Call monitoring and GDPR: the rep's rights

The need is real on both sides. In State of Sales 2026, Salesforce found that 46 percent of Gen Z reps rarely get feedback on their sales conversations, and the quickest way to get feedback is to have someone listen in. But the rep is also an employee, and IMY takes a harder line on monitoring employees than most sales managers realise. This is an editorial walkthrough, not legal advice, and IMY's guidance on working life does not mention phone calls specifically; what follows is its general position on monitoring employees, applied to calls.

Two data subjects in every call

IMY defines personal data broadly: any information that can be linked, directly or indirectly, to a living person. The authority says explicitly that audio recordings of individuals, processed on a computer, can be personal data even when no names are mentioned. A recorded sales call therefore holds two sets of personal data. The customer's: name, company, needs, what was said. The rep's: voice, phrasing, how many objections were handled, how the call ended. The second set is the one coaching and evaluation draw on, and it is what makes the rep a data subject in their own employer's processing.

Why the rep's consent is not enough

The most common misconception is that a clause in the employment contract settles it. IMY is clear that it does not: in its view an employer cannot rely on consent as the legal basis for processing data to monitor employees, because the employee is in a position of dependence and cannot genuinely say no. What can carry monitoring instead is a balancing of interests, or, for public authorities, a task in the public interest. A collective agreement can also provide support, something Article 88 of the GDPR expressly allows: member states may lay down more specific rules on the processing of employees' data in law or in collective agreements.

Within that balancing of interests, IMY adds a rule of thumb that sales organisations will find uncomfortable: security reasons carry more weight than efficiency reasons. Listening to calls to detect fraud or protect customers stands on firmer ground than listening to push up the booking rate. Coaching is a legitimate interest, but it is an efficiency interest, and it has to be weighed against the rep's interest in not being watched all the time.

Where coaching ends and surveillance begins

IMY writes that all processing of employee data must be objectively justified by the specific business, proportionate and not excessive in relation to its purpose, and that employees should have no justified reason to feel they are under more or less constant watch. In concrete terms: as a rule, an employer may not use an IT system to monitor in real time, or otherwise routinely, how employees carry out their tasks. Measuring performance can be permitted in order to plan, organise, lead and follow up the work, as long as it is not done in a way that is unreasonable or offensive. And an employer should generally put more effort into prevention than into catching misconduct after the fact.

For a sales team, that means: listening to a sample of calls, with the rep's knowledge, in order to give feedback sits inside what is allowed. Letting a system listen to every call, score every rep in real time and alert the manager to deviations, as a rule, does not. IMY's 2021 decision against the fire and rescue service in Östra Skaraborg shows the logic: the authority accepted that the service had weighty reasons for its camera surveillance, but still required it to be limited to alarm situations, and issued an administrative fine of 350,000 kronor. A good purpose does not make unlimited monitoring proportionate.

Information in advance, and sometimes an impact assessment

According to IMY, employees have the right to clear information in advance about which checks may be carried out using the data the employer collects, and as a rule that information should be given no later than the point at which the data is collected. For call monitoring, that means a written policy before anyone listens to the first call: which calls, for what purpose, who listens, how long the recordings are kept and what they may be used for. IMY names systematic monitoring of employees' internet and email use as an example of processing that requires a data protection impact assessment. A system that continuously analyses every rep's calls sits close to that example, and anyone introducing one should do the assessment before, not after.

The Co-Determination Act: negotiate before you introduce monitoring

Data protection is not the only rulebook. IMY itself points out that there may be a duty to negotiate with the union under the Co-Determination Act (MBL). Under section 11 of the Act, an employer bound by a collective agreement must negotiate with the union, on its own initiative, before deciding on a significant change to its operations, and the same applies before decisions that significantly change working or employment conditions. Introducing systematic call monitoring or conversation analytics can be such a change; it is judged case by case. Under section 12 the union can also demand negotiation on other matters concerning its members, and under section 19 the employer must keep the union continuously informed about the guidelines for its personnel policy. Employers without a collective agreement have a duty to inform under section 19 a.

What a rep can demand

• Advance notice of which calls are monitored, for what purpose and by whom, before the monitoring starts.
• A legal basis that stands up to scrutiny: a documented balancing of interests or support in a collective agreement, not a consent clause.
• Proportionality: a sample rather than every call, feedback rather than real-time alerts, and a retention period for the recordings.
• Purpose limitation: coaching recordings must not resurface in a pay review or a dismissal unless that was the stated purpose from the start.
• Access and objection: the right to know what data exists and to object to processing that rests on a balancing of interests.

How to coach without surveillance

There is a way of working that satisfies both the rep's need for feedback and IMY's demand for proportionality. Let the rep pick which calls you listen to together. Listen to one call a week, not all of them. Decide beforehand which skill you are looking at, and write down one thing to change. Pair it with practice that involves no customer calls at all: in an AI roleplay there is no customer to protect, and the feedback goes straight from the AI to the rep.

Practice data is personal data about the rep too, so the same openness applies. In Salesprep the raw audio from practice calls is deleted as soon as it has been scored, transcripts and scores stay in the rep's own history, and on the team plans the sales manager sees scores and trends in an admin dashboard; tell the team what the manager can see before you start. The Cold call module is included in every plan with three free calls, and the Follow-up module is available on Pro and up. A rep who gets feedback on ten practice calls a week does not need a manager listening in on ten real ones.