Compliance Resource
Data Retention for Call Recordings and Enquiry Records
Keeping call data forever is a decision, even when nobody makes it deliberately. This guide covers how to set a retention schedule, apply it across connected systems, and prove that deletion actually happened.
Why retention needs a decision
The Personal Data Protection Act expects organisations to stop retaining personal data once the purpose for collecting it has ended and retention is no longer necessary for legal or business purposes. Call recordings, transcripts and enquiry records all fall within that expectation.
The practical risk is simple. Data you no longer need still has to be protected, still appears in access requests, and still forms part of any incident. Deleting it on a schedule reduces all three.
Balance that against genuine reasons to keep records: unresolved disputes, warranty or service periods, tax and accounting requirements, and ongoing customer relationships. The right period depends on your sector and your advisers’ view, so this guide sets out the method rather than a number.
Not all call data is the same
One call can produce several artefacts, each with a different purpose and a different sensible lifespan. Treating them as one undifferentiated pile is what leads to keeping everything.
| Artefact | Typical purpose | Retention consideration |
|---|---|---|
| Audio recording | Dispute resolution and quality review | The most sensitive artefact and usually the shortest justified period |
| Transcript | Reviewing how an enquiry was handled | Contains the same content as the audio; delete on the same schedule unless there is a reason not to |
| Structured summary | Telling your team what the caller wanted | Often sufficient on its own, and easier to redact than audio |
| Enquiry or CRM record | Follow-up and customer relationship | Usually governed by your wider customer data policy rather than call policy |
| Calendar entry | Delivering the appointment | Retained according to your normal booking records practice |
| Call metadata | Volume reporting and performance measurement | Consider aggregating, so reporting survives without personal data |
Aggregation is the underused option. Most of the reporting described in measuring call handling performance works perfectly well on counts and durations, with no need to retain identifiable records.
Building a retention schedule
Five steps, in order. The mapping step is the one most often skipped, and the one that makes the rest work.
1. Map where the data goes
List every location a call record reaches: the call platform, your CRM, your calendar, any automation platform, email inboxes, messaging channels, exports and backups.
2. Assign a purpose to each artefact
If you cannot state the purpose, that is the artefact to stop keeping. Purpose drives the period, not the other way round.
3. Set a period per artefact
Agree periods with your advisers, taking account of sector requirements, dispute windows and any statutory record-keeping duties that apply to your business.
4. Automate deletion where possible
Manual deletion does not happen reliably. Where a system supports scheduled deletion, use it, and document the setting rather than the intention.
5. Review and evidence
Check periodically that deletion is occurring, including in exports and backups, and keep a record of the review. A schedule nobody verifies is a statement of hope.
Where deletion usually fails
Copies in inboxes
Enquiry notifications sent by email persist long after the source record is deleted. Decide whether notifications should carry full details or only a link.
Messaging channels
Call summaries forwarded to a team chat or a personal messaging app sit outside any retention schedule and outside your access controls.
Spreadsheet exports
An export taken for a monthly report becomes a permanent copy on someone’s drive. Set a rule for exports at the same time as the schedule itself.
Middleware logs
Automation platforms often retain a history of the data they passed. Check their retention settings as part of integration planning.
Backups
Deleted records commonly survive in backups. Understand your backup cycle and be able to explain how deletion interacts with it.
Departed staff
Records held in an individual account can outlive the individual’s employment. Offboarding should include the call data they held, as covered in access control for call data.
Retention checklist
- Every location holding call data is listed, including exports and backups
- Each artefact has a stated purpose and an agreed retention period
- Periods have been reviewed by your own advisers against sector requirements
- Deletion is scheduled automatically wherever the system allows it
- Notification emails and chat messages are covered by the schedule
- A named person owns the periodic verification and records the result
- Deletion requests from individuals can be traced through every system
- Records subject to a dispute or legal hold are identified and excluded deliberately
- Reporting relies on aggregated data wherever identifiable records are unnecessary
Write down the exceptions. Any record kept beyond the normal period should have a documented reason and an owner who reviews it. Undocumented exceptions are how retention schedules quietly stop being true.
Frequently asked questions
How long should we keep call recordings?
There is no single answer, and we will not invent one. The period should follow from the purpose you have documented and any sector or statutory requirements, agreed with your own advisers.
Can we keep transcripts but delete the audio?
Many businesses do, since the transcript usually serves the business purpose with less sensitive material. Remember that a transcript still contains personal data and needs its own period.
What if a caller asks us to delete their data?
Route the request to your data protection officer and follow it through every connected system. If deletion cannot propagate, that is a design problem worth fixing before it is tested by a real request.
Do we need to keep records to prove a booking was made?
Usually the calendar entry and enquiry record serve that purpose without retaining audio. Decide which artefact is your evidence and retain that one deliberately.
What happens to our data if we stop using the service?
Agree this before you start: what is returned, in what format, what is deleted and when. It is a standard question in vendor due diligence.
Does aggregated reporting count as personal data?
Aggregated counts that cannot be linked back to an individual are generally less sensitive, but the test is whether identification remains possible. Check the specifics with your advisers before treating a dataset as anonymous.
Related reading
Related data handling guides are indexed in the AI receptionist resources library.
Map where your call data would travel
We will show every place a single call leaves a record, so your retention schedule can be built on the actual data path rather than an assumption.