst cases, the loss of the ability to accept card payments.
FCA Consumer Duty and vulnerable customers
The Consumer Duty came into force on 31 July 2023 and requires firms to deliver good outcomes for retail customers. Its consumer understanding outcome expects firms to communicate in a way customers can understand, and that has to work in practice on a phone call. FG21/1 adds expectations around vulnerable customers, covering staff skills, service design and communication.
A call where a customer cannot hear properly or an agent cannot distinguish hesitation from interference falls short of both. Financial services teams can include audio quality in their Consumer Duty monitoring and in the management information that goes to the board. Our FCA Consumer Duty guide covers how voice isolation supports each outcome.
Verbal disclosure, open-plan floors and home working
Open-plan contact centres put dozens of agents within earshot of one another, and each of them reads out or repeats personal details many times a day. Headset microphones pick up nearby voices, so one customer’s date of birth can travel down another agent’s line and into another recording. Audio from a headset speaker can also reach colleagues who have no reason to hear it. Each incident may constitute an unauthorised disclosure of personal data.
Home and hybrid working moved the same conversations into kitchens, spare rooms and shared flats. Your obligations are the same, but you control far less of the environment. Housemates can overhear card numbers and health details, and domestic noise raises the chance of errors and repeated questions. The ICO expects you to demonstrate that you have taken appropriate technical and organisational measures wherever processing occurs.
Whether a particular incident counts as a reportable breach depends on the facts. A breach that is likely to pose a risk to individuals must be reported to the ICO within 72 hours of becoming aware of it, and your data protection officer should assess an overheard disclosure in the same way as any other incident.
Practical steps help: a clear-desk and quiet-space policy for home workers, a review of seating plans, and audio checks on QA scorecards. IRIS Clarity adds a technical control. It removes background noise and voices from both sides of the call in real time, so the same standard applies in the office and at home, with no extra hardware to buy or ship.
Acoustic shock and workplace noise
The Control of Noise at Work Regulations 2005 require employers to assess and reduce noise risks, with the lower exposure action value set at 80 dB(A) averaged over a working day. Contact centre agents also face a specific hazard: acoustic shock, where a sudden loud sound through the headset can cause injury. Symptoms include tinnitus, ear pain and sensitivity to everyday sounds, and some agents never return to phone-based roles.
Cleaner audio can help, as agents who hear callers clearly can keep headset volume lower, reducing their exposure over a shift. Our acoustic shock guide covers symptoms, employer duties and prevention steps. You can also estimate your own exposure with the calculator below.
Who this affects
Compliance officers and data protection officers
You decide whether an overheard conversation is logged as an incident, and you need evidence that your controls work on the live call as well as on the stored file. Start with GDPR and call recording and verbal disclosure.
Heads of compliance and conduct risk in financial services
You are accountable for evidencing good outcomes under the Consumer Duty, including for customers who are vulnerable, and audio quality is part of that evidence. Read our FCA Consumer Duty guide and the financial services whitepaper.
Caldicott Guardians and information governance leads in healthcare
Patient information is as exposed on a call as it is in a record. Booking, triage and switchboard teams often work in shared spaces, so overheard calls are a real confidentiality risk. Start with our Caldicott Guardian guide and the healthcare whitepaper.
HR, health and safety and operations leaders
Agents bear the risk of injury, and you bear the duty of care. Check your exposure with the HSE Workplace Noise Calculator, then read our acoustic shock guide for symptoms, duties and prevention steps.
What clear audio does for compliance in practice
A European bank: verbal disclosure risk
One of Europe’s largest banking groups, with operations in more than 35 countries, was concerned about verbal disclosure breaches across its branches, contact centres and hybrid teams. It reviewed hardware and software options and found none that met its compliance requirements and also improved the customer experience. After trials with its technology, operations and compliance teams, the bank deployed IRIS Clarity to more than 15,000 customer-facing employees. Clarity is software only, so no extra hardware was needed.
Sopra Steria: noise complaints reduced to zero
Sopra Steria rolled out IRIS Clarity to improve calls for customers and agents, and noise complaints fell to zero. For compliance teams, fewer complaints can mean fewer disputes to investigate and fewer recordings to review.
A UK gaming company: first call resolution up 11%
A UK gaming company improved first call resolution by 11% and cut errors caused by mishearing by 25%. Fewer mishearings mean fewer inaccurate records, which supports the accuracy principle in UK GDPR.
Want to see how audio quality is measured? Read more customer stories.
Hear the difference
Select a file to listen to:
Contact centres
Card details
Contact centres
Car hire
Contact centres
Bill query
Roadside
PH Crash roadside 01
Roadside
PH Crash roadside 02
Find out how you can take action now!
Haven’t read our whitepaper yet?
Discover if your audio data is breaching compliance laws, and how to protect your business.
Call centre compliance FAQs
Not always. UK GDPR gives six lawful bases for processing personal data, and consent is only one of them. Many firms rely on legitimate interests or a legal obligation, such as FCA recording rules. You must still tell callers that you record calls and why, ideally at the start of the call, and you should document the basis you have chosen.
Yes. A recording of a customer’s voice is personal data, and so is what they say on the call. UK GDPR and the Data Protection Act 2018 apply from the moment you capture it, which means you need a lawful basis, a retention period and appropriate security.
A recording has evidential quality when an independent listener can clearly hear both parties and follow what was said and agreed. Background noise, clipped speech and crosstalk all reduce that clarity and can weaken your position in a complaint or dispute. Test a sample of recordings regularly and keep them for the period your regulator requires.
It can be. UK GDPR defines a personal data breach as a breach of security that leads to the unauthorised disclosure of personal data. Whether a particular incident counts depends on the facts, including what was heard and by whom. A breach that is likely to risk individuals’ rights must be reported to the ICO within 72 hours of becoming aware of it, so your DPO should assess overheard disclosures like any other incident.
PCI DSS applies to every channel that handles card data, including payments taken by phone. You must protect cardholder data wherever you store or process it, and you must never store sensitive authentication data, such as the card security code, after authorisation, even if it is encrypted. That includes call recordings. Many firms use DTMF masking, pause-and-resume or automated payment systems to keep card details out of recordings.
The Consumer Duty covers communications with retail customers, and phone calls are in scope. Firms must communicate in a way customers can understand and support customers with characteristics of vulnerability. Poor audio makes both harder, so call quality is a practical part of meeting the Duty, although the FCA does not set a technical audio standard.
A Caldicott Guardian is a senior person in an NHS, social care or other health organisation who is responsible for protecting the confidentiality of patient and service-user information. Their remit covers every channel that carries it, including calls to patients and carers. An overheard call in a booking or triage centre can breach confidentiality in the same way as a misdirected letter. Our Caldicott Guardian guide explains the role in more detail.
Yes. Data protection law applies wherever an agent works, and you remain responsible for appropriate technical and organisational measures even in homes you do not control. A written home-working policy, secure equipment, and voice-isolation software that removes household noise and voices all help home workers meet the same standard as office teams.
Acoustic shock is an injury caused by a sudden loud sound, usually through a headset, with symptoms such as tinnitus, ear pain and sensitivity to noise. Employers have duties under the Health and Safety at Work etc. Act 1974 and the Control of Noise at Work Regulations 2005 to assess and reduce noise risk. Liability depends on the circumstances, but contact centre operators have faced significant compensation claims. Our acoustic shock guide covers symptoms and prevention.
UK GDPR sets no fixed period. It requires you to keep personal data no longer than necessary and to set a retention period you can justify. Some rules set a minimum: FCA COBS 11.8 requires in-scope firms to keep relevant recordings for at least five years. Check which rules apply to each type of call, document the period, and delete or anonymise recordings when it ends.
Find out where your compliance exposure is
A free Noise Audit shows how background noise affects disclosure risk and recording quality in your contact centre. We walk you through the findings and the practical next steps for your compliance programme.
This page is general information, not legal advice. Check your obligations with your own legal or compliance advisers.