All articles
Compliance & Legal|10 min read||By Arne Niitsoo

Call Recording Laws: Baltics & Nordics (2026)

If your sales team records calls across the Baltics and Nordics, compliance isn't optional — it's a legal minefield that varies by country. Get it wrong, and you face GDPR fines of up to 4% of annual revenue or EUR 20 million, whichever is higher.

This guide covers the specific call recording laws in each Baltic and Nordic country as of 2026, plus practical steps to stay compliant while still getting value from conversation intelligence.

The GDPR Foundation

All EU/EEA countries share the GDPR as a baseline, but each nation implements it differently through local data protection acts and telecom regulations. For call recording, the key GDPR principles are:

  • Lawful basis — you need a legal reason to record (consent, legitimate interest, or contractual necessity)
  • Transparency — the other party must know they're being recorded
  • Data minimization — only record what's necessary
  • Storage limitation — don't keep recordings forever
  • Right to access and deletion — recorded parties can request their data

    • However, the devil is in the details — especially around consent type and notification requirements.

    Call Recording Laws in Estonia

    Consent type: One-party consent with notification.

    Estonia's Electronic Communications Act and Personal Data Protection Act govern call recording. In a business context, you can record a call if:

  • At least one party to the call consents to the recording
  • The other party is notified that recording is taking place
  • You have a legitimate business purpose (sales training, quality assurance, compliance)

    • Key requirements:

  • Verbal notification at the start of the call is sufficient
  • Written privacy policy must explain how recordings are used
  • Recordings must be stored within the EU/EEA or in countries with adequate data protection
  • Retention period should be defined and documented (typically 6-12 months for sales calls)

    • Data Protection Authority: Andmekaitse Inspektsioon (AKI)

    Call Recording Laws in Latvia

    Consent type: One-party consent with clear notification.

    Latvia's Personal Data Processing Law (in force since 2019) and Electronic Communications Law require:

  • At least one party consents to the recording
  • The other party is informed before or at the start of the recording
  • The purpose of recording is clearly stated

    • Key requirements:

  • Automated notification (beep tone or verbal message) is acceptable
  • Data processing agreement required if using third-party recording tools
  • The Data State Inspectorate (Datu valsts inspekcija) oversees compliance
  • Cross-border data transfers must follow standard GDPR adequacy rules

    • Special note: Latvia's implementation emphasizes the need for a clear and specific purpose statement. "Quality assurance" alone may not be sufficient — specify "sales training and performance improvement."

    Data Protection Authority: Datu valsts inspekcija (DVI)

    Call Recording Laws in Lithuania

    Consent type: One-party consent with prior notification.

    Lithuania's Law on Legal Protection of Personal Data and Electronic Communications Law require:

  • One-party consent plus notification to all parties
  • Documentation of the lawful basis for recording

    • Key requirements:

  • Notification must happen before the recording starts (not during)
  • The notification must include who is recording and why
  • Businesses must maintain a record of processing activities (ROPA) that includes call recording
  • The State Data Protection Inspectorate (Valstybine duomenu apsaugos inspekcija) can audit your recording practices

    • Special note: Lithuania has been more active than Estonia or Latvia in GDPR enforcement. Ensure your privacy policy is available in Lithuanian if you're recording calls with Lithuanian nationals.

    Data Protection Authority: Valstybine duomenu apsaugos inspekcija (VDAI)

    Call Recording Laws in Finland

    Consent type: One-party consent (with caveats).

    Finland's Data Protection Act (tietosuojalaki) and Information Society Code govern call recording. Finland is notably more permissive than other Nordics:

  • One-party consent is generally sufficient for business calls
  • The recording party must have a legitimate purpose
  • Notification is strongly recommended but not always legally required for one-party consent

    • Key requirements:

  • Despite permissive rules, best practice is always to notify — Finnish courts have shown less sympathy for surprise recordings
  • Employee monitoring laws apply if recording your own reps — works council notification required
  • Finnish DPA (Tietosuojavaltuutetun toimisto) has issued specific guidance on workplace recording

    • Special note: Finland's strong employee data protection rules mean you need separate consent frameworks for recording your own team vs. recording prospects.

    Data Protection Authority: Tietosuojavaltuutetun toimisto

    Call Recording Laws in Sweden

    Consent type: One-party consent with notification recommended.

    Sweden's Data Protection Act (dataskyddslag) and its GDPR implementation apply:

  • One-party consent is legally sufficient
  • Notification is considered best practice but not strictly required in all contexts
  • The Swedish Authority for Privacy Protection (IMY) has issued guidance on legitimate interest as a basis for recording business calls

    • Key requirements:

  • Privacy impact assessment recommended for systematic recording of sales calls
  • If recording employees, the employer must consult with unions (common in Swedish workplaces)
  • Recordings containing personal data must be logged in your ROPA
  • IMY has actively enforced GDPR violations with significant fines

    • Data Protection Authority: Integritetsskyddsmyndigheten (IMY)

    Call Recording Laws in Norway

    Consent type: One-party consent, but with strict transparency rules.

    Norway, while not in the EU, is part of the EEA and follows GDPR through its Personal Data Act (personopplysningsloven):

  • One-party consent allows recording
  • The Norwegian DPA (Datatilsynet) strongly recommends notifying all parties
  • Covert recording without any party's knowledge is illegal outside law enforcement

    • Key requirements:

  • Norway's Datatilsynet has been one of the more aggressive European DPAs in enforcement
  • Privacy notices must be available in Norwegian if recording calls with Norwegian speakers
  • Cross-border data transfers to non-EEA countries require additional safeguards

    • Data Protection Authority: Datatilsynet

    Call Recording Laws in Denmark

    Consent type: One-party consent with notification requirements.

    Denmark's Data Protection Act (databeskyttelsesloven) and Marketing Practices Act together govern call recording:

  • One-party consent is sufficient for business calls
  • Notification is required before recording begins
  • Marketing-related calls have additional disclosure requirements

    • Key requirements:

  • Denmark has specific rules about using recordings for marketing purposes — separate consent may be required
  • The Danish DPA (Datatilsynet) requires clear documentation of purpose and legal basis
  • Employee monitoring requires prior notification and consultation

    • Data Protection Authority: Datatilsynet (Danish)

    Why Consistent Recording Makes Compliance Easier

    Here's a counterintuitive insight: recording and analyzing 100% of calls is actually better for compliance than selective recording.

    When you record all calls consistently:

  • Your notification process is uniform — every call gets the same disclosure
  • Your retention policies are consistent — no confusion about which calls are kept and which aren't
  • Auditors see a systematic, documented process rather than ad-hoc decisions about what to record
  • You can demonstrate you're using recordings for their stated purpose (training, quality) with concrete evidence

    • Selective recording raises more compliance questions: Why this call and not that one? How do you decide? Is there bias in your selection?

    Practical Compliance Checklist

    Before You Start Recording

  • ☐Define your lawful basis for recording (legitimate interest is most common for B2B sales)
  • ☐Create a Legitimate Interest Assessment (LIA) documenting why recording is necessary
  • ☐Update your privacy policy to cover call recording — include purpose, retention period, and data subject rights
  • ☐Prepare notification scripts in each language your team uses
  • ☐Ensure your recording tool stores data within the EU/EEA
  • ☐Add call recording to your Record of Processing Activities (ROPA)

    • During Every Call

  • ☐Notify the other party before recording starts
  • ☐State the purpose clearly ("for quality assurance and training purposes")
  • ☐Offer the option to decline being recorded (and have a process for unrecorded calls)
  • ☐Ensure the notification is in a language the other party understands

    • After the Call

  • ☐Store recordings securely with access controls
  • ☐Enforce your retention policy (auto-delete after defined period)
  • ☐Be prepared to fulfill access or deletion requests within 30 days
  • ☐Regularly audit who has access to recordings

    • How Teneks Helps With Compliance

    Teneks was built in Tallinn, Estonia — at the intersection of Baltic and Nordic markets. Compliance is built into the platform:

  • Automatic recording notifications in 100+ languages
  • EU-based data storage with no cross-border transfers outside the EEA
  • Configurable retention policies with automatic deletion
  • Audit logs for every recording access
  • Data subject request handling built into the admin panel
  • Consistent processing — every call gets the same treatment, which is exactly what regulators want to see

    • Most importantly, Teneks can provide real-time coaching and call scoring without permanently storing full recordings — reducing your data protection exposure while still getting the sales intelligence value.

    The Bottom Line

    Call recording across Baltic and Nordic markets is legal in all seven countries covered here, provided you follow the rules. The key principles are universal: notify, document your purpose, store securely, and delete when no longer needed.

    The biggest mistake teams make isn't recording illegally — it's not having documented processes. When a data protection authority audits your practice, they want to see that you've thought about it, documented it, and built safeguards. Having the right tool — one that processes calls consistently and maintains audit trails automatically — makes compliance a feature, not a burden.

    Written by Arne Niitsoo

    Arne is the founder of Teneks, an AI sales coaching platform built in Tallinn, Estonia. He works daily with sales teams across the Nordics and Baltics on call coaching, conversation intelligence, and recording compliance — and writes from what he sees in real calls, not theory.

    More from the blog

    Sales Intelligence

    Why You Should Review 100% of Your Sales Calls, Not 3%

    Sales Intelligence

    Real-Time Sales Coaching vs Post-Call Analysis

    AI & Sales

    Handle Sales Objections With AI in Real Time