How long should you keep call recordings?

Not legal advice. This is a plain summary of public guidance, checked on 15 October 2026. Check the rules for your own business with a lawyer.

Is there a legal time limit for keeping call recordings?

Usually not one fixed number. The GDPR's "storage limitation" principle says personal data must be kept "for no longer than is necessary for the purposes for which the personal data are processed" (GDPR Article 5(1)(e), gdpr-info.eu, 2016).

The UK regulator puts it plainly: "The UK GDPR does not set specific time limits for different types of data. This is up to you, and will depend on how long you need the data for your specified purposes" (ICO, as of 15 Oct 2026). The ICO marks that page as under review after the Data (Use and Access) Act, so check it again before you rely on it.

So the real question is: what do you need the recordings for, and for how long?

How do you decide how long to keep them?

Start from the reason you record. Different reasons need different periods.

Why you keep the recording	Question to ask	What it suggests
Coaching and quality scoring	How long after a call does a manager still use it?	Often weeks, not years. Keep the score and notes, drop the audio.
Settling a dispute	How long can a customer realistically complain about a sale?	Match your complaint or refund window.
A rule for your sector	Does a regulator set a minimum?	Follow the rule, and only for the calls it covers.
Training examples	Do you need this exact call, or just the lesson?	Keep a short, approved set, with clear consent and notice.

The ICO says you should "establish and document standard retention periods for different categories of information you hold wherever possible", usually in a retention policy or schedule. Even without a formal policy, you "must still regularly review the data you hold, and delete or anonymise anything you no longer need" (ICO, as of 15 Oct 2026).

Do some businesses have to keep calls longer?

Yes. Some regulated firms have a minimum. For example, the UK Financial Conduct Authority's rule SYSC 10A.1.14R says firms covered by that chapter must keep recorded calls "for a period of five years and, where requested by the FCA, for a period of up to seven years" (FCA Handbook, 3 Jan 2018). That rule only covers certain investment firms and certain calls, so it is not a general rule for sales calls.

The PCI Security Standards Council also notes that "local laws or regulation may require call recordings to be retained for a number of years", and says such rules should go into your retention policy (PCI SSC, Protecting Telephone-Based Payment Card Data, v3.0, Nov 2018).

What about calls where customers read out card details?

This is the one hard line. PCI DSS does not allow card security codes (CVV2, CVC2 and similar) to be stored after a payment is authorised, even if encrypted. The PCI SSC says storing those codes "in any form of digital audio recording—for example, .wav or .mp3 files—after authorization is therefore a violation" (PCI SSC FAQ 1210, Jun 2025).

The same FAQ says to stop the codes being recorded in the first place: "Where technology exists to suppress or redact audio during data entry, it should be enabled." If that isn't possible, the codes should be securely deleted right after authorisation. It also says PCI DSS "does not override local or regional audio retention laws" (PCI SSC FAQ 1210, Jun 2025).

Do you need the audio, or just the score?

For coaching, the score, the notes and a short quote from the call usually do the job long after the call. The audio is the heaviest and most sensitive part. Keeping the scores while deleting audio sooner is one way to meet the storage limitation principle without losing your coaching history.

For example, Callyst deletes audio 30 days after scoring, and deletes everything within 30 days of a customer cancelling (see the FAQ on our home page).

What should a simple retention policy say?

1. 1

   List why you record

   Coaching, quality, disputes, any rule for your sector.

2. 2

   Set a period for each reason

   Pick the shortest period that still does the job, and write it down.

3. 3

   Keep card codes out

   Suppress or redact the audio while card details are given. Securely delete any codes that slip through right after authorisation.

4. 4

   Delete on a schedule

   Make deletion automatic. A period nobody enforces is not a period.

5. 5

   Tell people

   Put the period, or how you decide it, in your privacy notice.

For the earlier step of recording at all, see is it legal to record and score sales calls.