UK Recording Laws: Consent, RIPA, UK GDPR, and 2025 Updates

UK recording questions depend on how the recording is made and used. The Investigatory Powers Act 2016, sections 3 and 4, sets the current telecommunications-interception framework. RIPA section 1 is no longer the operative provision, and its former text should not be treated as a general permission to record or share.

Quick Answer: Which Recording Rule Applies?

The current telecommunications question starts with IPA 2016 sections 3 and 4. Section 4 requires a relevant act involving the system and content being made available to someone other than the sender or intended recipient. A label such as personal use does not replace that statutory test.

For practical examples, see the UK phone-call recording guide and the guide to covert recordings as evidence.

What RIPA Covers Today

RIPA's current text retains powers concerning covert surveillance, covert human intelligence sources and protected information. Section 26 defines directed and intrusive surveillance; sections 28 and 32 contain distinct authorisation requirements. These provisions do not create a general personal-recording licence.

The former interception offence in RIPA section 1 is omitted from the current text. Telecommunications interception is addressed by the Investigatory Powers Act 2016. Section 44 also distinguishes consent by both sender and intended recipient from its separate route involving one party's consent and an applicable surveillance authorisation.

The RIPA 2000 guide explains the surviving powers, authorisation safeguards, Scotland's framework and Tribunal complaints.

The Investigatory Powers Act 2016

The Investigatory Powers Act 2016 supplies the current principal interception framework. Section 3 prohibits intentional interception in the United Kingdom through specified systems or services without lawful authority, subject to its private-system exception. Party status alone is not the complete statutory test.

What the IPA 2016 Criminalises

Under IPA 2016 section 3, it is an offence to intercept a communication without lawful authority. The Act covers:

• Modifying or interfering with a telecommunication system to obtain content.
• Monitoring transmissions on a system, including wireless telegraphy.
• Making the content of a transmission available to someone who was not the sender or intended recipient.

Telecommunication systems include phone networks, the internet, email, and encrypted messaging platforms.

Current Warrant Review and Urgent Issue

The current Investigatory Powers Act 2016 retains independent Judicial Commissioner review of decisions to issue interception warrants under Part 2, Chapter 1. Section 23 requires review of necessity and proportionality. Section 24 provides a separate urgent-issue procedure, with a Commissioner decision required by the end of the third working day after issue; refusal ends the warrant's effect and prevents renewal.

Penalties Under IPA 2016

Civil liability and regulatory action by the Information Commissioner's Office (ICO) can arise separately from criminal proceedings.

UK GDPR and the Data Protection Act 2018

Recording a conversation is only the first step. Once a recording captures identifiable information about another person, it becomes personal data under the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018. This overlay applies to organisations and individuals alike, with one important exception: purely personal or household activity is exempt.

The Household Exemption

Individuals recording for purely personal or household purposes are exempt from most UK GDPR obligations (Article 2(2)(c) UK GDPR). If you record a call with your bank for your own notes, you are not processing personal data in a regulated sense. The exemption disappears the moment you share, publish, or use the recording commercially.

Lawful Basis for Organisations

Any organisation recording calls or conversations must identify and document a lawful basis under Article 6 UK GDPR before processing begins. The most commonly relied-upon bases are:

• Legitimate interests (Article 6(1)(f)): The most widely used basis for business call recording. Requires a documented Legitimate Interest Assessment (LIA) demonstrating that the business interest is not overridden by the data subject's rights. The ICO's January 2026 guidance update requires this assessment to be formal and on file.
• Legal obligation (Article 6(1)(c)): Applies where recording is mandated by sector regulation, such as FCA rules for financial services firms.
• Contract (Article 6(1)(b)): Where recording is necessary to perform or verify a contract with the individual.
• Consent (Article 6(1)(a)): Valid in principle but rarely the right basis for employment contexts; must be freely given, specific, informed, and unambiguous.

ICO Guidance on Employee Monitoring (2025-2026)

The ICO updated its employee monitoring guidance in 2025-2026. Key requirements:

• Monitoring must be justified by a clear, documented business need.
• Workers must generally be informed that monitoring may occur, via a privacy notice.
• Covert monitoring is only permissible in exceptional circumstances such as investigating suspected criminal activity, and only after less intrusive methods have been considered.
• Data Protection Impact Assessments (DPIAs) are required for any systematic or large-scale monitoring programme.
• Organisations using AI-assisted call analysis must explicitly disclose this in their privacy notices (January 2026 ICO requirement).
• Recordings must be subject to defined retention policies and automatically deleted at the end of the retention period.

Workplace Call Recording and Business Monitoring

Business call monitoring needs separate analysis of interception authority and data protection. IPA 2016 section 46 provides a regulation-making route for specified business monitoring and record-keeping. Its existence does not authorise every recording labelled training or quality control.

The ICO's current worker-monitoring guidance explains that recording every call's content is not usually proportionate. It gives business transactions, training and quality control as possible contexts for necessary monitoring, with attention to less intrusive alternatives.

The guidance says callers must be told that recording is taking place and why. A recorded message is good practice; additional privacy information can be supplied separately. That is data-protection guidance, not a conclusion that an announcement satisfies every interception condition.

The UK workplace-recording guide and covert recordings as evidence cover the separate workplace and court-use questions.

Recording Phone Calls in the UK

A participant recording a telephone call should not be analysed through the former RIPA section 1 as though it remained in force. The current IPA section 4 definition turns on the system activity and who can access the content. The applicable circumstances, rather than a blanket personal-use label, determine whether the interception provisions are engaged.

Recording and Later Use Are Separate Questions

The current IPA section 4 definition addresses a relevant act involving a telecommunications system, access to content and the statutory timing rules. It does not create the personal-use exemption described in older versions of this guide. The way a recording is later used needs its own analysis; it cannot be resolved by quoting the former RIPA interception provision.

Admissibility in Legal Proceedings

A covert recording you have made of your own conversation is generally admissible in civil and criminal proceedings, but admission is not guaranteed. Courts apply a balancing test:

• Civil proceedings: Under the Civil Procedure Rules, courts have discretion to admit or exclude evidence, weighing relevance, authenticity, and fairness.
• Family court: The Family Justice Council published comprehensive guidance in May 2025 on covert recordings in family proceedings. Courts may admit recordings with significant evidential weight. Recording children is strongly discouraged. Parties must disclose recordings early, produce unedited versions, and cannot share recordings with third parties without court permission.
• Criminal proceedings: Courts may exclude evidence obtained unlawfully under section 78 of the Police and Criminal Evidence Act 1984 (PACE) if admitting it would adversely affect the fairness of proceedings.

Recording In-Person Conversations

IPA section 4 concerns telecommunications systems. A face-to-face recording therefore needs analysis of the actual device, setting and use rather than an assumed exception in RIPA. For workplace and evidential questions, see the UK workplace-recording guide and covert recordings as evidence.

Potential issues arise under:

• Privacy law and the tort of misuse of private information: If you record someone in a context where they had a reasonable expectation of privacy (for example, in their home or a private medical consultation), you may face civil liability even if no criminal offence is committed.
• Harassment: Persistent, systematic covert recording of a particular person could constitute a course of conduct amounting to harassment under the Protection from Harassment Act 1997.
• Data protection: If you process the recording in a way that goes beyond personal household use, UK GDPR applies.

Recording the Police

You have the right to film and record police officers carrying out their duties in a public place. There is no specific criminal offence of filming a police officer in the UK.

The Metropolitan Police states explicitly in its public guidance that members of the public and the press do not need a permit to film or photograph in public places, and police have no power to stop them filming police personnel. This reflects the right to receive and impart information under Article 10 of the European Convention on Human Rights, as incorporated into UK law by the Human Rights Act 1998.

What Police Cannot Do

Police officers cannot:

• Require you to stop filming without a specific legal power.
• Demand you delete footage from your phone without a court order or warrant.
• Seize your device purely because you filmed them.

What You Must Not Do

• Obstruct a police officer in the execution of duties (Police Act 1996 s.89).
• Film in a way that is likely to be useful to a person planning a terrorist act (Counter-Terrorism Act 2008 s.76; this requires the terrorist-assistance nexus, not mere filming of police activity).
• Film in premises where filming is restricted by a court order or security designation.

Bridges v South Wales Police [2020] EWCA Civ 1058

In August 2020, the Court of Appeal held that South Wales Police's use of live automated facial recognition technology was unlawful. The court found three grounds: the absence of an adequate legal framework breached Article 8 ECHR; the Data Protection Impact Assessment failed to properly address privacy implications; and the force had not complied with the public sector equality duty. Although the case concerned police surveillance technology rather than individual recording rights, it demonstrates the courts' willingness to scrutinise public-space surveillance programmes robustly.

The Voyeurism (Offences) Act 2019 and Image-Based Abuse

The Voyeurism (Offences) Act 2019 amended the Sexual Offences Act 2003 to create a specific upskirting offence. Under section 67A of the 2003 Act (as inserted), it is a criminal offence to operate equipment or record an image beneath another person's clothing for the purpose of obtaining sexual gratification or causing humiliation, alarm, or distress to the victim.

Maximum penalty: 2 years imprisonment. The most serious cases may result in the offender being placed on the sex offenders register.

The offence exists alongside section 67 of the Sexual Offences Act 2003, which covers voyeuristic recording more broadly (filming private acts for sexual gratification), and the Protection of Freedoms Act 2012 offence of installing equipment to observe or record private acts.

Domestic Abuse Act 2021: Non-Consensual Breastfeeding Photography

The Domestic Abuse Act 2021 extended voyeurism provisions to cover recording a person who is breastfeeding without their consent for the purpose of sexual gratification or causing humiliation, distress, or alarm. Maximum penalty: 2 years imprisonment.

Civil Tort: Misuse of Private Information

Even where no criminal offence is made out, recording someone in a context where they had a reasonable expectation of privacy can give rise to civil liability for misuse of private information, a tort developed by English courts under the influence of Article 8 ECHR. Damages are available; courts have awarded substantial sums in cases involving covert intimate recording.

The Online Safety Act 2023: Platform Duties and NCII

The Online Safety Act 2023 is primarily a platform regulatory statute. Its relevance to recording law is through new criminal offences and the priority offence regime.

The OSA created two offences in the Sexual Offences Act 2003:

• Cyberflashing (section 66A): Sending an image of genitals without consent for the purpose of sexual gratification or causing humiliation, alarm, or distress. The first conviction under this provision occurred in March 2024.
• Sharing intimate images without consent (section 66B): Sharing a real or AI-generated intimate image of an identifiable adult without consent. No requirement to prove intent to cause harm; the sharing itself is the offence.

Platforms that fail to remove non-consensual intimate imagery face fines of up to £18 million or 10% of global qualifying revenue under Ofcom's enforcement powers. Illegal content duties came into force on 17 March 2025. On 8 January 2026, the Online Safety Act 2023 (Priority Offences) (Amendment) Regulations 2025 came into force, formally designating cyberflashing and intimate image sharing as priority offences requiring proactive platform action.

AI, Deepfakes, and the Data (Use and Access) Act 2025

The Data (Use and Access) Act 2025 (DUAA) is the most significant recent development in UK recording-adjacent law. Section 138 inserts new sections 66E-H into the Sexual Offences Act 2003, creating criminal offences specifically targeting the creation of intimate deepfakes.

What Is Now Criminalised

From 6 February 2026, it is a criminal offence to intentionally:

• Create, or request the creation of, a "purported intimate image" of an identifiable adult without their consent or a reasonable belief in consent.
• A purported intimate image is any image that appears to show the person nude, partially nude, or engaged in a sexual act, whether the image is real, digitally altered, or entirely AI-generated.

Importantly, the offence does not require intent to share the image. Creating a deepfake for private use is already criminalised. If the deepfake is subsequently shared, the perpetrator may also face the separate section 66B sharing offence under the OSA 2023.

Crime and Policing Bill: Nudification Apps

The UK Government announced its intention to criminalise the supply of nudification tools (apps designed to generate non-consensual intimate images) through the Crime and Policing Bill, which was progressing through Parliament as of early 2026. Companies supplying such tools would face criminal liability.

The Combined Effect of OSA 2023 and DUAA 2025

Sharing AI-generated intimate images has been illegal under the OSA 2023 since 31 January 2024. The DUAA 2025 closes the creation gap. Together the two statutes mean that both creating and sharing non-consensual intimate deepfakes are criminal in the UK.

Scotland: The RIP(S)A Framework

The Regulation of Investigatory Powers (Scotland) Act 2000 provides a distinct framework for directed and intrusive surveillance and covert human intelligence sources. Its authorisations are not a general licence for private people to record conversations.

RIPA section 46 preserves specified UK-wide authorisation grounds and authorities in Scotland. Identifying the activity, authority and statutory ground matters more than treating the two Acts as interchangeable personal-recording rules.

Cross-Border Recordings: UK to US and EU

Recording laws vary by jurisdiction, and a UK caller recording a cross-border call must consider the law of the other jurisdiction.

UK Calling a US Number

The United States has both federal wiretapping law (18 U.S.C. § 2511, which permits one-party consent recording at the federal level) and state wiretapping statutes. Approximately 13 US states require the consent of all parties to a call, including California, Florida, Pennsylvania, and Washington. If a UK-based caller records a call with a person in California, they should obtain consent from the California party because California Penal Code § 632 applies to the party in California.

The safest approach for any cross-border business call recording programme is to apply the strictest applicable consent law to all calls, regardless of where the recording party is located.

UK Calling EU Numbers

EU member states implement the e-Privacy Directive alongside EU GDPR. Many EU jurisdictions require that all parties be informed before a call is recorded. Germany, for example, requires all-party consent in most contexts. The UK's post-Brexit UK GDPR is functionally equivalent to EU GDPR for most recording-related purposes, but businesses transferring recorded personal data from EU countries to UK-based systems must comply with GDPR Chapter V transfer rules. The EU adequacy decision for UK data transfers was extended to 2027.

Notable Enforcement Cases

News of the World Phone Hacking Scandal

The most significant UK case of illegal recording involved systematic interception of voicemail messages by staff at the News of the World between 2001 and 2011:

• Clive Goodman and Glenn Mulcaire were convicted under RIPA in January 2007 for intercepting royal household voicemails.
• Andy Coulson (former editor) was convicted of conspiracy to intercept communications in 2014 and sentenced to 18 months.
• The newspaper closed in July 2011 after 168 years of publication.
• News Corporation paid over £400 million in civil settlements to victims.
• The Leveson Inquiry produced wide-ranging recommendations on press ethics.

The scandal demonstrates that illegal interception of communications, including voicemail interception, is treated as serious criminality in the UK.

ICO Enforcement: Key Examples

• 2019: A care home fined for using CCTV in residents' bedrooms without a proper lawful basis.
• 2020: An employer reprimanded for covert monitoring of employee emails without adequate justification.
• 2023: A private landlord received an enforcement notice for CCTV covering neighbouring properties without a lawful basis or privacy notice.
• 2024: ICO issued enforcement notices to two organisations for deploying AI-powered call analysis without adequate disclosure to data subjects.

Bridges v South Wales Police (2020)

As noted above, the Court of Appeal held the police use of live automated facial recognition in public to be unlawful on three grounds: breach of Article 8 ECHR, failure to conduct a proper DPIA under the DPA 2018, and failure to comply with the public sector equality duty. The decision has shaped subsequent police AFR deployment policy.

CCTV and Surveillance Cameras

The UK has one of the highest concentrations of CCTV cameras in the world, estimated at between four and six million cameras. The regulatory framework is set by the Protection of Freedoms Act 2012, which created the Surveillance Camera Commissioner and the Surveillance Camera Code of Practice.

Who Must Follow the Code

The following bodies are required to have regard to the Surveillance Camera Code:

• Police forces and Police and Crime Commissioners.
• Local authorities and fire and rescue services.
• NHS trusts and foundation trusts.
• Public transport providers and other public authorities operating surveillance systems.

Domestic CCTV

Private homeowners operating cameras that capture images beyond their own property may be subject to UK GDPR. The ICO advises that domestic cameras should ideally cover only the homeowner's own property. Where cameras capture a neighbour's garden, driveway, or a public footpath, data protection obligations may apply, including the obligation to respond to subject access requests within one month.

ICO Video Surveillance Guidance (2023 Update)

The ICO updated its video surveillance guidance in 2023, emphasising that audio recording alongside CCTV video is "highly intrusive" and will require substantially greater justification than video-only surveillance. Organisations should switch off audio capture capability by default and enable it only in exceptional circumstances through a deliberate trigger.

Updates Log

Related UK Recording Guides

• Recording Phone Calls in the UK
• Recording in the UK Workplace
• Filming the Police in Public
• Home CCTV and Video Doorbells
• Covert Recordings as Evidence

This guide is part of our United Kingdom law guides.