How long can you keep call recordings under the GDPR?

The GDPR does not give a number of days, months or years for keeping call recordings. It gives a principle: keep them only as long as you need them for the purpose you recorded them for, and be able to explain that choice.

No fixed period in the GDPR

A call recording captures a person's voice and what they say, so it is personal data under the General Data Protection Regulation. The rule on how long you may keep it is the storage limitation principle in Article 5(1)(e): personal data must be kept in a form that identifies people for no longer than is necessary for the purposes of the processing.

The GDPR leaves the actual period to you, the controller. Under the accountability principle in Article 5(2), you must also be able to demonstrate that you comply. In practice that means a period you can justify, written down before you start recording, and actually applied.

You also have to tell people. Article 13(2)(a) requires you to inform them of the period for which the data will be stored, or, if that is not possible, the criteria used to determine that period. "As long as necessary" on its own does not meet that standard.

If you are still deciding whether and how to record at all, start with recording sales calls under the GDPR, which covers lawful bases and transparency.

Set the period per purpose, not per system

The most common mistake is one retention period for "call recordings" as a whole. The GDPR ties retention to purpose, and most teams record for more than one reason. Each purpose needs its own reasoning.

Questions to answer for each purpose

• Why do we keep this recording? Name the purpose precisely, for example "checking that agents read the cancellation terms" rather than "quality".
• When is the purpose fulfilled? A coaching session, the end of a complaint window, the closing of a file.
• Does a law require us to keep it? If so, which provision, and for how long.
• Do we need the audio, or is less enough? A transcript, a summary or the result of a check may serve the purpose once review is done.

Purposes and typical considerations

The table gives fixed periods only where a law sets one.

Document it in your records of processing

Article 30 of the GDPR requires a record of processing activities. Among other things it lists the purposes of the processing (Article 30(1)(b)) and, where possible, the envisaged time limits for erasure of the different categories of data (Article 30(1)(f)). Call recording is usually a regular activity, so the exemption for organisations with fewer than 250 employees in Article 30(5) generally does not apply to it.

A practical format is a deletion matrix: one row per purpose and data type, with the legal basis, the retention period and, where relevant, the law that requires it. The European Data Protection Board lists this kind of matrix as a best practice in its 2025 coordinated enforcement report on the right to erasure, and recommends that controllers specify in their records of processing any legal obligation to retain data for a certain period.

Treat recordings, transcripts and derived data separately. A summary or a check result is still personal data if it relates to an identifiable person, so it needs its own row and its own period.

Sector rules that set a minimum

Investment services: MiFID II

Some laws do require you to keep recordings. The clearest example in the EU is MiFID II. Article 16(7) requires investment firms to record telephone conversations and electronic communications relating to, at least, transactions concluded when dealing on own account and client orders. Those records must be provided to the client on request and kept for a period of five years and, where requested by the competent authority, for up to seven years.

This obligation applies to the calls in scope of MiFID II. It does not turn every call at an investment firm into a five year record. Calls outside the scope still follow the ordinary storage limitation principle.

Dutch tax record keeping is a different matter

Dutch businesses often know the seven year period in Article 52(4) of the Algemene wet inzake rijksbelastingen. That provision obliges businesses to keep their administration, the books and records relevant for taxation, for seven years. It is about financial and tax records. It does not say that conversations must be recorded, and it is not a general reason to keep every call recording for seven years. If you think a specific recording forms part of your administration, ask your tax or legal adviser before relying on it.

Deletion requests and Article 17

People can ask you to erase their personal data. Under Article 17(1), you must erase without undue delay when, for example, the data is no longer necessary for its purpose, the person successfully objects to processing, or the data was processed unlawfully. You must respond within one month of receiving the request, extendable by two further months for complex or numerous requests, as Article 12(3) sets out.

The right is not absolute. Article 17(3) lists exceptions, including where you must keep the data to comply with a legal obligation (17(3)(b)), such as the MiFID II requirement above, and where it is necessary for the establishment, exercise or defence of legal claims (17(3)(e)).

A workable process

1. Find every call with the person, using their number and name, and every derived item such as transcripts, notes and summaries.
2. Check each against your deletion matrix: is there a legal obligation or a specific claim that requires keeping it?
3. Delete what you have no reason to keep, and record which exception applies to anything you retain.
4. Tell the person what you did, and on what basis you kept anything.

Backups

Backups are where retention policies often fail quietly. In its 2025 report, the EDPB found that many controllers excluded backups from erasure requests by default, without justification, and had no specific procedure for them.

The EDPB accepts that modifying a backup is not always advisable, since backups protect against incidents such as ransomware. In that case, it expects you to keep track of erasure requests and apply them if a backup is ever restored. Its recommendations for controllers are to follow established standards for secure erasure, and to verify that erasure has been carried out and be able to demonstrate it.

For call recordings, that means knowing how long your backups are kept, writing that period into your deletion matrix, and keeping a log of erasure requests that is checked on every restore.

For a broader view of how recording fits into quality assurance and compliance, see VOIX for compliance and QA.

How VOIX helps

VOIX hosts call recordings, transcripts and analysis in the EU, and a data processing agreement is included on every plan. Your organisation stays the controller. Full-text search across calls, contacts and tasks helps you find what relates to a person when a request comes in. Roles and organisation and team scopes limit who can see calls in the first place. Read more on our security page.

This article is general information, not legal advice. Check the rules that apply to your organisation with your legal adviser or data protection officer.

New to a term? See the glossary.

VOIX for compliance and quality assuranceEvery call checked against your script and the rules.