GDPR Data processing modelUse of telephone exchanges in the workplace

Organisation: PrivateOrganisation: PublicFunction: General services

This processing model relates to the management of an internal messaging system as well as the internal telephone directory and also to the reimbursement of the cost of personal telephone calls as well as the control of telephone expenses

Purposes (4)

A purpose is the objective pursued by the setting up of your file. It indicates what the processing of personal data will be used for, its purpose. This purpose must be clear and understandable

Reimbursement of the cost of personal telephone calls

- the drawing up of documents intended for the recovery of the corresponding sums; - in the event of a dispute, the drawing up of documents indicating the characteristics of the communication(s) for which reimbursement of the cost is claimed.

Legitimate interest

Art. 6(1)(f) UK GDPR – legitimate interests of the employer in recovering the cost of personal calls made from workplace telephones. Where the employer is a public authority, rely on Art. 6(1)(e) (public task) instead.

Controlling telephone costs

- drawing up and publishing statements of telephone communications, including item by item;- calculating the cost of telephone communications, including item by item;- drawing up statistics.

Legitimate interest

Management of an internal messaging system

Legitimate interest

Internal telephone directory management

Creation, publication and distribution of nominative lists of telephone service users

Legitimate interest

Data categories (3)

Personal data is any information relating to an identified or identifiable natural person. A natural person can be identified either directly (eg surname and first name) or indirectly (eg phone number, social security number, email or postal address, but also voice or image)

Telephone communication

Data details

Cost of communicationrequired

Number of taxesrequired

Call start and end date and timerequired

Call durationrequired

Nature of callrequired

Called phone numberrequired

Data conservation rules

Active base:

No statutory period applies to an employer's call logging. Call records identifying a user (number called, date, time, duration, cost) should be kept only for as long as needed to check telephone costs and recover the cost of personal calls; the controller should set a short period based on its telecoms billing cycle (for example up to 6 months from the call) and document it, in line with Information Commission (ICO) guidance on monitoring workers. The last digits of numbers called may be masked in statements.

Information Commission (ICO) guidance on monitoring workers

Destruction

Professional situation

Data details

Professional e-mail addressrequired

Professional addressrequired

Servicerequired

Job function required

Data conservation rules

Active base:

For as long as the person holds a telephone line or extension. Call records: see the 'Telephone communication' rule (no statutory period; short period set by the controller). Records of amounts recovered from employees for personal calls are kept with financial records: 6 years for contractual claims (Limitation Act 1980, s.5); where recovered through payroll, payroll records must be kept for 3 years from the end of the tax year they relate to (HMRC).

Limitation Act 1980, s.5; HMRC payroll record-keeping requirements

Destruction

Station user identity

Data details

Item numberrequired

Name and surnamerequired

Data conservation rules

Active base:

For as long as the person is assigned a line or extension; removed from the internal directory when they leave. No statutory period applies to an employer's call logging. Call records identifying a user (number called, date, time, duration, cost) should be kept only for as long as needed to check telephone costs and recover the cost of personal calls; the controller should set a short period based on its telecoms billing cycle (for example up to 6 months from the call) and document it, in line with Information Commission (ICO) guidance on monitoring workers. The last digits of numbers called may be masked in statements.

Information Commission (ICO) guidance on monitoring workers

Destruction

Data subject (1)

A data subject is any person whose data is collected, retained or processed by the data processing. e.g. In a recruitement process, any candidate for a position proposed in recruitement management process

Employees

Created at:07/08/2023

Updated on:10/05/2026

Nb using:15