GDPR Compliance Questions from Customers

Last updated: August 30, 2025

At Mycroft, we proudly offer Managed Services and Success Packages featuring industry expertise through our virtual CISOs. Below are inquiries about GDPR that our Virtual CISOs have addressed, with answers modified to benefit a wider audience.

Interested in adding a Mycroft Virtual CISO to your subscription with a Success Package? Reach out to us today!


In GDPR and EU countries, do you know if there are expectations and rules around recording consent?

Consent is mandatory and some countries Germany, France, and Spain - cannot be recorded until consent is given

  1. Key points of disclosure - must be in plain language:

    • Who is recording (your business)

    • Why the recording is happening (legal basis)

    • How long it'll be stored (retention)

    • How to opt-out (disclosing that method)

  2. However - companies can record calls (without consent) if:

    • Necessary for contract performance

    • Required by law

    • Necessary to protect someone's vital interests (could be covered here)

    • Legitimate interest of the organization (provided it does not override the individual rights)