UK Recording Laws: Consent, RIPA, UK GDPR, and 2025 Updates

Quick Answer: One-Party Consent in the UK

Yes, recording a conversation in the UK is generally legal if you are a participant. Under the Regulation of Investigatory Powers Act 2000 (RIPA), a person may record their own communications without informing any other party, provided the recording is retained for personal use.

Scenario	Legal Status	Key Law
Recording your own phone call, personal use	Legal, no consent needed	RIPA 2000 s.1(1)
Sharing that recording with a third party	Requires consent	Telecoms LBP Regs 2000
Business call recording (quality / compliance)	Legal with UK GDPR lawful basis	DPA 2018 + LBP Regs
Intercepting someone else's communication	Criminal offence	IPA 2016 s.3
Filming police in a public place	Generally legal	Article 10 ECHR; Met guidance
Upskirting or voyeuristic recording	Criminal offence (up to 2 years)	Voyeurism (Offences) Act 2019
Creating non-consensual intimate deepfakes	Criminal offence (from Feb 2026)	Data (Use and Access) Act 2025 s.138

The UK is often described as a "one-party consent" jurisdiction, but that shorthand misses important layers. RIPA permits the recording; UK GDPR governs what happens to the data afterwards; and the Online Safety Act 2023, together with the Data (Use and Access) Act 2025, added a rapidly expanding criminal regime around intimate and AI-generated imagery.

The RIPA 2000 Framework: What It Actually Says

The Regulation of Investigatory Powers Act 2000 is the foundation of private recording law in the UK. Section 1(1) makes it a criminal offence to intentionally and unlawfully intercept a communication in the course of its transmission through a public or private telecommunications system.

The critical carve-out is in section 1(6) and the Telecommunications (Lawful Business Practice) Regulations 2000: interception is lawful when the person conducting it is a party to the communication and is recording solely for their own use.

The Distinction RIPA Draws

RIPA draws a bright line between two acts:

• Recording your own conversation: Legal without consent from other parties.
• Making that recording available to a third party not on the call: This crosses into the prohibited territory of interception unless you have obtained consent.

The Telecoms LBP Regulations confirm the prohibition is triggered when content is made available to someone who was neither the sender, the caller, nor the intended recipient of the original communication.

What RIPA Does Not Cover

RIPA primarily governs electronic interception (phone calls, email, messaging systems). It does not directly govern recording an in-person conversation through a physical recording device, though such recordings may raise issues under data protection law and the tort of misuse of private information.

The Investigatory Powers Act 2016 and Its 2024 Amendment

The Investigatory Powers Act 2016 (IPA 2016) replaced and consolidated much of the UK's surveillance framework, including key interception provisions formerly in RIPA. For private individuals, the practical effect is the same: intercepting communications you are not party to is a serious criminal offence.

What the IPA 2016 Criminalises

Under IPA 2016 section 3, it is an offence to intercept a communication without lawful authority. The Act covers:

• Modifying or interfering with a telecommunication system to obtain content.
• Monitoring transmissions on a system, including wireless telegraphy.
• Making the content of a transmission available to someone who was not the sender or intended recipient.

Telecommunication systems include phone networks, the internet, email, and encrypted messaging platforms.

The Investigatory Powers (Amendment) Act 2024

The Investigatory Powers (Amendment) Act 2024 amended the IPA 2016 primarily in relation to state surveillance powers. It revised the "double-lock" warrant approval mechanism so that the Secretary of State no longer requires independent judicial commissioner approval before interception warrants come into force. This attracted significant criticism from civil liberties groups. For private individuals, the criminal prohibition on unlawful interception is unchanged.

Penalties Under IPA 2016

Conviction Route	Jurisdiction	Maximum Penalty
Summary conviction	England and Wales	Unlimited fine
Summary conviction	Scotland / Northern Ireland	Fine up to statutory maximum
Conviction on indictment	All UK jurisdictions	Up to 2 years imprisonment and/or fine

Civil liability and regulatory action by the Information Commissioner's Office (ICO) can arise separately from criminal proceedings.

UK GDPR and the Data Protection Act 2018

Recording a conversation is only the first step. Once a recording captures identifiable information about another person, it becomes personal data under the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018. This overlay applies to organisations and individuals alike, with one important exception: purely personal or household activity is exempt.

The Household Exemption

Individuals recording for purely personal or household purposes are exempt from most UK GDPR obligations (Article 2(2)(c) UK GDPR). If you record a call with your bank for your own notes, you are not processing personal data in a regulated sense. The exemption disappears the moment you share, publish, or use the recording commercially.

Lawful Basis for Organisations

Any organisation recording calls or conversations must identify and document a lawful basis under Article 6 UK GDPR before processing begins. The most commonly relied-upon bases are:

• Legitimate interests (Article 6(1)(f)): The most widely used basis for business call recording. Requires a documented Legitimate Interest Assessment (LIA) demonstrating that the business interest is not overridden by the data subject's rights. The ICO's January 2026 guidance update requires this assessment to be formal and on file.
• Legal obligation (Article 6(1)(c)): Applies where recording is mandated by sector regulation, such as FCA rules for financial services firms.
• Contract (Article 6(1)(b)): Where recording is necessary to perform or verify a contract with the individual.
• Consent (Article 6(1)(a)): Valid in principle but rarely the right basis for employment contexts; must be freely given, specific, informed, and unambiguous.

ICO Guidance on Employee Monitoring (2025-2026)

The ICO updated its employee monitoring guidance in 2025-2026. Key requirements:

• Monitoring must be justified by a clear, documented business need.
• Workers must generally be informed that monitoring may occur, via a privacy notice.
• Covert monitoring is only permissible in exceptional circumstances such as investigating suspected criminal activity, and only after less intrusive methods have been considered.
• Data Protection Impact Assessments (DPIAs) are required for any systematic or large-scale monitoring programme.
• Organisations using AI-assisted call analysis must explicitly disclose this in their privacy notices (January 2026 ICO requirement).
• Recordings must be subject to defined retention policies and automatically deleted at the end of the retention period.

Workplace Call Recording: The Telecoms LBP Regulations 2000

The Telecommunications (Lawful Business Practice) (Interception of Communications) Regulations 2000 (the LBP Regulations) create a distinct carve-out from RIPA's interception prohibition. They permit a business to intercept communications on its own telecommunications system without the consent of the parties, provided specific conditions are met.

Permitted Purposes

The LBP Regulations authorise interception solely for the following purposes:

• Establishing facts: Recording to evidence that a business transaction or instruction took place.
• Regulatory compliance: Demonstrating compliance with regulatory or self-regulatory standards (such as FCA requirements for financial firms or MiFID II obligations).
• Quality assurance and training: Monitoring or recording to maintain standards of service.
• National security: Where applicable to authorised bodies.
• Crime prevention: Detecting criminal use of the system or unauthorised access.
• System operation: Ensuring the effective and secure operation of the telecommunications system.

The Notification Requirement

The LBP Regulations require the system controller to have "made all reasonable efforts to inform every person who may use the telecommunication system in question that communications transmitted by means thereof may be intercepted." For employees, this is typically accomplished through:

• An employment contract clause or staff handbook provision.
• A recorded announcement at the start of external calls (for example, "This call may be recorded for training and quality purposes").
• A privacy notice under UK GDPR disclosing call recording practices.

Interaction With UK GDPR

The LBP Regulations govern whether recording is permitted; UK GDPR governs how the recorded data must be handled. A business that satisfies the LBP Regulations but fails to maintain a lawful basis under UK GDPR or fails to respond to subject access requests will still face ICO enforcement.

Key Employment Tribunal Decisions

Employment tribunals have consistently held that covert recordings made by employees are not automatically inadmissible:

• Punjab National Bank v Gosain [2014] UKEAT: A covert recording of a disciplinary meeting was admitted. The EAT confirmed inadmissibility is not automatic, but noted the recording itself could justify disciplinary action.
• Phoenix House Ltd v Stockman [2017] UKEAT: Covert recordings can be admitted, but making them might affect compensation awards or the employee's credibility.
• Dogherty v Capita Business Services [2012] ET: A covert recording of a grievance appeal was admitted; the tribunal balanced the breach of trust against the probative value of the evidence.

Employees should be aware that making a covert workplace recording may constitute gross misconduct under some employers' policies, even where the content later supports their case.

Recording Phone Calls in the UK

For private individuals, recording a telephone call you are a party to is legal under RIPA 2000. There is no requirement to inform the other party.

What Personal Use Means

Personal use includes:

• Keeping a record of an important conversation with a lender, insurer, or service provider.
• Documenting a dispute or disagreement for your own reference.
• Preserving evidence you may need in potential legal proceedings.
• Making notes from a conversation you cannot write down in real time.

Personal use does not include posting the recording on social media, selling it, broadcasting it, or sharing it with anyone who was not a party to the call. Each of those acts moves the recording outside the personal-use exemption and may constitute unlawful interception or a breach of data protection law.

Admissibility in Legal Proceedings

A covert recording you have made of your own conversation is generally admissible in civil and criminal proceedings, but admission is not guaranteed. Courts apply a balancing test:

• Civil proceedings: Under the Civil Procedure Rules, courts have discretion to admit or exclude evidence, weighing relevance, authenticity, and fairness.
• Family court: The Family Justice Council published comprehensive guidance in May 2025 on covert recordings in family proceedings. Courts may admit recordings with significant evidential weight. Recording children is strongly discouraged. Parties must disclose recordings early, produce unedited versions, and cannot share recordings with third parties without court permission.
• Criminal proceedings: Courts may exclude evidence obtained unlawfully under section 78 of the Police and Criminal Evidence Act 1984 (PACE) if admitting it would adversely affect the fairness of proceedings.

Recording In-Person Conversations

In-person audio recording sits in a slightly different position to telephone recording because there is no "telecommunication system" involved and RIPA's specific carve-out does not apply directly. The general position is comparable: if you are present in a conversation, recording it for personal use is not a criminal offence in England and Wales under any currently enacted statute.

Potential issues arise under:

• Privacy law and the tort of misuse of private information: If you record someone in a context where they had a reasonable expectation of privacy (for example, in their home or a private medical consultation), you may face civil liability even if no criminal offence is committed.
• Harassment: Persistent, systematic covert recording of a particular person could constitute a course of conduct amounting to harassment under the Protection from Harassment Act 1997.
• Data protection: If you process the recording in a way that goes beyond personal household use, UK GDPR applies.

Recording the Police

You have the right to film and record police officers carrying out their duties in a public place. There is no specific criminal offence of filming a police officer in the UK.

The Metropolitan Police states explicitly in its public guidance that members of the public and the press do not need a permit to film or photograph in public places, and police have no power to stop them filming police personnel. This reflects the right to receive and impart information under Article 10 of the European Convention on Human Rights, as incorporated into UK law by the Human Rights Act 1998.

What Police Cannot Do

Police officers cannot:

• Require you to stop filming without a specific legal power.
• Demand you delete footage from your phone without a court order or warrant.
• Seize your device purely because you filmed them.

What You Must Not Do

• Obstruct a police officer in the execution of duties (Police Act 1996 s.89).
• Film in a way that is likely to be useful to a person planning a terrorist act (Counter-Terrorism Act 2008 s.76; this requires the terrorist-assistance nexus, not mere filming of police activity).
• Film in premises where filming is restricted by a court order or security designation.

Bridges v South Wales Police [2020] EWCA Civ 1058

In August 2020, the Court of Appeal held that South Wales Police's use of live automated facial recognition technology was unlawful. The court found three grounds: the absence of an adequate legal framework breached Article 8 ECHR; the Data Protection Impact Assessment failed to properly address privacy implications; and the force had not complied with the public sector equality duty. Although the case concerned police surveillance technology rather than individual recording rights, it demonstrates the courts' willingness to scrutinise public-space surveillance programmes robustly.

The Voyeurism (Offences) Act 2019 and Image-Based Abuse

The Voyeurism (Offences) Act 2019 amended the Sexual Offences Act 2003 to create a specific upskirting offence. Under section 67A of the 2003 Act (as inserted), it is a criminal offence to operate equipment or record an image beneath another person's clothing for the purpose of obtaining sexual gratification or causing humiliation, alarm, or distress to the victim.

Maximum penalty: 2 years imprisonment. The most serious cases may result in the offender being placed on the sex offenders register.

The offence exists alongside section 67 of the Sexual Offences Act 2003, which covers voyeuristic recording more broadly (filming private acts for sexual gratification), and the Protection of Freedoms Act 2012 offence of installing equipment to observe or record private acts.

Domestic Abuse Act 2021: Non-Consensual Breastfeeding Photography

The Domestic Abuse Act 2021 extended voyeurism provisions to cover recording a person who is breastfeeding without their consent for the purpose of sexual gratification or causing humiliation, distress, or alarm. Maximum penalty: 2 years imprisonment.

Civil Tort: Misuse of Private Information

Even where no criminal offence is made out, recording someone in a context where they had a reasonable expectation of privacy can give rise to civil liability for misuse of private information, a tort developed by English courts under the influence of Article 8 ECHR. Damages are available; courts have awarded substantial sums in cases involving covert intimate recording.

The Online Safety Act 2023: Platform Duties and NCII

The Online Safety Act 2023 is primarily a platform regulatory statute. Its relevance to recording law is through new criminal offences and the priority offence regime.

The OSA created two offences in the Sexual Offences Act 2003:

• Cyberflashing (section 66A): Sending an image of genitals without consent for the purpose of sexual gratification or causing humiliation, alarm, or distress. The first conviction under this provision occurred in March 2024.
• Sharing intimate images without consent (section 66B): Sharing a real or AI-generated intimate image of an identifiable adult without consent. No requirement to prove intent to cause harm; the sharing itself is the offence.

Platforms that fail to remove non-consensual intimate imagery face fines of up to £18 million or 10% of global qualifying revenue under Ofcom's enforcement powers. Illegal content duties came into force on 17 March 2025. On 8 January 2026, the Online Safety Act 2023 (Priority Offences) (Amendment) Regulations 2025 came into force, formally designating cyberflashing and intimate image sharing as priority offences requiring proactive platform action.

AI, Deepfakes, and the Data (Use and Access) Act 2025

The Data (Use and Access) Act 2025 (DUAA) is the most significant recent development in UK recording-adjacent law. Section 138 inserts new sections 66E-H into the Sexual Offences Act 2003, creating criminal offences specifically targeting the creation of intimate deepfakes.

What Is Now Criminalised

From 6 February 2026, it is a criminal offence to intentionally:

• Create, or request the creation of, a "purported intimate image" of an identifiable adult without their consent or a reasonable belief in consent.
• A purported intimate image is any image that appears to show the person nude, partially nude, or engaged in a sexual act, whether the image is real, digitally altered, or entirely AI-generated.

Importantly, the offence does not require intent to share the image. Creating a deepfake for private use is already criminalised. If the deepfake is subsequently shared, the perpetrator may also face the separate section 66B sharing offence under the OSA 2023.

Crime and Policing Bill: Nudification Apps

The UK Government announced its intention to criminalise the supply of nudification tools (apps designed to generate non-consensual intimate images) through the Crime and Policing Bill, which was progressing through Parliament as of early 2026. Companies supplying such tools would face criminal liability.

The Combined Effect of OSA 2023 and DUAA 2025

Sharing AI-generated intimate images has been illegal under the OSA 2023 since 31 January 2024. The DUAA 2025 closes the creation gap. Together the two statutes mean that both creating and sharing non-consensual intimate deepfakes are criminal in the UK.

Scotland: The RIP(S)A Framework

Scotland has its own statutory regime: the Regulation of Investigatory Powers (Scotland) Act 2000 (RIP(S)A). The general principles broadly mirror RIPA:

• Individuals may record their own communications for personal use.
• Interception of others' communications without authority is prohibited.

Key differences include separate oversight by Scottish Ministers and different judicial authorisation processes for local authority surveillance. Scottish courts apply Scottish evidence law when considering admissibility of recordings in Scottish proceedings. Practitioners should seek Scotland-specific legal advice when dealing with recordings in those contexts.

Cross-Border Recordings: UK to US and EU

Recording laws vary by jurisdiction, and a UK caller recording a cross-border call must consider the law of the other jurisdiction.

UK Calling a US Number

The United States has both federal wiretapping law (18 U.S.C. § 2511, which permits one-party consent recording at the federal level) and state wiretapping statutes. Approximately 13 US states require the consent of all parties to a call, including California, Florida, Pennsylvania, and Washington. If a UK-based caller records a call with a person in California, they should obtain consent from the California party because California Penal Code § 632 applies to the party in California.

The safest approach for any cross-border business call recording programme is to apply the strictest applicable consent law to all calls, regardless of where the recording party is located.

UK Calling EU Numbers

EU member states implement the e-Privacy Directive alongside EU GDPR. Many EU jurisdictions require that all parties be informed before a call is recorded. Germany, for example, requires all-party consent in most contexts. The UK's post-Brexit UK GDPR is functionally equivalent to EU GDPR for most recording-related purposes, but businesses transferring recorded personal data from EU countries to UK-based systems must comply with GDPR Chapter V transfer rules. The EU adequacy decision for UK data transfers was extended to 2027.

Notable Enforcement Cases

News of the World Phone Hacking Scandal

The most significant UK case of illegal recording involved systematic interception of voicemail messages by staff at the News of the World between 2001 and 2011:

• Clive Goodman and Glenn Mulcaire were convicted under RIPA in January 2007 for intercepting royal household voicemails.
• Andy Coulson (former editor) was convicted of conspiracy to intercept communications in 2014 and sentenced to 18 months.
• The newspaper closed in July 2011 after 168 years of publication.
• News Corporation paid over £400 million in civil settlements to victims.
• The Leveson Inquiry produced wide-ranging recommendations on press ethics.

The scandal demonstrates that illegal interception of communications, including voicemail interception, is treated as serious criminality in the UK.

ICO Enforcement: Key Examples

• 2019: A care home fined for using CCTV in residents' bedrooms without a proper lawful basis.
• 2020: An employer reprimanded for covert monitoring of employee emails without adequate justification.
• 2023: A private landlord received an enforcement notice for CCTV covering neighbouring properties without a lawful basis or privacy notice.
• 2024: ICO issued enforcement notices to two organisations for deploying AI-powered call analysis without adequate disclosure to data subjects.

Bridges v South Wales Police (2020)

As noted above, the Court of Appeal held the police use of live automated facial recognition in public to be unlawful on three grounds: breach of Article 8 ECHR, failure to conduct a proper DPIA under the DPA 2018, and failure to comply with the public sector equality duty. The decision has shaped subsequent police AFR deployment policy.

CCTV and Surveillance Cameras

The UK has one of the highest concentrations of CCTV cameras in the world, estimated at between four and six million cameras. The regulatory framework is set by the Protection of Freedoms Act 2012, which created the Surveillance Camera Commissioner and the Surveillance Camera Code of Practice.

Who Must Follow the Code

The following bodies are required to have regard to the Surveillance Camera Code:

• Police forces and Police and Crime Commissioners.
• Local authorities and fire and rescue services.
• NHS trusts and foundation trusts.
• Public transport providers and other public authorities operating surveillance systems.

Domestic CCTV

Private homeowners operating cameras that capture images beyond their own property may be subject to UK GDPR. The ICO advises that domestic cameras should ideally cover only the homeowner's own property. Where cameras capture a neighbour's garden, driveway, or a public footpath, data protection obligations may apply, including the obligation to respond to subject access requests within one month.

ICO Video Surveillance Guidance (2023 Update)

The ICO updated its video surveillance guidance in 2023, emphasising that audio recording alongside CCTV video is "highly intrusive" and will require substantially greater justification than video-only surveillance. Organisations should switch off audio capture capability by default and enable it only in exceptional circumstances through a deliberate trigger.

Updates Log

Date	Change
2026-05-15	Full refresh: added Investigatory Powers (Amendment) Act 2024; Data (Use and Access) Act 2025 deepfake offences (in force 6 Feb 2026); Online Safety Act 2023 priority offences (in force 8 Jan 2026); Family Justice Council covert recording guidance (May 2025); ICO January 2026 LIA and AI disclosure requirements; Bridges v South Wales Police 2020; updated cross-border US/EU section; Scotland RIP(S)A section added; rebuilt FAQ and SourcesList. Word count expanded from 3,532 to approximately 6,200.
2026-03-28	Minor edits; Investigatory Powers (Amendment) Act 2024 noted.
2021-11-01	Original publication.