Compliance Resource
PDPA and Call Recording
Recording a call captures personal data, which brings it within Singapore’s Personal Data Protection Act. This guide explains the obligations that most often apply, and the questions to put to your own advisers before you record anything.
The short answer
A call recording of an identifiable individual is personal data. Under the Personal Data Protection Act, an organisation that collects, uses or discloses personal data generally needs to notify the individual of the purposes and obtain consent, use the data only for those purposes, protect it, and stop retaining it once the purpose has ended.
In practice this means telling callers at the start that the call may be recorded and why, recording only where you have a genuine business purpose, restricting who can listen to the recordings, and setting a retention period rather than keeping everything indefinitely.
None of this is legal advice, and your obligations depend on your sector, your contracts and the circumstances of your business. Confirm your position with your own legal or data protection advisers, and check the current guidance published by the Personal Data Protection Commission. We describe how our service handles data and what you control; we do not certify that your business is compliant, and no supplier can.
Obligations that most affect recorded calls
The Act sets out a set of data protection obligations. These are the ones that come up most often when calls are recorded or transcribed.
| Obligation | What it means for calls | Practical step |
|---|---|---|
| Notification | Callers should be told the purposes for which their data is collected | State recording and its purpose in the opening seconds of the call |
| Consent | Collection generally requires consent for the notified purposes | Give callers a real option, and record how consent was obtained |
| Purpose limitation | Data may be used only for purposes a reasonable person would consider appropriate | Do not repurpose service recordings for marketing without addressing consent |
| Protection | Reasonable security arrangements must be in place | Restrict access, review it, and avoid copies in unmanaged locations |
| Retention limitation | Data should not be kept once the purpose has ended | Set and apply a retention schedule across every connected system |
| Access and correction | Individuals may request their data or ask for corrections | Know how to locate and produce a specific caller’s records |
| Accountability | Policies, practices and a named contact are expected | Appoint a data protection officer and document your handling practices |
There are additional obligations covering accuracy, transfers outside Singapore and data breach notification. The breach obligation is covered separately in our guidance on incident response for call data.
Decisions to make before you record
Recording is a choice, not a default. Each of these should have a documented answer.
Why you are recording
Quality review, dispute resolution, training and accuracy of booking details are common purposes. Write yours down, because the purpose determines what you may later do with the recording.
Recording or transcript
A structured summary or transcript often serves the business purpose with less personal data than full audio. Ask whether you need the recording itself or only the outcome.
What is captured
Collect only the fields your process genuinely needs. An identification number or medical detail captured out of habit becomes a liability you then have to protect.
Who can listen
Define the roles with access and review the list periodically. Our guidance on access control for call data covers how to structure this.
How long you keep it
Set a period tied to the purpose, and apply it everywhere the data travels, including your CRM and any middleware in the chain.
Who processes it for you
Suppliers processing personal data on your behalf carry their own duties, and your contract should reflect that. See vendor due diligence questions.
Where automation changes the picture
An AI receptionist does not create a different legal regime, but it does change the volume and shape of what is captured. Calls that previously left no trace now produce a structured record, and that record may travel to a calendar, a CRM and an automation platform within seconds.
Three points deserve particular attention. Callers should understand they are speaking to an automated system. The data path should be documented end to end, including every intermediary. And deletion should be able to follow that same path, or your retention policy exists only on paper.
Some calls should not be handled by automation at all. Matters concerning an individual child, clinical triage or symptoms, security incidents, allergen confirmation, callers in distress, grievances and personal HR matters, and regulated legal, medical, financial or immigration advice are routed to a person immediately in every deployment we build. That boundary exists for the caller’s benefit, and it is not configurable.
Sector rules may also apply on top of the Act. Healthcare, legal, financial and education settings each carry professional or regulatory expectations about confidentiality that go beyond general data protection, and those should be checked with the relevant body or your professional advisers.
Review checklist
Work through this with whoever advises you on data protection. It is a prompt for that conversation rather than a compliance certificate.
- The purpose of recording is written down and is one a caller would find reasonable
- Callers are told about recording, and about the automated receptionist, before details are collected
- Only the data fields your process needs are captured
- Access to recordings, transcripts and enquiry records is restricted by role
- A retention period is set, applied and evidenced across every connected system
- You can locate and produce all records relating to one caller on request
- A data protection officer is appointed and contactable
- Supplier arrangements, including ours, are covered by written terms
- Your position has been reviewed by your own advisers, not only by a supplier
Frequently asked questions
Do we have to record calls at all?
No. Many businesses run an AI receptionist with structured transcripts or summaries and no stored audio. If the recording is not serving a defined purpose, not keeping it is usually the simpler position.
Is an announcement at the start of the call enough?
An announcement addresses notification, but whether it is sufficient in your circumstances is a question for your advisers. What matters practically is that the caller is told before their details are collected, in language they can understand, and that they have a route if they object.
What if a caller refuses to be recorded?
Decide the route in advance: continuing without recording, or transferring to a person. Handling an objection well is covered in consent and call notifications.
Can we use recordings to train staff?
That depends on whether training was among the purposes notified to the caller. If it was not, address the purpose limitation question before using the material that way.
Does the PDPA apply to business callers?
The Act concerns personal data about individuals. A call from a named person at another company still involves their personal data, even though the enquiry is commercial.
Can you confirm that our setup is PDPA compliant?
No, and we would be wary of any supplier that says otherwise. We can describe exactly what data our service handles, where it goes and what you control, which is what your advisers need in order to reach their own conclusion.
Related reading
The rest of the compliance series is in the AI receptionist resources library.
See exactly what a call captures
We will walk you through the data a single call produces, where each field goes, and what you can switch off, so your advisers have something concrete to review.