Recording customer calls
in the UAE and the UK.

Recording calls used to be something only call centres and banks worried about. With AI receptionists, almost every call is at least transcribed, and often recorded, so the rules now matter to clinics, property managers, shops and restaurants too. The good news is that one simple practice, a clear notice at the start of each call, goes a long way in both the UAE and the UK.

This article is general information, not legal advice. Laws differ by sector, and some free zones have their own rules. Speak to a lawyer about your circumstances.

The UAE: privacy and consent

UAE law treats private conversations as protected, and the key offences turn on consent.

• Cybercrime law. Article 44 of Federal Decree-Law No. 34 of 2021 on combating rumours and cybercrimes covers using an information network or IT system to violate privacy without consent. Recording or disclosing conversations is listed among the prohibited acts. Gulf News, citing the Abu Dhabi Judicial Department, reports penalties of at least six months' imprisonment and/or a fine of AED 150,000 to AED 500,000.
• Penal Code. The UAE Penal Code (Federal Decree-Law No. 31 of 2021) also criminalises listening to or recording conversations held by telephone without the consent of the person concerned, outside cases permitted by law.
• Data protection. The Personal Data Protection Law (Federal Decree-Law No. 45 of 2021) has applied since January 2022. The government portal summarises it as prohibiting processing of personal data without the owner's consent, subject to exceptions such as performing a contract. Its executive regulations had not been issued as of mid-2026, according to law-firm reports, so some details remain unsettled.

We found no UAE equivalent of the UK's specific permission for businesses to record calls. The practical conclusion, which is our reading rather than a rule set out in the law, is that a UAE business should tell callers at the start of every call that it is recorded or transcribed, and why, and give them a way to object or reach a person. Continuing the call after a clear notice is the usual basis for showing the caller knew and agreed.

For outbound marketing calls there is an explicit rule: Cabinet Resolution No. 56 of 2024 requires companies to record marketing calls and to inform the consumer of the recording when the call begins. See UAE telemarketing rules.

Businesses in the DIFC and ADGM are governed by those free zones' own data protection laws. The DIFC also has a specific rule on AI systems, covered in our data protection comparison.

The UK: interception rules plus UK GDPR

In the UK, two sets of rules apply together.

1. Interception law. The Investigatory Powers Act 2016 makes interception unlawful unless an exception applies. The Investigatory Powers (Interception by Businesses etc. for Monitoring and Record-keeping Purposes) Regulations 2018 provide that exception for businesses. They permit recording for purposes including establishing facts, checking compliance with regulatory or self-regulatory procedures, demonstrating standards, and preventing or detecting crime. A condition is that the business has made "all reasonable efforts to inform every person who may use the telecommunication system" that their communications may be intercepted.

2. Data protection. A recording or transcript is personal data, so you need a lawful basis under the UK GDPR and must be transparent. The ICO uses call recording as an example: a company may rely on legitimate interests to use recordings of calls to its helpline for training. The ICO also says you must provide privacy information to people at the time you collect their data, covering your purposes, lawful basis, retention period and their rights.

Sector rules. Some sectors must record. Under the FCA's rules in SYSC 10A, in-scope investment firms must take all reasonable steps to record relevant telephone conversations, tell clients in advance that calls are recorded, and keep records for five years, or up to seven if the FCA requests.

AI transcription is processing too

A transcript produced by an AI is subject to the same rules as a recording. The ICO's innovation guidance notes that when a supplier transcribes calls for a business, the business is likely to remain the controller, but a supplier that uses the data to train its own models becomes a controller for that purpose. Ask your provider whether your calls are used for training, and make sure your contract and privacy notice match the answer.

A notice that works in both countries

Keep it short, natural and at the very start of the call. For example:

"Hello, you've reached [Business]. I'm the AI assistant. This call is recorded and transcribed so we can help you and improve our service. How can I help?"

In Arabic, a natural equivalent could be: «أهلاً، معك المساعد الذكي لـ[اسم الشركة]. يتم تسجيل هذه المكالمة وتحويلها إلى نص لخدمتك وتحسين خدماتنا. كيف أقدر أساعدك؟»

Then back it up:

• Publish a privacy notice that explains what is recorded, why, how long it is kept, who processes it and how to make requests.
• Let callers ask for a person, or ask for recording to stop where that is practical.
• Decide retention periods and delete recordings and transcripts on schedule.
• Restrict who can listen to recordings, and log access.
• Avoid capturing payment card numbers or other sensitive data in recordings unless your setup is designed for it.

Summary

Read the Arabic guide to تسجيل المكالمات وحماية البيانات في الإمارات.