Call recording: what the law asks at each location

What it watches

the audio of calls

Family

Audio

Reads as this class

for example "call recording" in a practice column

• Representative stepstatutory requirementInform and consult the CSE before deciding to put the means of control in place, while the consultation can still change the decision (undertakings of 50 or more employees). (where a CSE exists) Code du travail L2312-38 al3Code du travail L2312-8 II 4Code du travail L2312-14CNIL guidance ACT-6
• Representative stepverification requiredThe CNIL adds, for calls: inform and consult the representative bodies before installing listening or recording. (where a CSE exists) CNIL guidance CALL-6 official guidance, not law
• Noticestatutory requirementThe Art. 13 information at the time the data is collected: who, why, on which basis, the legitimate interest where that is the basis, recipients, retention, rights. GDPR Art. 13WP249 para 3.1.2
• Noticestatutory requirementNo information about an employee may be collected by a device not first brought to the employee's knowledge. Code du travail L1222-4CNIL guidance ACT-7
• Recording consentverification requiredOccasional listening or recording for training, evaluation or service quality, never permanent or systematic unless a law requires it; callers told at the start of the call and able to object. CNIL guidance CALL-1CNIL guidance CALL-2CNIL guidance CALL-6 official guidance, not law
• Places kept privateofficial guidance, not law guidance says noLimits by place: never in sensitive areas such as places of worship, sanitary facilities and break rooms. (where it covers toilets or washrooms, showers or bathing areas, change or locker rooms, break rooms or staff lounges and prayer rooms) WP249 para 3.1.1(d) official guidance, not law
• Personal devicesofficial guidance, not lawTell private from business use so private information is not monitored; the employer's ownership of a device does not remove the secrecy of communications. (if personal devices are monitored) WP249 para 5.4.2(a)WP249 para 6.1 official guidance, not law
• Lawful basisstatutory requirementAn Art. 6 basis for each purpose; Art. 88 lets national law or collective agreements set more specific employment rules, and is not a basis itself. Consent is rarely free at work; legitimate interest needs a necessary, least intrusive method and a documented balance. GDPR Art. 6GDPR Art. 88WP249 para 3.1.1(a)WP249 para 3.1.1(c)
• Lawful basisstatutory requirementEvery restriction on employees' rights justified by the task and proportionate to the aim. Code du travail L1121-1
• Retentionstatutory requirementKept no longer than the purpose needs, with a set retention period, and deleted once no longer needed. GDPR Art. 5WP249 para 3.1(d)
• Retentionverification requiredRecordings kept up to six months, analysis documents up to a year. CNIL guidance CALL-5 official guidance, not law
• Retentionofficial guidance, not lawKept only as long as the purpose justifies. ILO code para 8.5 official guidance, not law

• Representative stepstatutory requirementA works agreement (or a conciliation committee award) before the practice starts, changes or is extended. The test is whether the device can monitor conduct or performance, not what it was bought for; a company-wide system goes to the central works council. (where a works council exists) BetrVG s 87(1) no. 6BetrVG s 80(2)BetrVG s 77(1), (2)BDSG s 26(4)
• Noticestatutory requirementThe Art. 13 information at the time the data is collected: who, why, on which basis, the legitimate interest where that is the basis, recipients, retention, rights. GDPR Art. 13WP249 para 3.1.2
• Recording consentstatutory requirementNo recording of another person's non-public spoken words on a sound carrier, and no listening in with a device to words not meant for the listener, without the authorisation of every participant; a recording of doubtful origin is neither used nor passed on. A criminal provision, read beside the works agreement and BDSG s 26 lines. StGB s 201(1)StGB s 201(2)
• Places kept privateofficial guidance, not law guidance says noLimits by place: never in sensitive areas such as places of worship, sanitary facilities and break rooms. (where it covers toilets or washrooms, showers or bathing areas, change or locker rooms, break rooms or staff lounges and prayer rooms) WP249 para 3.1.1(d) official guidance, not law
• Covert monitoringstatutory requirementTo uncover a crime: documented factual indications supporting a suspicion of an offence in the employment relationship, the processing necessary to uncover it, and not disproportionate to the occasion. BDSG s 26(1) sentence 2
• Personal devicesofficial guidance, not lawTell private from business use so private information is not monitored; the employer's ownership of a device does not remove the secrecy of communications. (if personal devices are monitored) WP249 para 5.4.2(a)WP249 para 6.1 official guidance, not law
• Lawful basisstatutory requirementAn Art. 6 basis for each purpose; Art. 88 lets national law or collective agreements set more specific employment rules, and is not a basis itself. Consent is rarely free at work; legitimate interest needs a necessary, least intrusive method and a documented balance. GDPR Art. 6GDPR Art. 88WP249 para 3.1.1(a)WP249 para 3.1.1(c)
• Lawful basisstatutory requirementEmployee data only where necessary for the employment relationship; consent only where genuinely voluntary, in writing or electronically, with notice of the right to withdraw. BDSG s 26(1) sentence 1BDSG s 26(2)
• Retentionstatutory requirementKept no longer than the purpose needs, with a set retention period, and deleted once no longer needed. GDPR Art. 5WP249 para 3.1(d)
• Retentionofficial guidance, not lawKept only as long as the purpose justifies. ILO code para 8.5 official guidance, not law

• Representative stepstatutory requirementEquipment that also allows remote monitoring of workers only for organisational and production needs, workplace safety or asset protection, and only after an agreement with the union representation or, failing one, prior authorisation from the labour inspectorate. Workers' Statute Art. 4(1)Italian Privacy Code Art. 114Italian Privacy Code Art. 171
• Noticestatutory requirementThe Art. 13 information at the time the data is collected: who, why, on which basis, the legitimate interest where that is the basis, recipients, retention, rights. GDPR Art. 13WP249 para 3.1.2
• Noticestatutory requirementAdequate information to workers on how the instruments are used and how checks are made, before the data is used for any employment purpose. Workers' Statute Art. 4(3)
• Places kept privateofficial guidance, not law guidance says noLimits by place: never in sensitive areas such as places of worship, sanitary facilities and break rooms. (where it covers toilets or washrooms, showers or bathing areas, change or locker rooms, break rooms or staff lounges and prayer rooms) WP249 para 3.1.1(d) official guidance, not law
• Personal devicesofficial guidance, not lawTell private from business use so private information is not monitored; the employer's ownership of a device does not remove the secrecy of communications. (if personal devices are monitored) WP249 para 5.4.2(a)WP249 para 6.1 official guidance, not law
• Lawful basisstatutory requirementAn Art. 6 basis for each purpose; Art. 88 lets national law or collective agreements set more specific employment rules, and is not a basis itself. Consent is rarely free at work; legitimate interest needs a necessary, least intrusive method and a documented balance. GDPR Art. 6GDPR Art. 88WP249 para 3.1.1(a)WP249 para 3.1.1(c)
• Retentionstatutory requirementKept no longer than the purpose needs, with a set retention period, and deleted once no longer needed. GDPR Art. 5WP249 para 3.1(d)
• Retentionofficial guidance, not lawKept only as long as the purpose justifies. ILO code para 8.5 official guidance, not law

• Representative stepstatutory requirementThe works council's consent to the arrangement before it is adopted: a proposal in writing with reasons and consequences, at least one consultation meeting, then written notice of the decision and its start date. Without consent or the cantonal court's permission the decision is void if the council invokes nullity. (where a works council exists) WOR Art. 27(1)(l)WOR Art. 27(2)WOR Art. 27(4)
• Noticestatutory requirementThe Art. 13 information at the time the data is collected: who, why, on which basis, the legitimate interest where that is the basis, recipients, retention, rights. GDPR Art. 13WP249 para 3.1.2
• Places kept privateofficial guidance, not law guidance says noLimits by place: never in sensitive areas such as places of worship, sanitary facilities and break rooms. (where it covers toilets or washrooms, showers or bathing areas, change or locker rooms, break rooms or staff lounges and prayer rooms) WP249 para 3.1.1(d) official guidance, not law
• Personal devicesofficial guidance, not lawTell private from business use so private information is not monitored; the employer's ownership of a device does not remove the secrecy of communications. (if personal devices are monitored) WP249 para 5.4.2(a)WP249 para 6.1 official guidance, not law
• Lawful basisstatutory requirementAn Art. 6 basis for each purpose; Art. 88 lets national law or collective agreements set more specific employment rules, and is not a basis itself. Consent is rarely free at work; legitimate interest needs a necessary, least intrusive method and a documented balance. GDPR Art. 6GDPR Art. 88WP249 para 3.1.1(a)WP249 para 3.1.1(c)
• Retentionstatutory requirementKept no longer than the purpose needs, with a set retention period, and deleted once no longer needed. GDPR Art. 5WP249 para 3.1(d)
• Retentionofficial guidance, not lawKept only as long as the purpose justifies. ILO code para 8.5 official guidance, not law

• Noticestatutory requirementThe Art. 13 information at the time the data is collected: who, why, on which basis, the legitimate interest where that is the basis, recipients, retention, rights. GDPR Art. 13WP249 para 3.1.2
• Places kept privatestatutory requirement not allowed hereNo sound recording or video surveillance in places for workers' rest or leisure, such as changing rooms, toilets and canteens. (where it covers toilets or washrooms, change or locker rooms, showers or bathing areas and break rooms or staff lounges) LOPDGDD Art. 89
• Places kept privateofficial guidance, not law guidance says noLimits by place: never in sensitive areas such as places of worship, sanitary facilities and break rooms. (where it covers toilets or washrooms, showers or bathing areas, change or locker rooms, break rooms or staff lounges and prayer rooms) WP249 para 3.1.1(d) official guidance, not law
• Personal devicesofficial guidance, not lawTell private from business use so private information is not monitored; the employer's ownership of a device does not remove the secrecy of communications. (if personal devices are monitored) WP249 para 5.4.2(a)WP249 para 6.1 official guidance, not law
• Lawful basisstatutory requirementAn Art. 6 basis for each purpose; Art. 88 lets national law or collective agreements set more specific employment rules, and is not a basis itself. Consent is rarely free at work; legitimate interest needs a necessary, least intrusive method and a documented balance. GDPR Art. 6GDPR Art. 88WP249 para 3.1.1(a)WP249 para 3.1.1(c)
• Retentionstatutory requirementKept no longer than the purpose needs, with a set retention period, and deleted once no longer needed. GDPR Art. 5WP249 para 3.1(d)
• Retentionofficial guidance, not lawKept only as long as the purpose justifies. ILO code para 8.5 official guidance, not law

• Noticestatutory requirementThe Art. 13 information at the time the data is collected: who, why, on which basis, the legitimate interest where that is the basis, recipients, retention, rights. GDPR Art. 13WP249 para 3.1.2
• Places kept privateofficial guidance, not law guidance says noLimits by place: never in sensitive areas such as places of worship, sanitary facilities and break rooms. (where it covers toilets or washrooms, showers or bathing areas, change or locker rooms, break rooms or staff lounges and prayer rooms) WP249 para 3.1.1(d) official guidance, not law
• Personal devicesofficial guidance, not lawTell private from business use so private information is not monitored; the employer's ownership of a device does not remove the secrecy of communications. (if personal devices are monitored) WP249 para 5.4.2(a)WP249 para 6.1 official guidance, not law
• Lawful basisstatutory requirementAn Art. 6 basis for each purpose; Art. 88 lets national law or collective agreements set more specific employment rules, and is not a basis itself. Consent is rarely free at work; legitimate interest needs a necessary, least intrusive method and a documented balance. GDPR Art. 6GDPR Art. 88WP249 para 3.1.1(a)WP249 para 3.1.1(c)
• Retentionstatutory requirementKept no longer than the purpose needs, with a set retention period, and deleted once no longer needed. GDPR Art. 5WP249 para 3.1(d)
• Retentionofficial guidance, not lawKept only as long as the purpose justifies. ILO code para 8.5 official guidance, not law

• Noticestatutory requirementThe Art. 13 information at collection, and tell workers about monitoring in an accessible way. UK GDPR Art. 13ICO monitoring guidance para 1.9
• Noticeofficial guidance, not lawTell callers the call is recorded and why. ICO monitoring guidance para 3.3(b) official guidance, not law
• Written policyofficial guidance, not lawMonitoring policies that set out the nature, purpose and extent of monitoring, brought to workers' attention and matching what happens. ICO monitoring guidance para 1.12(b) official guidance, not law
• Recording consentstatutory requirementInterception by or with the express consent of the system controller, for a listed purpose (such as standards achieved in the course of duties), and all reasonable efforts to tell every user of the system that calls may be intercepted. UK interception regulations reg 3(1)(a)UK interception regulations reg 3(2)(c)UK interception regulations reg 4(1)(c)ICO monitoring guidance para 3.3(a)
• Limitsofficial guidance, not lawContent only exceptionally, under a clear policy notified in advance; network data first. ICO monitoring guidance para 3.4(a)ICO monitoring guidance para 3.4(b)ICO monitoring guidance para 3.10 official guidance, not law
• Covert monitoringofficial guidance, not lawCovert monitoring only exceptionally, for suspected crime or gross misconduct, authorised by senior management after an assessment, tightly targeted and time-limited, never in toilets or changing rooms. ICO monitoring guidance para 1.19(a)ICO monitoring guidance para 1.19(b) Human Rights Act, Article 8, named, not quoted official guidance, not law
• Personal devicesofficial guidance, not lawWhen workers use their own devices, make sure private use is not captured. (if personal devices are monitored) ICO monitoring guidance para 3.11(c) Human Rights Act, Article 8, named, not quoted official guidance, not law
• Lawful basisstatutory requirementAn Art. 6 basis chosen for the specific purpose and documented from the start; consent rarely valid; legitimate interests with a recorded assessment. UK GDPR Art. 6ICO monitoring guidance para 1.4(a)ICO monitoring guidance para 1.4(b)ICO monitoring guidance para 1.4(d)
• Retentionstatutory requirementA retention schedule justified by business need, reviewed, and not kept in case a use turns up. UK GDPR Art. 5ICO monitoring guidance para 1.15
• Retentionofficial guidance, not lawKept only as long as the purpose justifies. ILO code para 8.5 official guidance, not law

• Noticestatutory requirementNotify individuals of the collection and the APP 5 matters. (when you say the Privacy Act applies) APP 5
• Recording consentstatutory requirementInterception of communications passing over a telecommunications system. Telecommunications (Interception and Access) Act 1979 (Cth), named, not quoted
• Retentionstatutory requirementDestroy or de-identify personal information no longer needed. (when you say the Privacy Act applies) APP 11
• Retentionofficial guidance, not lawKept only as long as the purpose justifies. ILO code para 8.5 official guidance, not law

• Noticestatutory requirementNotify individuals of the collection and the APP 5 matters. (when you say the Privacy Act applies) APP 5
• Recording consentstatutory requirementRecording a private conversation as a party needs every principal party's consent, or one party's where recording is reasonably necessary to protect that party's own interests; listening to a conversation you are not part of is not allowed. NSW SDA s 7(1)(a)NSW SDA s 7(1)(b) and (3)
• Recording consentstatutory requirementInterception of communications passing over a telecommunications system. Telecommunications (Interception and Access) Act 1979 (Cth), named, not quoted
• Places kept privatestatutory requirement not allowed hereNo surveillance of employees in a change room, toilet, shower or other bathing facility at a workplace. (where it covers toilets or washrooms, change or locker rooms and showers or bathing areas) NSW WSA s 15
• Covert monitoringstatutory requirementNo covert surveillance of employees at work without a covert surveillance authority from a Magistrate; surveillance without the notice Part 2 asks for is covert. NSW WSA s 19NSW WSA s 22
• Covert monitoringverification requiredNo communication, publication or possession of records obtained by a device used outside the conditions of the Act, save the exceptions the Act lists: to a party to the conversation or activity, with the consent of all principal parties, to investigate or prosecute an offence under the Act, and the minimum reasonably needed where serious violence, substantial property damage or a serious narcotics offence is imminent. NSW SDA s 11NSW SDA s 12NSW SDA s 14
• Outside workstatutory requirement not allowed hereNo surveillance with a work surveillance device while the employee is not at work, except computer surveillance of the use of equipment or resources the employer provided or paid for. (if it runs outside work) NSW WSA s 16
• Personal devicesstatutory requirementTracking a person, or monitoring a computer they own, needs their consent; the employer's own devices rest on its possession or control. (if personal devices are monitored) NSW SDA s 9NSW SDA s 10
• Retentionstatutory requirementDestroy or de-identify personal information no longer needed. (when you say the Privacy Act applies) APP 11
• Retentionofficial guidance, not lawKept only as long as the purpose justifies. ILO code para 8.5 official guidance, not law

• Noticestatutory requirementNotify individuals of the collection and the APP 5 matters. (when you say the Privacy Act applies) APP 5
• Recording consentstatutory requirementA listening device on a private conversation you are not part of needs every party's consent. Vic SDA s 6
• Recording consentstatutory requirementInterception of communications passing over a telecommunications system. Telecommunications (Interception and Access) Act 1979 (Cth), named, not quoted
• Places kept privatestatutory requirement not allowed hereNo camera or listening device in workplace toilets, washrooms, change rooms or lactation rooms, whether or not the workers consent. (where it covers toilets or washrooms, change or locker rooms, showers or bathing areas and lactation, nursing or parent rooms) Vic SDA s 9B
• Retentionstatutory requirementDestroy or de-identify personal information no longer needed. (when you say the Privacy Act applies) APP 11
• Retentionofficial guidance, not lawKept only as long as the purpose justifies. ILO code para 8.5 official guidance, not law

• Noticestatutory requirementNotify individuals of the collection and the APP 5 matters. (when you say the Privacy Act applies) APP 5
• Recording consentstatutory requirementInterception of communications passing over a telecommunications system. Telecommunications (Interception and Access) Act 1979 (Cth), named, not quoted
• Places kept privatestatutory requirement not allowed hereNo surveillance in a toilet, change room, shower or bathing facility, parent or nursing room, prayer room, sick bay or first-aid room. (where it covers toilets or washrooms, change or locker rooms, showers or bathing areas, lactation, nursing or parent rooms, prayer rooms and first-aid rooms or sick bays) ACT WPA s 41
• Covert monitoringstatutory requirementNo covert surveillance of a worker without a covert surveillance authority from the Magistrates Court. ACT WPA s 35
• Outside workstatutory requirement not allowed hereNo surveillance of a worker who is not in a workplace, except data surveillance of employer-supplied equipment and tracking that cannot be switched off. (if it runs outside work) ACT WPA s 42
• Retentionstatutory requirementDestroy or de-identify personal information no longer needed. (when you say the Privacy Act applies) APP 11
• Retentionofficial guidance, not lawKept only as long as the purpose justifies. ILO code para 8.5 official guidance, not law

• Noticestatutory requirementNotify individuals of the collection and the APP 5 matters. (when you say the Privacy Act applies) APP 5
• Recording consentstatutory requirementInterception of communications passing over a telecommunications system. Telecommunications (Interception and Access) Act 1979 (Cth), named, not quoted
• Recording consentstatutory requirementA listening device on a private conversation only as a party, or with the consent of one of the speakers; a party who records may publish the record only as s 45 allows. Qld IPA s 43(1)Qld IPA s 45(1)Qld IPA s 44(1)
• Retentionstatutory requirementDestroy or de-identify personal information no longer needed. (when you say the Privacy Act applies) APP 11
• Retentionofficial guidance, not lawKept only as long as the purpose justifies. ILO code para 8.5 official guidance, not law

• Recording consentstatutory requirementNo interception of calls or messages unless an exception applies: a party's prior consent (never for a criminal or tortious purpose), or equipment used in the ordinary course of business. Both are conditions to show, not a default. ECPA 2511(1)(a)ECPA 2511(2)(d)ECPA 2510(5)(a)
• Personal devicesstatutory requirementAn employer can authorise access to messages on a service it provides; that does not reach an employee's personal webmail or accounts, which need the user's authorisation. (if personal devices are monitored) SCA 2701(a)SCA 2701(c)(1)SCA 2701(c)(2)
• Retentionofficial guidance, not lawKept only as long as the purpose justifies. ILO code para 8.5 official guidance, not law

• Noticestatutory requirementWritten notice on hiring to every employee whose telephone, email or internet use is monitored, acknowledged by the employee in writing or electronically, and the notice posted in a conspicuous place. NY Civil Rights Law 52-c(2)(a)NY Civil Rights Law 52-c(2)(a)NY Civil Rights Law 52-c(2)(b)
• Recording consentstatutory requirementNo interception of calls or messages unless an exception applies: a party's prior consent (never for a criminal or tortious purpose), or equipment used in the ordinary course of business. Both are conditions to show, not a default. ECPA 2511(1)(a)ECPA 2511(2)(d)ECPA 2510(5)(a)
• Recording consentstatutory requirementNo wiretapping, mechanical overhearing of a conversation or interception of electronic communications without the consent of a party (for a conversation) or of the sender or receiver (for a call or an electronic message), or an eavesdropping warrant; the consent basis for each recording and interception tool is the record to hold. NY Penal Law s 250.05
• Limitsstatutory requirementIntercepting or accessing an electronic communication needs the consent of a sender or receiver, or a warrant: for email, voicemail and network monitoring the consent basis for each tool is the record to hold. NY Penal Law s 250.05
• Personal devicesstatutory requirementAn employer can authorise access to messages on a service it provides; that does not reach an employee's personal webmail or accounts, which need the user's authorisation. (if personal devices are monitored) SCA 2701(a)SCA 2701(c)(1)SCA 2701(c)(2)
• Retentionofficial guidance, not lawKept only as long as the purpose justifies. ILO code para 8.5 official guidance, not law

• Noticestatutory requirementPrior written notice to every employee who may be affected, naming the types of monitoring and the specific locations on the premises where it may occur, posted conspicuously including at those locations; and a plain-language statement to each new hire before they start. (the replacement text takes effect 1 October 2026 (Public Act 26-73); before that date it is not in force) Conn. Gen. Stat. 31-48d(b)(1)Conn. Gen. Stat. 31-48d(b)(1)Conn. Gen. Stat. 31-48d(b)(1)Conn. Gen. Stat. 31-48d(b)(3)
• Recording consentstatutory requirementNo interception of calls or messages unless an exception applies: a party's prior consent (never for a criminal or tortious purpose), or equipment used in the ordinary course of business. Both are conditions to show, not a default. ECPA 2511(1)(a)ECPA 2511(2)(d)ECPA 2510(5)(a)
• Recording consentstatutory requirementRecord a private phone call only with the prior consent of all parties (in writing or at the start of the recording), a recorded verbal notice at the start, or an automatic warning tone about every fifteen seconds. Conn. Gen. Stat. 52-570d(a)
• Places kept privatestatutory requirement not allowed hereNo electronic surveillance device or system, sound recording or CCTV included, to record or monitor employees in areas for their health or personal comfort or for safeguarding their possessions, such as rest rooms, locker rooms or lounges. (where it covers toilets or washrooms, change or locker rooms, showers or bathing areas and break rooms or staff lounges) Conn. Gen. Stat. 31-48b(b)
• Covert monitoringstatutory requirementMonitoring without prior written notice only on reasonable grounds to believe employees are breaking the law or others' rights, or creating a hostile workplace, where monitoring may produce evidence. (the replacement text takes effect 1 October 2026 (Public Act 26-73); before that date it is not in force) Conn. Gen. Stat. 31-48d(b)(2)
• Personal devicesstatutory requirementAn employer can authorise access to messages on a service it provides; that does not reach an employee's personal webmail or accounts, which need the user's authorisation. (if personal devices are monitored) SCA 2701(a)SCA 2701(c)(1)SCA 2701(c)(2)
• Retentionofficial guidance, not lawKept only as long as the purpose justifies. ILO code para 8.5 official guidance, not law

• Noticestatutory requirementBefore monitoring telephone, email or internet use: an electronic notice each day the employee uses the employer's email or internet, or a one-time notice the employee acknowledges. Del. Code tit. 19 705(b)Del. Code tit. 19 705(b)(1)Del. Code tit. 19 705(b)(2)
• Recording consentstatutory requirementNo interception of calls or messages unless an exception applies: a party's prior consent (never for a criminal or tortious purpose), or equipment used in the ordinary course of business. Both are conditions to show, not a default. ECPA 2511(1)(a)ECPA 2511(2)(d)ECPA 2510(5)(a)
• Recording consentstatutory requirementChapter 24 lets a party, or someone with one party's prior consent, intercept a call or conversation; the criminal code (s 1335(a)(4)) separately asks for the consent of all parties. The two are recorded side by side and not resolved: a question for counsel. Del. Code tit. 11 2402(a)(1) and (c)(4)Del. Code tit. 11 2401(8)
• Personal devicesstatutory requirementAn employer can authorise access to messages on a service it provides; that does not reach an employee's personal webmail or accounts, which need the user's authorisation. (if personal devices are monitored) SCA 2701(a)SCA 2701(c)(1)SCA 2701(c)(2)
• Retentionofficial guidance, not lawKept only as long as the purpose justifies. ILO code para 8.5 official guidance, not law

• Noticestatutory requirementAt or before collection, tell staff the categories collected, the purposes, and how long each is kept. (when you say the business meets the CCPA thresholds) CCPA 1798.100(a)CCPA CCR 7012
• Recording consentstatutory requirementThe consent of every party before recording a confidential communication, and before recording any call involving a cellular or cordless phone. Cal. Penal Code 632(a)Cal. Penal Code 632.7(a)Cal. Penal Code 631(a)Cal. Penal Code 631(a)
• Recording consentstatutory requirementNo interception of calls or messages unless an exception applies: a party's prior consent (never for a criminal or tortious purpose), or equipment used in the ordinary course of business. Both are conditions to show, not a default. ECPA 2511(1)(a)ECPA 2511(2)(d)ECPA 2510(5)(a)
• Places kept privatestatutory requirement not allowed hereNo audio or video recording of an employee in a restroom, locker room or room set aside for changing clothes unless a court order allows it; the duty is on causing the recording, so a camera or microphone a contractor, landlord or security vendor installed at the employer's request is reached too, and a recording made against the section is not used for any purpose. (where it covers toilets or washrooms, change or locker rooms and showers or bathing areas) Cal. Lab. Code s 435(a)Cal. Lab. Code s 435(b)
• Places kept privatestatutory requirementFrom the day Part 5.8 takes effect: no workplace surveillance tool of any kind (video, audio, location, badge logging, wearables, time tracking) monitors employees in a workplace bathroom, save a court order and one-time entry and exit checks; employees may leave a tool they carry outside the room, and a badge or alarm they must carry captures no audio or video and carries no embedded AI. (where it covers toilets or washrooms and showers or bathing areas) Cal. Lab. Code s 1560Cal. Lab. Code s 1560
• Limitsstatutory requirementReading or learning the contents of a message in transit needs the consent of every party; an organisation that deploys a third party tool doing so can be exposed too. Cal. Penal Code 631(a)Cal. Penal Code 631(a)
• Personal devicesstatutory requirementAn employer can authorise access to messages on a service it provides; that does not reach an employee's personal webmail or accounts, which need the user's authorisation. (if personal devices are monitored) SCA 2701(a)SCA 2701(c)(1)SCA 2701(c)(2)
• Retentionstatutory requirementRetention periods disclosed and no longer than reasonably necessary. (when you say the business meets the CCPA thresholds) CCPA 1798.100(a)
• Retentionofficial guidance, not lawKept only as long as the purpose justifies. ILO code para 8.5 official guidance, not law

• Noticestatutory requirementWhere the business telephone monitoring exemption is relied on: tell current and prospective employees, including by prominent signs. Illinois Eavesdropping Act 14-3(j)
• Recording consentstatutory requirementNo surreptitious recording of a private conversation without the consent of every party; a business doing telephone sales, service or research may monitor its employees' calls for quality, training or research only with one active party's consent, with unmonitored personal lines, and with no onward use. Illinois Eavesdropping Act 14-2(a)(1)Illinois Eavesdropping Act 14-2(a)(2)Illinois Eavesdropping Act 14-2(a)(3)Illinois Eavesdropping Act 14-3(j)Illinois Eavesdropping Act 14-3(j)
• Recording consentstatutory requirementNo interception of calls or messages unless an exception applies: a party's prior consent (never for a criminal or tortious purpose), or equipment used in the ordinary course of business. Both are conditions to show, not a default. ECPA 2511(1)(a)ECPA 2511(2)(d)ECPA 2510(5)(a)
• Personal devicesstatutory requirementAn employer can authorise access to messages on a service it provides; that does not reach an employee's personal webmail or accounts, which need the user's authorisation. (if personal devices are monitored) SCA 2701(a)SCA 2701(c)(1)SCA 2701(c)(2)
• Retentionofficial guidance, not lawKept only as long as the purpose justifies. ILO code para 8.5 official guidance, not law

• Recording consentstatutory requirementNo interception of calls or messages unless an exception applies: a party's prior consent (never for a criminal or tortious purpose), or equipment used in the ordinary course of business. Both are conditions to show, not a default. ECPA 2511(1)(a)ECPA 2511(2)(d)ECPA 2510(5)(a)
• Recording consentstatutory requirementNo intentional interception of a call, of an in-person conversation captured by a device, or of a message in transit, unless the recorder is a party to it or one party gave prior consent, and never to further an aim outside the law; contents known or suspected to come from an interception outside those terms are neither disclosed nor used. Tex. Penal Code s 16.02(b)(1)Tex. Penal Code s 16.02(c)(4)Tex. Penal Code s 16.02(b)(2) and (3)
• Limitsstatutory requirementEmail, messaging and network traffic in transit are communications the section reaches: interception needs the recorder to be a party or one party's prior consent. Tex. Penal Code s 16.02(b)(1)
• Personal devicesstatutory requirementAn employer can authorise access to messages on a service it provides; that does not reach an employee's personal webmail or accounts, which need the user's authorisation. (if personal devices are monitored) SCA 2701(a)SCA 2701(c)(1)SCA 2701(c)(2)
• Retentionofficial guidance, not lawKept only as long as the purpose justifies. ILO code para 8.5 official guidance, not law

• Recording consentstatutory requirementNo interception of calls or messages unless an exception applies: a party's prior consent (never for a criminal or tortious purpose), or equipment used in the ordinary course of business. Both are conditions to show, not a default. ECPA 2511(1)(a)ECPA 2511(2)(d)ECPA 2510(5)(a)
• Recording consentstatutory requirementCalls, in-person conversations where privacy is expected, and electronic messages in transit: the prior consent of all parties; one party's consent, the recorder's own included, is not enough. Provider-furnished telephone equipment used in the ordinary course of business is outside the definition. Fla. Stat. 934.03(1)(a)Fla. Stat. 934.03(1)(a)Fla. Stat. 934.03(1)(a)Fla. Stat. 934.02(4)(a)Fla. Stat. 934.03(1)(d)
• Personal devicesstatutory requirementAn employer can authorise access to messages on a service it provides; that does not reach an employee's personal webmail or accounts, which need the user's authorisation. (if personal devices are monitored) SCA 2701(a)SCA 2701(c)(1)SCA 2701(c)(2)
• Retentionofficial guidance, not lawKept only as long as the purpose justifies. ILO code para 8.5 official guidance, not law

• Recording consentstatutory requirementNo interception of calls or messages unless an exception applies: a party's prior consent (never for a criminal or tortious purpose), or equipment used in the ordinary course of business. Both are conditions to show, not a default. ECPA 2511(1)(a)ECPA 2511(2)(d)ECPA 2510(5)(a)
• Recording consentstatutory requirementRecord a call, a private conversation or a message in transit only as a party and with the prior consent of all parties. Md. Cts. & Jud. Proc. 10-402(a)(1)Md. Cts. & Jud. Proc. 10-402(a)(1)Md. Cts. & Jud. Proc. 10-402(a)(1)Md. Cts. & Jud. Proc. 10-401(8)
• Personal devicesstatutory requirementAn employer can authorise access to messages on a service it provides; that does not reach an employee's personal webmail or accounts, which need the user's authorisation. (if personal devices are monitored) SCA 2701(a)SCA 2701(c)(1)SCA 2701(c)(2)
• Retentionofficial guidance, not lawKept only as long as the purpose justifies. ILO code para 8.5 official guidance, not law

• Recording consentstatutory requirementNo interception of calls or messages unless an exception applies: a party's prior consent (never for a criminal or tortious purpose), or equipment used in the ordinary course of business. Both are conditions to show, not a default. ECPA 2511(1)(a)ECPA 2511(2)(d)ECPA 2510(5)(a)
• Recording consentstatutory requirementNo secret hearing or recording of a call or of spoken words without the prior authority of all parties; open recording the speakers know about is not an interception. Tariffed business telephone equipment used in the ordinary course of business is outside the definition. M.G.L. c. 272 s. 99 C.1M.G.L. c. 272 s. 99 C.1M.G.L. c. 272 s. 99 B.3 and D.1.bM.G.L. c. 272 s. 99 C.3
• Personal devicesstatutory requirementAn employer can authorise access to messages on a service it provides; that does not reach an employee's personal webmail or accounts, which need the user's authorisation. (if personal devices are monitored) SCA 2701(a)SCA 2701(c)(1)SCA 2701(c)(2)
• Retentionofficial guidance, not lawKept only as long as the purpose justifies. ILO code para 8.5 official guidance, not law

• Recording consentstatutory requirementNo interception of calls or messages unless an exception applies: a party's prior consent (never for a criminal or tortious purpose), or equipment used in the ordinary course of business. Both are conditions to show, not a default. ECPA 2511(1)(a)ECPA 2511(2)(d)ECPA 2510(5)(a)
• Recording consentstatutory requirementNo device to eavesdrop on a private conversation without the consent of all parties; whether a participant may record their own conversation is unsettled in the case law and recorded as such. MCL 539cMCL 539e
• Places kept privatestatutory requirement not allowed hereNo device observing, recording or eavesdropping in a private place without the consent of those entitled to privacy there. (where it covers toilets or washrooms, change or locker rooms, showers or bathing areas and lactation, nursing or parent rooms) MCL 539d(1)(a)
• Personal devicesstatutory requirementAn employer can authorise access to messages on a service it provides; that does not reach an employee's personal webmail or accounts, which need the user's authorisation. (if personal devices are monitored) SCA 2701(a)SCA 2701(c)(1)SCA 2701(c)(2)
• Retentionofficial guidance, not lawKept only as long as the purpose justifies. ILO code para 8.5 official guidance, not law

• Recording consentstatutory requirementNo interception of calls or messages unless an exception applies: a party's prior consent (never for a criminal or tortious purpose), or equipment used in the ordinary course of business. Both are conditions to show, not a default. ECPA 2511(1)(a)ECPA 2511(2)(d)ECPA 2510(5)(a)
• Recording consentstatutory requirementNo recording of a call or conversation by a hidden device without the knowledge of all parties; where the parties have been warned of the recording, either may record. Mont. Code Ann. 45-8-213(1)(c)Mont. Code Ann. 45-8-213(3)
• Personal devicesstatutory requirementAn employer can authorise access to messages on a service it provides; that does not reach an employee's personal webmail or accounts, which need the user's authorisation. (if personal devices are monitored) SCA 2701(a)SCA 2701(c)(1)SCA 2701(c)(2)
• Retentionofficial guidance, not lawKept only as long as the purpose justifies. ILO code para 8.5 official guidance, not law

• Recording consentstatutory requirementNo interception of calls or messages unless an exception applies: a party's prior consent (never for a criminal or tortious purpose), or equipment used in the ordinary course of business. Both are conditions to show, not a default. ECPA 2511(1)(a)ECPA 2511(2)(d)ECPA 2510(5)(a)
• Recording consentstatutory requirementPhone calls: not on one party's consent alone (the court has, as reported, required all parties); in-person private conversations: one participant's authority. NRS 200.620(1)NRS 200.650
• Personal devicesstatutory requirementAn employer can authorise access to messages on a service it provides; that does not reach an employee's personal webmail or accounts, which need the user's authorisation. (if personal devices are monitored) SCA 2701(a)SCA 2701(c)(1)SCA 2701(c)(2)
• Retentionofficial guidance, not lawKept only as long as the purpose justifies. ILO code para 8.5 official guidance, not law

• Recording consentstatutory requirementNo interception of calls or messages unless an exception applies: a party's prior consent (never for a criminal or tortious purpose), or equipment used in the ordinary course of business. Both are conditions to show, not a default. ECPA 2511(1)(a)ECPA 2511(2)(d)ECPA 2510(5)(a)
• Recording consentstatutory requirementCalls and conversations where privacy is expected: the consent of all parties, and a party to the conversation needs every other party's consent too. RSA 570-A:2, I(a)RSA 570-A:2, I(a)RSA 570-A:2, I-aRSA 570-A:1, IV(a)
• Personal devicesstatutory requirementAn employer can authorise access to messages on a service it provides; that does not reach an employee's personal webmail or accounts, which need the user's authorisation. (if personal devices are monitored) SCA 2701(a)SCA 2701(c)(1)SCA 2701(c)(2)
• Retentionofficial guidance, not lawKept only as long as the purpose justifies. ILO code para 8.5 official guidance, not law

• Recording consentstatutory requirementNo interception of calls or messages unless an exception applies: a party's prior consent (never for a criminal or tortious purpose), or equipment used in the ordinary course of business. Both are conditions to show, not a default. ECPA 2511(1)(a)ECPA 2511(2)(d)ECPA 2510(5)(a)
• Recording consentstatutory requirementPhone and radio communications: a non-participant needs at least one participant's consent. In-person and video conference conversations: every participant specifically informed before it is obtained. ORS 165.540(1)(a)ORS 165.540(1)(c)ORS 165.543
• Personal devicesstatutory requirementAn employer can authorise access to messages on a service it provides; that does not reach an employee's personal webmail or accounts, which need the user's authorisation. (if personal devices are monitored) SCA 2701(a)SCA 2701(c)(1)SCA 2701(c)(2)
• Retentionofficial guidance, not lawKept only as long as the purpose justifies. ILO code para 8.5 official guidance, not law

• Recording consentstatutory requirementNo interception of calls or messages unless an exception applies: a party's prior consent (never for a criminal or tortious purpose), or equipment used in the ordinary course of business. Both are conditions to show, not a default. ECPA 2511(1)(a)ECPA 2511(2)(d)ECPA 2510(5)(a)
• Recording consentstatutory requirementCalls, in-person conversations and messages in transit: the prior consent of all parties; telephone marketing and customer service calls may be monitored for training, quality control or monitoring with one party's consent, used only for those purposes and destroyed within one year. 18 Pa.C.S. 5703(1)18 Pa.C.S. 5703(1)18 Pa.C.S. 5703(1)18 Pa.C.S. 5704(15)18 Pa.C.S. 5704(15)
• Personal devicesstatutory requirementAn employer can authorise access to messages on a service it provides; that does not reach an employee's personal webmail or accounts, which need the user's authorisation. (if personal devices are monitored) SCA 2701(a)SCA 2701(c)(1)SCA 2701(c)(2)
• Retentionofficial guidance, not lawKept only as long as the purpose justifies. ILO code para 8.5 official guidance, not law

• Recording consentstatutory requirementNo interception of calls or messages unless an exception applies: a party's prior consent (never for a criminal or tortious purpose), or equipment used in the ordinary course of business. Both are conditions to show, not a default. ECPA 2511(1)(a)ECPA 2511(2)(d)ECPA 2510(5)(a)
• Recording consentstatutory requirementThe consent of all participants before recording a call or a private conversation; consent is obtained once a party announces the recording to all others and the announcement itself is recorded. RCW 9.73.030(1)(a)RCW 9.73.030(1)(b)RCW 9.73.030(3)
• Personal devicesstatutory requirementAn employer can authorise access to messages on a service it provides; that does not reach an employee's personal webmail or accounts, which need the user's authorisation. (if personal devices are monitored) SCA 2701(a)SCA 2701(c)(1)SCA 2701(c)(2)
• Retentionofficial guidance, not lawKept only as long as the purpose justifies. ILO code para 8.5 official guidance, not law

• Noticestatutory requirementA copy of the written policy to every employee within 30 days of the date the policy was required, and to each new employee within 30 days of starting. (when you say 25 or more employees in Ontario on 1 January) Ontario ESA 41.1.1(3)Ontario ESA 41.1.1(4)
• Written policystatutory requirementA written electronic monitoring policy covering all employees, in place before 1 March, saying whether the employer monitors, how and in what circumstances, the purposes, and the dates it was prepared and changed; kept for three years after it ends. (when you say 25 or more employees in Ontario on 1 January) Ontario ESA 41.1.1(1)Ontario ESA 41.1.1(2) para 1Ontario ESA 41.1.1(2) para 1 iOntario ESA 41.1.1(2) para 1 iiOntario ESA 15(8.2)
• Retentionofficial guidance, not lawKept only as long as the purpose justifies. ILO code para 8.5 official guidance, not law

• 1 Representative step before start not recorded
• 2 Notice not recorded, or its period not met
• 3 Written policy not recorded where the law asks for one
• 4 Covert monitoring
• 5 Monitoring a place the law keeps private
• 6 Monitoring outside work
• 7 Call recording consent
• 11 Retention not set, or above the period you set
• 12 Personal devices monitored
• 13 Lawful basis not recorded for an EU or UK line

The example "call recording" in a practice column reads as this class. Words are matched whole.

See the specimen plan run Plan your own list