Your cookie preferences

EDPB guidance · Art. 7 GDPR

We use technical cookies essential for the platform to work (login, security, sessions). We would also like to use analytics cookies to understand how to improve it.

You can accept all, reject all, or choose which categories to switch on.Your consent is valid for 6 months and you can withdraw it at any time from the footer.

You will find everything in our privacy notice.

All news
Regulation July 25, 2026 3 min

Call centre recordings: the customer has a right to access them, and a transcript is enough

The Italian DPA closes proceedings against Enel Energia: the agent's privacy does not justify refusal, their identifying details are simply redacted

TL;DR for the DPO

The right of access cannot be blocked by saying 'someone else's data is in there'. You must find the solution that satisfies the requester while limiting the impact on third parties: here, a transcript with the agent's identifying details redacted. Outright refusal is the last option, not the first.

The three points that matter

  • The presence of third-party data is not an automatic ground for refusal: Art. 15(4) protects others' rights but requires assessing them concretely, not invoking them as a formula.
  • The format can change: the request was held satisfiable with a transcript instead of the audio file. A practically useful point, since delivering a redacted transcript is often easier than editing audio.
  • Context matters: the conversation took place in a professional setting and concerned a supply contract. The agent's confidentiality, speaking in the course of their duties, does not cover the content of the call.

What to do now, in practice

For clients who record calls (call centres, support, telemarketing, bookings): 1) check the access-request procedure expressly covers audio recordings, not just documents; 2) decide in advance HOW delivery happens: a redacted transcript is the route indicated; 3) establish who performs the redaction and within what time, so as to stay within the one month of Art. 12(3); 4) review the notice: it must state that calls are recorded, for what purposes and for how long; 5) train customer service staff to forward the request rather than refuse it on the phone.

Why it matters for your clients

Almost every company with a customer service line records calls, and almost none has planned what to do when someone asks to hear them again. The reflex is to refuse. This decision says that is not enough: a procedure is needed, and it is needed before the request arrives. It is a quick check that prevents a complaint that would be very easy to substantiate.

Official source:Italian Data Protection Authority - proceedings against Enel Energia S.p.A., newsletter no. 549 of 16 July 2026

Looking for a workspace for your DPO work?

DPO Workspace is built by a certified DPO. 30-day free trial.

Start free

Related articles

Regulation
nullathe decision on a worker taken by the algorithm alone, from 23 October

A dismissal decided by the algorithm is void: from 23 October in Italy

Published in Official Gazette no. 234 of 8 October 2026 and in force since 23 October, decree no. 179/2026 provides that final decisions on the employment relationship cannot be based solely on automated processing, that the worker may request an understandable explanation, and that decisions taken in breach are void. In parallel, AI systems affecting work organisation enter the risk assessment under Article 28 of decree 81/2008. For a DPO this is the rare case where the consequence is not economic but civil, and it changes how the check is framed.

Oct 08, 2026New 8 min
Regulation
3signals that make notification due

Poland's UODO: not every breach must be notified. Public-register data on one side, PESEL, health and financial data on the other

If an invoicing system leaks only a sole trader's name, business name, tax number and registered address, already public in the business register, risk is normally unlikely. If it also leaks the national ID number, purchase details revealing health, or financial data, notification is due. Either way, the decision goes into the internal register.

Oct 05, 2026New 5 min
Regulation
120days to charge you, not to fine you

The 120 days are not the deadline to fine you: they are the deadline to charge you

Anyone who built an appeal on the authority's delay should re-read the calendar. The Court clarifies three things: the complaint procedure and the sanctioning procedure are autonomous, so overrunning the nine-to-twelve months on the complaint does not extinguish the power to fine; the 120 days are for notifying the charge, not for imposing the fine; and they run from the «definitive finding», which is not the first notice but the moment the authority can assess every element — including the hearing of your side. After the charge, only the five-year limitation period remains.

Sep 20, 2026 7 min