Call recording and GDPR: lawful basis, notice and retention
What the GDPR asks of a business that records calls. It covers the lawful basis, notice before recording starts, fixed retention, tight access and the national rules to check.
A virtual landline number is a geographic number your carrier hosts for you, with no copper pair behind it. How to order one, port an existing number, and run the cutover without losing a call.
A virtual landline number is a geographic phone number that your carrier hosts for you. No copper pair runs to your building, and no switchboard sits in a cupboard behind it. Callers dial the same area code they always have. The call arrives over the internet, on whichever desk phone, laptop or mobile the person answering happens to be using that day.
This guide is for whoever signs off the phone system at a small or mid-sized company. It covers what the number is, what your phone system does with it once you have it, the European Union rules on getting and keeping it, and how to run the switch without dropping a call. Where a detail changes from country to country, we name the rule and the regulator.
The number is an entry in a carrier's routing table, pointed at your account. Nothing about it depends on the address where it was first issued. Move across town, move to another city, keep the number.
That independence shows up in ordinary situations. Your published number survives the office move and the letterhead stays right. You add a number in a second city without buying a second cabinet of hardware to go with it. A new starter gets a direct number set up in software, and nobody drives out to fit anything.
Delivery runs over a session initiation protocol (SIP) trunk into a cloud private branch exchange (PBX), which is the part that decides which handset rings. Both halves have their own explainer: how a SIP trunk carries calls and what a cloud PBX actually does.

A geographic range ties the number to an area code, and a caller reads that code as where you are. Every national numbering plan has such ranges, and the national regulator publishes the plan. In France that is Arcep, in Belgium the BIPT. The published plan is the only reliable answer to what a range means in that country.
The rules also move. France dropped the location requirement on its 01 to 05 ranges on 1 January 2023, so a French geographic number can now be used anywhere in mainland France (Arcep's numbering plan). Conditions on a geographic range differ from one national plan to the next, so read the plan for the country your number comes from.
France's plan, for one, sets aside 09 as a non-geographic range that signals no particular town. A range like that suits a company that sells nationally and doesn't want one city's code on every invoice. Companies with branches in several cities often run both: a geographic number per branch, all of them answered from the same place.
Premium and special-rate ranges are a different animal. The caller pays more than a normal call to reach them. That can be defensible on a support line that is budgeted as one. On a main switchboard it costs you calls you would otherwise have taken.
Buying the number is the small half of this. What your customers actually experience is the routing behind it, and that is the part most buyers think about last.
Forwarding by time and by condition. Calls go to a different team outside opening hours, or when the queue they would normally land in is already full. That replaces the manual "divert everything to Sophie" that somebody always forgets to undo on Monday morning.
Overflow to a mobile or a softphone, with the business number still on the display. Someone picks up on a smartphone in a car park and the customer sees the company number, never a personal one.
One number per site, one routing plan. Each branch keeps its own local number while one set of rules decides who picks up and what happens at 18:00. Local numbers reassure customers. Central routing absorbs the load.
One call log across all of it. Every branch and every device writes into the same record, so you can see the shape of inbound demand week on week. Nobody in the field has to ring the switchboard to find out who took a call. Retention windows vary by plan, which is worth checking against the period your own auditor expects.
Direct numbers for individual people are their own subject. Direct inward dialling, and what it costs to run a block of it, is covered in what a DDI number is. The mobile side sits in company numbers on a mobile SIM.
For a hosted number, compliance comes down to four questions you can put in an email and expect a written answer to.
Where are the voice traffic and the call records stored?
Who inside the provider can read them?
How long are they kept, and what deletes them on schedule?
Which legal entity is actually processing the data?
The General Data Protection Regulation doesn't ban the cloud. It requires you to know where the data goes and on what basis someone handles it. Call logs contain personal data, caller numbers and timestamps among them, and recordings do too. Article 28 requires a written contract with whoever processes it on your behalf, and that processor cannot bring in another one without your written authorisation. Voxbi signs an Article 28 data processing agreement as standard (Article 28 in full).
Two kinds of business carry more than that baseline. Health data is a special category under Article 9 of the GDPR, and member states may add their own conditions on top. A clinic or a care home should check its national rule before it signs anything. An investment firm that takes client orders by phone has to keep those recordings for five years under the Markets in Financial Instruments Directive (MiFID II). Its regulator can ask for up to seven. More on that in call recording and the GDPR.
Voxbi stores call data and recordings in European Union data centres, so the data-residency answer fits in one sentence when your own client asks. Ask any provider you shortlist where the voice packets go. Then ask who can open the call log.
Start with the area code you want to publish. Then ask whether your provider holds numbers in that range itself or resells someone else's stock. Resale is fine day to day. It stops being fine the week you need fifty consecutive numbers in one city and the request lands in a third party's queue.
Ask what a block of numbers costs beyond the ones bundled with your seats. A growing company adds direct numbers faster than it adds licences, so price that line before you sign.
Ask how outbound porting works at this provider, and get the answer in writing. Without that clause you can end up locked in with your first operator.
With Voxbi you choose local, national or toll-free numbers, then assign each one to a user, a team or a full call flow from the same dashboard. The virtual numbers page lists what is available.

Porting moves your existing number to a new provider and the caller notices nothing. It's a legal right across the European Union. Article 106 of the European Electronic Communications Code gives every end user with a number from a national numbering plan the right to keep it when they change provider, and it bars any direct charge to the user for exercising that right (the Code on EUR-Lex).
The receiving provider runs the process. Your old operator has to cooperate in good faith and cannot stall it, and your contract with them terminates automatically the moment the port completes. So the most expensive mistake in a port is cancelling the old contract first. Don't. If you already have, the Code still gives you at least a month after termination to port the number out.
There are two clocks in a port and people mix them up. The regulated one is short. Once the date is agreed, the number has to be activated within one working day of it, and loss of service during the switch cannot exceed one working day either. Each member state sets the compensation when a provider misses that. Belgium's regulator explains how to claim it, for companies as well as consumers (BIPT on porting delays).
The second clock is the paperwork, and that's the one that costs you real days. Give the new provider your company name and line details exactly as they appear on your current contract, and check the agreed date and the fallback procedure before you sign. France adds a twelve-character RIO code that you get from your current operator first, though a business whose lines share one physical access can be exempt (Arcep on number portability). In our own market, Luxembourg and the Greater Region, a standard port usually takes five to fifteen business days, depending on the current operator and the number type. The full sequence is in how to port a business phone number.
If the port fails, the old provider has to switch your number back on and keep serving you on the same terms until it succeeds. That is in Article 106 as well.
If several of your lines share one physical access, ask your provider whether they port together. Raise it early if you plan to port in stages.

Book it for a quiet morning. The old system stays powered and answering until calls prove themselves on the new platform. You run both for a few hours.
Test from outside the building. Ring the ported number from a mobile on another network and confirm it lands in the right place. Then call out and read the caller display on the receiving handset. If the number you present differs from the number you publish, customers who don't recognise it won't ring back.
On-premises kit tends to hold routing that nobody wrote down. If the box has been in the rack for a decade, walk the dial plan with whoever built it before you agree a date.
112 reaches the emergency services everywhere in the European Union, free of charge, and operators pass the caller's location to the emergency authorities (European Commission on 112). A number that can ring on any device makes that harder, so ask your provider which location it sends with a 112 call from each kind of device. Then ask how they verify emergency routing without anyone dialling 112 for real.
The internet connection is the other thing to plan for. Your number terminates in the carrier's network, so a diversion configured at that level still works when the office line is down, and calls land on mobiles while somebody fixes it, provided you set it up during commissioning.
Three pieces of plain engineering sit underneath the carrier diversion. A mobile data failover on the router covers a short line fault. Voice traffic prioritised on the local network keeps quality steady when the office is busy. Monitoring on the SIP trunk means your own system tells you about a registration drop before a customer does.
The per-user subscription is the visible part. Add the per-number charge for anything beyond your bundled allocation, then the minimum term. Porting should not appear on that list at all: under Article 106 no direct charge falls on the end user for keeping their number. If a provider quotes you a porting fee, ask what it is for. Early termination fees on the old contract are a separate matter, and in France Arcep is explicit that you still owe them.
Then set the total against what the old system costs over the same period. That figure includes the maintenance contract and the engineer who drives out to site. It also includes hardware that stopped being manufactured years ago and will have to be replaced by something.
Can I keep my number if I change provider? Yes, and you don't pay for the privilege. Number portability is a right under Article 106 of the European Electronic Communications Code. The new provider leads the process and no direct charge falls on you. The paperwork is what varies by country. France uses the RIO code, and other countries have their own form. Get the agreed cutover date confirmed in writing before anything moves.
Can I use a geographic number on a mobile? Technically, yes. A softphone on the handset registers to the same cloud PBX as the desk phones. The mobile then presents the geographic number and the caller sees no difference. The limit is regulatory rather than technical. Regulators such as Arcep check that a number is used in line with what its range is for. Read the plan for the country the number comes from.
Is a virtual landline as reliable as the old line? It is as reliable as the internet connection under it. With the failover, voice priority and trunk monitoring described above, an outage on the office line does not have to take the number down. Without them, the number shares the fate of the connection. Ask for the service level commitment in writing in the contract.
Does it work out cheaper than an on-premises PBX? The subscription price will not tell you. Count the outbound call charges, the porting project, the minimum term, and then compare against the maintenance contract, the engineer visits and the eventual hardware replacement on the system you already own. Compare the two totals over several years.
Voxbi runs a cloud PBX hosted in the European Union. Call routing, number porting and day-to-day configuration all happen in a browser. Before you talk to anyone about switching, write down the numbers you cannot afford to lose, the exact company name on your current phone contracts, and the date your current term ends. Send it through the contact form and we'll tell you what porting it involves.
Talk to us or to a certified Voxbi partner.