Call recording gets enabled because it is a checkbox and because someone asked for it after a dispute. It records everything, retains it indefinitely because storage is cheap, and nobody revisits the decision.
The reasoning behind that — keeping more is the cautious option — is inverted. A recording you hold is data you are responsible for, that can be requested, subpoenaed or stolen, and that may contain material you are not permitted to retain at all.
The obligations differ by jurisdiction and this article does not attempt to state the law for yours. What it does cover is the part that is the same everywhere: the engineering and process controls that make recording defensible, and one specific rule that catches almost every business taking card payments by phone.
The rule that catches nearly everyone
If your business takes card payments over the phone and records calls, there is a specific and unambiguous requirement that is very commonly breached without anyone realising.
PCI DSS treats the card verification code — the three or four digit number referred to as CAV2, CVC2, CVV2 or CID depending on the brand — as sensitive authentication data, and prohibits storing it after authorisation even in encrypted form. The Council is explicit that this applies to audio: storing card validation codes or values in any form of digital audio recording, such as a WAV or MP3 file, after authorisation violates that requirement.
The practical consequence is severe and immediate. An agent reads the security code aloud, or the customer says it while the recording is running, and the resulting file is non-compliant from the moment it is written. Encrypting the file does not resolve it. Restricting access does not resolve it. The data must not be there.
- 1
Pause recording during card entry
Where the platform supports suppressing or redacting audio while payment data is entered, enable it. This is the answer the Council points to first.
- 2
Better: take the payment out of the audio path entirely
Keypad entry that never reaches the agent or the recording, or a payment link sent during the call. If the number is never spoken, there is nothing to suppress and the problem does not exist.
- 3
If neither is possible, delete immediately
Where sensitive authentication data cannot be prevented from being recorded, it must be securely deleted as soon as the transaction is authorised. Immediately, not on the retention schedule.
- 4
Verify rather than assume
Pause-and-resume features fail quietly — a mis-timed pause, an agent who forgets, a transfer that resets the state. Sample real recordings and check.
One further point worth stating because businesses reach for it as a resolution: PCI DSS does not override local or regional audio retention laws. Where a regulator requires recordings to be retained, that requirement and this prohibition have to be reconciled by not capturing the data in the first place, not by choosing which rule to follow.
Why retaining everything forever is the risky choice
Recordings are unusually dense personal data. A call may contain a name, an address, a date of birth, account details, health information volunteered in passing, and the speaker's voice — which is itself identifying.
- Every recording retained is data that can be requested by the person recorded, in jurisdictions with subject access rights, and finding all recordings of one individual across years of audio is an expensive exercise if nothing was designed for it.
- Every recording retained is data that can be compelled in litigation, including recordings you would rather not produce.
- Every recording retained is data that can be stolen. A recording archive is an unusually attractive target precisely because of what it contains.
- Storage cost is the least of it, which is why the storage-is-cheap argument leads businesses to the wrong conclusion.
The defensible position is a stated retention period, derived from why the recordings are kept, applied automatically. If the purpose is dispute resolution, the period is however long disputes realistically arise within. If it is quality monitoring, a sample retained briefly serves better than everything retained indefinitely.
Automatic deletion is the part that matters. A retention policy nobody enforces is a document describing what should have happened, and it is worse than having none, because it demonstrates awareness of an obligation that was not met.
The controls that make recording defensible
| Control | Addresses |
|---|---|
| Notification at call start | Transparency obligations in most jurisdictions |
| A stated, purpose-derived retention period | Holding data longer than the reason for holding it |
| Automatic deletion at expiry | The policy that exists on paper only |
| Encryption at rest | The archive as a theft target |
| Access control and access logging | Who listened to what, and whether that was legitimate |
| Suppression during payment entry | The PCI DSS requirement above |
| A documented retrieval process | Subject access and litigation requests, cheaply |
| Recordings excluded from general backup sprawl | Copies outliving the deletion policy |
The last row is the one most often missed. Recordings deleted from the recording system but present in six months of backups have not been deleted. Backup retention and recording retention have to be reconciled deliberately, and for most businesses that means recordings are backed up on their own schedule rather than inside the general estate backup.
Access logging deserves its own emphasis. Recording archives are routinely readable by anyone with access to the telephony platform, which usually means every administrator and often the whole support team. Who can listen to a customer's call should be a deliberate, short list, and who did listen should be recorded.
Getting this into a sensible state
- 1
Establish why you record
Dispute resolution, quality monitoring, regulatory requirement, training. Different purposes justify different retention, and if no purpose can be stated, the honest conclusion is that recording should stop.
- 2
Find out how long you actually hold recordings
Not the policy — the reality, including archives, backups and anything an administrator copied somewhere convenient.
- 3
Check whether card data is in the archive
If you take payments by phone and record, assume it is until you have verified otherwise by sampling.
- 4
Confirm the notification actually plays
On every route, including transfers, callbacks and out-of-hours paths. A notification on the main number and not on the direct dials is a partial control.
- 5
Set retention and automate deletion
Then verify a recording past the period is genuinely gone, from the platform and from backups.
- 6
Restrict and log access
Reduce the list of people who can listen, and record who does.
- 7
Write down the retrieval process
Before the first request arrives, because doing this under a statutory deadline is where the cost is.
Can call recordings contain card security codes?
No. PCI DSS treats the card verification code — CAV2, CVC2, CVV2 or CID — as sensitive authentication data that must not be stored after authorisation, even in encrypted form, and the Council states explicitly that storing it in any digital audio recording such as a WAV or MP3 file violates that requirement. Encryption and access restriction do not resolve it; the data must not be present. Where it cannot be prevented from being recorded, it must be securely deleted immediately upon authorisation rather than on the normal retention schedule.
How long should call recordings be kept?
For as long as the stated purpose for recording requires, and no longer. Recordings are unusually dense personal data — they can contain names, addresses, account details, information volunteered in passing, and the identifying voice itself — so every recording retained is data that can be requested, compelled in litigation, or stolen. The period should be derived from the purpose, applied automatically, and verified against backups as well as the recording platform.
Do we need consent to record calls?
This varies substantially by jurisdiction and in some countries between states or provinces, with some requiring all parties to consent and others one. It is a legal question rather than a technical one and the position should be established in writing for every place the business operates. What is consistent everywhere is the engineering obligation: whatever notification is required must actually play on every route, including transfers, callbacks and out-of-hours paths.
Does deleting recordings from the phone system mean they are deleted?
Only if the backups have been reconciled with the retention policy. Recordings removed from the recording platform but present in months of general estate backups have not been deleted, and this is the most commonly missed control. For most businesses it means recordings need their own backup schedule rather than being swept into the general one.
Does PCI DSS override a legal requirement to retain recordings?
No. PCI DSS does not override local or regional audio retention laws. Where a regulator requires recordings to be retained and PCI DSS prohibits retaining the card verification code within them, the two are reconciled by ensuring the code is never captured — through suppression during payment entry, or by removing the payment from the audio path entirely — rather than by choosing which requirement to follow.
Sources and further reading
- Data retention and archiving for growing businesses— the retention reasoning this applies to a specific data type
- VoIP security for business— protecting the platform the archive sits on
- Building reliable call centre infrastructure— where recording sits in the wider stack
- VICIdial in production— recording configuration on the platform this most often runs on
- Access control and offboarding— restricting who can listen, and revoking it
- A cybersecurity checklist for growing businesses— control 3, data protection, in its wider context
- PCI SSC: Protecting Telephone-based Payment Card Data— the information supplement covering recording, suppression and deletion
- PCI Security Standards Council document library— the standard itself and current supporting guidance
- ICO: lawful basis for processing— one regulator's guidance; find the equivalent for each jurisdiction you operate in
Services This Relates To
Written by KYCONNECTS Engineering. Client names are withheld under confidentiality.