UK Recording Laws (2026): Calls, In-Person, Workplace and Police

UK recording questions depend on how the recording is made and used. The Investigatory Powers Act 2016, sections 3 and 4, sets the current telecommunications-interception framework. RIPA section 1 is no longer the operative provision, and its former text should not be treated as a general permission to record or share.

Quick Answer: Which Recording Rule Applies?

The current telecommunications question starts with IPA 2016 sections 3 and 4. Section 4 requires a relevant act involving the system and content being made available to someone other than the sender or intended recipient. A label such as personal use does not replace that statutory test.

For practical examples, see the UK phone-call recording guide and the guide to covert recordings as evidence.

What RIPA Covers Today

RIPA's current text retains powers concerning covert surveillance, covert human intelligence sources and protected information. Section 26 defines directed and intrusive surveillance; sections 28 and 32 contain distinct authorisation requirements. These provisions do not create a general personal-recording licence.

The former interception offence in RIPA section 1 is omitted from the current text. Telecommunications interception is addressed by the Investigatory Powers Act 2016. Section 44 also distinguishes consent by both sender and intended recipient from its separate route involving one party's consent and an applicable surveillance authorisation.

The RIPA 2000 guide explains the surviving powers, authorisation safeguards, Scotland's framework and Tribunal complaints.

The Investigatory Powers Act 2016

The Investigatory Powers Act 2016 supplies the current principal interception framework. Section 3 prohibits intentional interception in the United Kingdom through specified systems or services without lawful authority, subject to its private-system exception. Party status alone is not the complete statutory test.

What the IPA 2016 Criminalises

Under IPA 2016 section 3, it is an offence to intercept a communication without lawful authority. The Act covers:

• Modifying or interfering with a telecommunication system to obtain content.
• Monitoring transmissions on a system, including wireless telegraphy.
• Making the content of a transmission available to someone who was not the sender or intended recipient.

Telecommunication systems include phone networks, the internet, email, and encrypted messaging platforms.

Current Warrant Review and Urgent Issue

The current Investigatory Powers Act 2016 retains independent Judicial Commissioner review of decisions to issue interception warrants under Part 2, Chapter 1. Section 23 requires review of necessity and proportionality. Section 24 provides a separate urgent-issue procedure, with a Commissioner decision required by the end of the third working day after issue; refusal ends the warrant's effect and prevents renewal.

Penalties Under IPA 2016

Civil liability and regulatory action by the ICO (the Information Commissioner's Office, which the Data (Use and Access) Act 2025 converts into the Information Commission from 30 September 2026, still known as the ICO) can arise separately from criminal proceedings.

UK GDPR and the Data Protection Act 2018

Recording a conversation is only the first step. Once a recording captures identifiable information about another person, it becomes personal data under the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018. This overlay applies to organisations and individuals alike, with one important exception: purely personal or household activity is exempt.

The Household Exemption

Individuals recording for purely personal or household purposes are exempt from most UK GDPR obligations (Article 2(2)(c) UK GDPR). If you record a call with your bank for your own notes, you are not processing personal data in a regulated sense. The exemption ends once your use of the recording is no longer purely personal or household, for example if you use it in connection with a business or to promote goods or services.

Lawful Basis for Organisations

Any organisation recording calls or conversations must identify and document a lawful basis under Article 6 UK GDPR before processing begins. The most commonly relied-upon bases are:

• Legitimate interests (Article 6(1)(f)): The most widely used basis for business call recording. Requires a balancing test showing that the business interest is not overridden by the data subject's rights. ICO guidance says you should document the outcome, which it calls a legitimate interests assessment (LIA).
• Legal obligation (Article 6(1)(c)): Applies where recording is mandated by sector regulation, such as FCA rules for financial services firms.
• Contract (Article 6(1)(b)): Where recording is necessary to perform or verify a contract with the individual.
• Consent (Article 6(1)(a)): Valid in principle but rarely the right basis for employment contexts; must be freely given, specific, informed, and unambiguous.

ICO Guidance on Employee Monitoring

The ICO's employee monitoring guidance, which it says is under review following the Data (Use and Access) Act 2025, sets out these key points:

• Monitoring must be justified by a clear, documented business need.
• Workers must generally be informed that monitoring may occur, via a privacy notice.
• Covert monitoring is only permissible in exceptional circumstances such as investigating suspected criminal activity, and only after less intrusive methods have been considered.
• Data Protection Impact Assessments (DPIAs) are required for any systematic or large-scale monitoring programme.
• Recordings must be subject to defined retention policies and automatically deleted at the end of the retention period.

Workplace Call Recording and Business Monitoring

Business call monitoring needs separate analysis of interception authority and data protection. IPA 2016 section 46 provides a regulation-making route for specified business monitoring and record-keeping. Its existence does not authorise every recording labelled training or quality control.

The regulations made under it, the Investigatory Powers (Interception by Businesses etc. for Monitoring and Record-keeping Purposes) Regulations 2018, let a business intercept communications on its own system for listed purposes, such as establishing facts, checking regulatory compliance or standards, and preventing or detecting crime. The interception must be solely to monitor or keep a record of communications relevant to the business, and the business must have made all reasonable efforts to tell users that communications may be intercepted.

The ICO's current worker-monitoring guidance explains that recording every call's content is not usually proportionate. It gives business transactions, training and quality control as possible contexts for necessary monitoring, with attention to less intrusive alternatives.

The guidance says callers must be told that recording is taking place and why. A recorded message is good practice; additional privacy information can be supplied separately. That is data-protection guidance, not a conclusion that an announcement satisfies every interception condition.

The UK workplace-recording guide and covert recordings as evidence cover the separate workplace and court-use questions.

Recording Phone Calls in the UK

A participant recording a telephone call should not be analysed through the former RIPA section 1 as though it remained in force. The current IPA section 4 definition turns on the system activity and who can access the content. The applicable circumstances, rather than a blanket personal-use label, determine whether the interception provisions are engaged.

Recording and Later Use Are Separate Questions

The current IPA section 4 definition addresses a relevant act involving a telecommunications system, access to content and the statutory timing rules. It does not create the personal-use exemption described in older versions of this guide. The way a recording is later used needs its own analysis; it cannot be resolved by quoting the former RIPA interception provision.

Admissibility in Legal Proceedings

A covert recording you have made of your own conversation is generally admissible in civil and criminal proceedings, but admission is not guaranteed. Courts apply a balancing test:

• Civil proceedings: Under the Civil Procedure Rules, courts have discretion to admit or exclude evidence, weighing relevance, authenticity, and fairness.
• Family court: The Family Justice Council published comprehensive guidance in May 2025 on covert recordings in family proceedings. Courts may admit recordings with significant evidential weight. Recording children is strongly discouraged. Parties must disclose recordings early, produce unedited versions, and cannot share recordings with third parties without court permission.
• Criminal proceedings: Courts may exclude evidence obtained unlawfully under section 78 of the Police and Criminal Evidence Act 1984 (PACE) if admitting it would adversely affect the fairness of proceedings.

Recording In-Person Conversations

IPA section 4 concerns telecommunications systems. A face-to-face recording therefore needs analysis of the actual device, setting and use rather than an assumed exception in RIPA. For workplace and evidential questions, see the UK workplace-recording guide and covert recordings as evidence.

Potential issues arise under:

• Privacy law and the tort of misuse of private information: If you record someone in a context where they had a reasonable expectation of privacy (for example, in their home or a private medical consultation), you may face civil liability even if no criminal offence is committed.
• Harassment: Persistent, systematic covert recording of a particular person could constitute a course of conduct amounting to harassment: in England and Wales under the Protection from Harassment Act 1997; in Scotland under sections 38 and 39 of the Criminal Justice and Licensing (Scotland) Act 2010 (and civilly under section 8 of the 1997 Act); and in Northern Ireland under the Protection from Harassment (Northern Ireland) Order 1997 and the Protection from Stalking Act (Northern Ireland) 2022.
• Data protection: If you process the recording in a way that goes beyond personal household use, UK GDPR applies.

Recording the Police

You have the right to film and record police officers carrying out their duties in a public place. There is no specific criminal offence of filming a police officer in the UK.

The Metropolitan Police states explicitly in its public guidance that members of the public and the press do not need a permit to film or photograph in public places, and police have no power to stop them filming police personnel. This reflects the right to receive and impart information under Article 10 of the European Convention on Human Rights, as incorporated into UK law by the Human Rights Act 1998.

What Police Cannot Do

Police officers cannot:

• Require you to stop filming without a specific legal power.
• Demand you delete footage from your phone without a court order or warrant.
• Seize your device purely because you filmed them.

What You Must Not Do

• Obstruct a police officer in the execution of duties (Police Act 1996 s.89 in England and Wales; Scotland and Northern Ireland have equivalent offences).
• Elicit or publish information about a constable of a kind likely to be useful to a person planning a terrorist act (Terrorism Act 2000 s.58A, inserted by the Counter-Terrorism Act 2008 s.76; this requires the terrorist-assistance nexus, not mere filming of police activity).
• Film in premises where filming is restricted by a court order or security designation.

Bridges v South Wales Police [2020] EWCA Civ 1058

In August 2020, the Court of Appeal held that South Wales Police's use of live automated facial recognition technology was unlawful. The court found three grounds: the absence of an adequate legal framework breached Article 8 ECHR; the Data Protection Impact Assessment failed to properly address privacy implications; and the force had not complied with the public sector equality duty. Although the case concerned police surveillance technology rather than individual recording rights, it demonstrates the courts' willingness to scrutinise public-space surveillance programmes robustly.

The Voyeurism (Offences) Act 2019 and Image-Based Abuse

The Voyeurism (Offences) Act 2019 amended the Sexual Offences Act 2003 to create a specific upskirting offence. Under section 67A of the 2003 Act (as inserted), which applies in England and Wales, it is a criminal offence to operate equipment or record an image beneath another person's clothing for the purpose of obtaining sexual gratification or causing humiliation, alarm, or distress to the victim.

Maximum penalty: 2 years imprisonment. Scotland (Sexual Offences (Scotland) Act 2009, section 9) and Northern Ireland (Sexual Offences (Northern Ireland) Order 2008, article 71A) have their own upskirting offences. The most serious cases may result in the offender being placed on the sex offenders register.

The offence exists alongside section 67 of the Sexual Offences Act 2003, which covers voyeuristic recording more broadly (filming private acts for sexual gratification) and, in section 67(4), installing equipment or adapting a structure to enable voyeurism.

Police, Crime, Sentencing and Courts Act 2022: Non-Consensual Breastfeeding Photography

The Police, Crime, Sentencing and Courts Act 2022 extended the voyeurism provisions in England and Wales (section 67A of the 2003 Act) to cover recording a person who is breastfeeding without their consent for the purpose of sexual gratification or causing humiliation, distress, or alarm. Maximum penalty: 2 years imprisonment.

Civil Tort: Misuse of Private Information

Even where no criminal offence is made out, recording someone in a context where they had a reasonable expectation of privacy can give rise to civil liability for misuse of private information, a tort developed by English courts under the influence of Article 8 ECHR. Damages are available; courts have awarded substantial sums in cases involving covert intimate recording.

The Online Safety Act 2023: Platform Duties and NCII

The Online Safety Act 2023 is primarily a platform regulatory statute. Its relevance to recording law is through new criminal offences and the priority offence regime.

The OSA created two offences in the Sexual Offences Act 2003, both applying in England and Wales only:

• Cyberflashing (section 66A): Sending an image of genitals without consent for the purpose of sexual gratification or causing humiliation, alarm, or distress. The first conviction under this provision occurred in March 2024.
• Sharing intimate images without consent (section 66B): Sharing a real or AI-generated intimate image of another person without consent. No requirement to prove intent to cause harm; the sharing itself is the offence.

Platforms that fail to remove non-consensual intimate imagery face fines of up to £18 million or 10% of global qualifying revenue under Ofcom's enforcement powers. Illegal content duties came into force on 17 March 2025. On 8 January 2026, the Online Safety Act 2023 (Priority Offences) (Amendment) Regulations 2025 came into force, formally designating cyberflashing (and encouraging or assisting serious self-harm) as priority offences requiring proactive platform action. Intimate image sharing (section 66B) was already a priority offence.

AI, Deepfakes, and the Data (Use and Access) Act 2025

The Data (Use and Access) Act 2025 (DUAA) is the most significant recent development in UK recording-adjacent law. Section 138 inserts new sections 66E-H into the Sexual Offences Act 2003, creating criminal offences in England and Wales specifically targeting the creation of intimate deepfakes.

What Is Now Criminalised

From 6 February 2026, it is a criminal offence to intentionally:

• Create, or request the creation of, a "purported intimate image" of an identifiable adult without their consent or a reasonable belief in consent.
• A purported intimate image is an image that appears to be a photo or film of the person in an intimate state but is not, or is not only, a genuine photo or film of them, such as a digitally altered or AI-generated image.

Importantly, the offence does not require intent to share the image. Creating a deepfake for private use is already criminalised. If the deepfake is subsequently shared, the perpetrator may also face the separate section 66B sharing offence under the OSA 2023.

Crime and Policing Act 2026: Nudification Apps

The Crime and Policing Act 2026 made it an offence in England and Wales, from 29 June 2026, to make, adapt, supply or offer to supply a tool for creating purported intimate images, such as a nudification app (Sexual Offences Act 2003, section 66I).

The Combined Effect of OSA 2023 and DUAA 2025

Sharing AI-generated intimate images has been illegal under the OSA 2023 since 31 January 2024. The DUAA 2025 closes the creation gap. Together the two statutes mean that both creating and sharing non-consensual intimate deepfakes are criminal in England and Wales. Scotland has its own offence of disclosing, or threatening to disclose, an intimate photograph or film with intent to cause fear, alarm or distress (or recklessness as to that), which covers altered versions of a real photograph or film but not an image generated entirely by AI (Abusive Behaviour and Sexual Harm (Scotland) Act 2016, sections 2 and 3). Northern Ireland has an offence of disclosing private sexual photographs and films with intent to cause distress (Justice Act (Northern Ireland) 2016, section 51), extended to threats by the Justice (Sexual Offences and Trafficking Victims) Act (Northern Ireland) 2022.

Scotland: The RIP(S)A Framework

The Regulation of Investigatory Powers (Scotland) Act 2000 provides a distinct framework for directed and intrusive surveillance and covert human intelligence sources. Its authorisations are not a general licence for private people to record conversations.

RIPA section 46 preserves specified UK-wide authorisation grounds and authorities in Scotland. Identifying the activity, authority and statutory ground matters more than treating the two Acts as interchangeable personal-recording rules.

Cross-Border Recordings: UK to US and EU

Recording laws vary by jurisdiction, and a UK caller recording a cross-border call must consider the law of the other jurisdiction.

UK Calling a US Number

The United States has both federal wiretapping law (18 U.S.C. § 2511, which permits one-party consent recording at the federal level) and state wiretapping statutes. About a dozen US states require the consent of all parties to record a call, including California, Florida, Pennsylvania, and Washington. If a UK-based caller records a call with a person in California, they should obtain consent from the California party because California Penal Code § 632 applies to the party in California.

The safest approach for any cross-border business call recording programme is to apply the strictest applicable consent law to all calls, regardless of where the recording party is located.

UK Calling EU Numbers

EU member states implement the e-Privacy Directive alongside EU GDPR. Many EU jurisdictions require that all parties be informed before a call is recorded. Germany, for example, requires all-party consent in most contexts. The UK's post-Brexit UK GDPR is functionally equivalent to EU GDPR for most recording-related purposes, but businesses transferring recorded personal data from EU countries to UK-based systems must comply with GDPR Chapter V transfer rules. The European Commission renewed its UK adequacy decisions on 19 December 2025; they run until 27 December 2031.

Notable Enforcement Cases

News of the World Phone Hacking Scandal

The most significant UK case of illegal recording involved systematic interception of voicemail messages by staff at the News of the World between 2001 and 2011:

• Clive Goodman and Glenn Mulcaire were convicted under RIPA in January 2007 for intercepting royal household voicemails.
• Andy Coulson (former editor) was convicted of conspiracy to intercept communications in 2014 and sentenced to 18 months.
• The newspaper closed in July 2011 after 168 years of publication.
• News Corporation paid over £400 million in civil settlements to victims.
• The Leveson Inquiry produced wide-ranging recommendations on press ethics.

The scandal demonstrates that illegal interception of communications, including voicemail interception, is treated as serious criminality in the UK.

Bridges v South Wales Police (2020)

As noted above, the Court of Appeal held the police use of live automated facial recognition in public to be unlawful on three grounds: breach of Article 8 ECHR, failure to conduct a proper DPIA under the DPA 2018, and failure to comply with the public sector equality duty. The decision has shaped subsequent police AFR deployment policy.

CCTV and Surveillance Cameras

The UK has one of the highest concentrations of CCTV cameras in the world, estimated at between four and six million cameras. The regulatory framework is set by the Protection of Freedoms Act 2012, which created the Surveillance Camera Commissioner and the Surveillance Camera Code of Practice.

Who Must Follow the Code

In England and Wales, the following bodies are required to have regard to the Surveillance Camera Code (Protection of Freedoms Act 2012, section 33(5)):

• Chief officers of police, Police and Crime Commissioners and the Mayor's Office for Policing and Crime.
• Local authorities, including the Greater London Authority, the City of London and parish meetings.
• Any other body the Home Secretary adds by order.

Other operators, including other public bodies and private businesses, may adopt the code voluntarily.

Domestic CCTV

Private homeowners operating cameras that capture images beyond their own property may be subject to UK GDPR. The ICO advises that domestic cameras should ideally cover only the homeowner's own property. Where cameras capture a neighbour's garden, driveway, or a public footpath, data protection obligations may apply, including the obligation to respond to subject access requests within one month.

ICO Video Surveillance Guidance (2023 Update)

The ICO updated its video surveillance guidance in 2023, emphasising that audio recording alongside CCTV video is "highly intrusive" and will require substantially greater justification than video-only surveillance. Organisations should switch off audio capture capability by default and enable it only in exceptional circumstances through a deliberate trigger.

Updates Log

Related UK Recording Guides

• Recording Phone Calls in the UK
• Recording in the UK Workplace
• Filming the Police in Public
• Home CCTV and Video Doorbells
• Covert Recordings as Evidence

This guide is part of our United Kingdom law guides.

Frequently Asked Questions

Is it legal to record a phone call in the UK without telling the other person?

The answer depends on the recording method and circumstances. IPA 2016 section 4 defines telecommunications interception; former RIPA section 1 is not a current blanket personal-use permission. See the linked UK phone-call guide for the practical recording questions.

Can I record a conversation with my employer at work?

A workplace recording needs separate analysis of the recording method, monitoring arrangements and proposed use. RIPA authorisations are not a general personal-use licence. The linked UK workplace and evidence guides address those distinct questions.

What is the penalty for illegally intercepting someone else's communications?

Under the Investigatory Powers Act 2016, unlawful interception carries a maximum of two years imprisonment and/or an unlimited fine on indictment. Civil claims and ICO enforcement action can arise in addition to criminal proceedings.

Do businesses need to tell customers they are recording calls?

The ICO guidance says organisations monitoring calls must tell affected callers that calls are recorded and why. A recorded message is good practice, with further privacy information supplied by another appropriate route. That guidance does not establish that one announcement satisfies every interception or data-protection condition.

Can I film police officers in the UK?

Yes, generally. There is no specific UK law prohibiting filming police officers performing their duties in a public place. The Metropolitan Police confirms that members of the public do not need a permit to film in public places. You must not obstruct officers in the execution of their duties, or elicit or publish information about officers of a kind likely to be useful to a terrorist.

Is it legal to share an intimate image of someone without their consent?

No. In England and Wales, sharing intimate images without consent is a criminal offence under the Sexual Offences Act 2003 (as amended by the Online Safety Act 2023), whether the image is real or AI-generated. Scotland and Northern Ireland have their own disclosure offences, which are narrower for altered or AI-generated images. In England and Wales, from 6 February 2026, creating (not just sharing) a non-consensual intimate deepfake is also a criminal offence under the Data (Use and Access) Act 2025, section 138.

Can covert recordings be used in family court proceedings?

Possibly, at the court's discretion. The Family Justice Council's May 2025 guidance states that courts may admit covert recordings if they have significant evidential weight and admitting them serves the interests of justice. However, parties must disclose recordings to the court early, provide unedited copies, and cannot share them with third parties without court permission. Recording children is strongly discouraged.

What laws apply if I record a call between the UK and the United States?

Start by identifying the locations and the recording method. IPA section 4 supplies the UK telecommunications definition; the linked US recording guides provide the separate federal and state context. A general one-party label does not decide a particular cross-border recording.

Does Scotland have different recording laws from England and Wales?

Scotland has RIP(S)A for specified covert-surveillance and human-source authorisations, alongside the UK-wide grounds preserved by RIPA section 46. Neither framework is a general private-recording licence. The relevant activity, authority and jurisdiction need to be identified.

What changed in UK deepfake law in 2025 and 2026?

Significant changes occurred in rapid succession in England and Wales. The Online Safety Act 2023 made sharing non-consensual intimate images (including deepfakes) illegal from 31 January 2024. The Data (Use and Access) Act 2025, section 138, which came into force on 6 February 2026, extended liability to creating or requesting the creation of a non-consensual intimate deepfake, even without intending to share it. The Crime and Policing Act 2026 also made it an offence, from 29 June 2026, to make or supply tools for generating such images, such as nudification apps.