Call-centre consent requirements across the GCC: scripts, IVR placement, and the rules behind them

Do you need consent to record calls in the GCC?

You need a lawful basis, and in practice you need disclosure. The GCC data-protection laws — the Saudi PDPL (Royal Decree M/19 of 2021, amended by M/148 of 2023), the UAE federal PDPL (Federal Decree-Law 45 of 2021), the DIFC and ADGM regimes, Qatar's Law 13 of 2016, Bahrain's Law 30 of 2018, and Oman's Royal Decree 6/2022 — all treat an identifiable voice recording as personal data requiring a lawful basis. Consent is the default basis in most of these laws, with contractual necessity and (narrowly) legitimate interest available in some.

For quality-assurance and dispute-resolution recording, the universal operational pattern is notification-backed: the caller hears a clear disclosure before recording-relevant content begins, and continuing the call evidences awareness. Telecom regulators reinforce this — the UAE TDRA requires operators to record key customer-care interactions, and the Saudi CST requires customer notification at the start of recorded calls on licensed services. Where the purpose extends beyond QA and disputes (AI model training, marketing analytics, biometric voiceprints), the notification-backed pattern gets thinner and explicit consent or counsel-reviewed alternative bases become the safer route.

What should the recording disclosure actually say? Arabic and English scripts

Keep it short, name the fact and the purpose, and play it before the agent connects. These are field-standard starting scripts — adapt the purpose clause to what you actually do, and have counsel sign off the final wording for regulated traffic.

• Arabic (standard QA): ‫«هذه المكالمة مسجلة لغرض الجودة والتدريب.»‬ — "This call is recorded for quality and training purposes."
• Arabic (fuller version): ‫«نحيطكم علماً بأن هذه المكالمة قد يتم تسجيلها لأغراض الجودة والتدريب وحماية حقوق الطرفين.»‬ — "Please note this call may be recorded for quality, training, and the protection of both parties' rights."
• English (standard QA): "This call may be recorded for quality and training purposes."
• English (fuller version): "This call may be recorded for quality assurance, training, and dispute-resolution purposes. For details, see our privacy policy at [URL]."
• Bilingual order: play Arabic first in KSA and Arabic-majority queues; in UAE multilingual queues, Arabic then English is the standard sequence, with language-selection IVR branches carrying their own-language disclosure
• Outbound calls: the agent or dialer message delivers the same disclosure verbally at the start — "هذه المكالمة مسجلة" / "this call is recorded" — before the substantive conversation

One-party vs all-party: how the six states differ

Teams arriving from US compliance frameworks ask which GCC states are "one-party consent." The framing does not transfer. US wiretap law asks whose consent legalises an interception; GCC regimes ask whether the processing of personal data has a lawful basis and whether the data subject was informed — and separately, several GCC states treat covert recording of private conversations as a serious legal risk under privacy and penal provisions. The practical consequence is that silent recording relying on "one party (us) consented" is not a defensible posture anywhere in the GCC.

The differences between the six states are of texture, not direction. Saudi Arabia and the UAE have the most developed enforcement machinery (SDAIA since September 2024; the UAE Data Office plus the DIFC and ADGM commissioners) and the most explicit sector overlays. Qatar, Bahrain, and Oman have statutes in force with maturing enforcement; Kuwait regulates primarily through CITRA's telecom and cloud framework rather than a single comprehensive statute. Where a nuance might matter to you — for instance, recording internal employee calls, or recording counterparties in another GCC state — that is precisely the situation to put to counsel rather than to resolve from a comparison table. The all-participant disclosure pattern is compliant everywhere and costs nothing, which is why it is the regional standard.

Where in the IVR should the recording notice sit?

Placement rules of thumb that survive audits: the disclosure must complete before any recorded substantive content — which in practice means before queue music if you record from call answer, or gated so recording starts only after the notice plays. Put it after language selection so each caller hears it in their chosen language, and before menu trees so abandoning callers still heard it. Do not bury it after promotional messages; regulators and courts read a disclosure the caller plausibly never reached as no disclosure.

Three operational details get missed. Transfers: if a call transfers into a recorded queue from an unrecorded one, the recorded leg needs its own notice — agent scripts should cover warm transfers. Callbacks: an outbound callback is a new call needing its own disclosure, not an extension of the inbound one. Verification: keep IVR change logs and a periodic recorded test call as evidence that the notice was actually playing during the period a disputed call occurred — CallScribe customers automate this with a disclosure-detection rule that flags any call where the standard phrase is missing from the first 30 seconds, turning notice verification from an assumption into a per-call check.

What about retention notices and privacy policies?

The IVR notice is the short form of a longer disclosure that lives in your privacy policy. GCC data-protection laws give data subjects rights — access, rectification, erasure — and expect controllers to tell people how long data is kept and how to exercise those rights. The privacy policy should state what is recorded, the purposes, the retention period per category (for example, one year for general support calls, six or more years for regulated financial calls under DFSA COB 3.4.6 or SAMA-aligned windows), where processing occurs, which processors are involved, and the contact channel for data-subject requests.

Keep the IVR script and the policy consistent: if the notice says "quality and training" but the policy says the recordings also feed marketing analytics, the mismatch is the finding. And make the retention notice true in the system, not just the policy — automated deletion at the end of each category's window is what turns the stated retention period from a promise into a control. A caller's erasure request should be executable against both recordings and transcripts through one workflow.

GCC recording-consent checklist

The condensed version for an operations team standing up or auditing recorded queues across GCC markets.

• Disclosure plays before recording of substantive content, in every queue language, on every recorded line — inbound and outbound
• Script names the purposes actually pursued; secondary purposes (AI training, analytics beyond QA) reviewed with counsel
• All participants hear the notice — no silent or one-party recording anywhere in the GCC estate
• Transfer and callback legs carry their own disclosure
• IVR change log plus periodic test calls retained as evidence the notice was live; automated disclosure-detection on recorded calls where available
• Privacy policy states recording purposes, per-category retention, processing locations, processors, and the data-subject request channel — and matches the IVR script
• Lawful basis documented per call category in the record of processing activities, per the applicable state law
• Erasure workflow tested against both recordings and transcripts