How Long Should You Keep Recorded Business Calls?
There's no single legal time limit for how long a business must keep call recordings. GDPR requires that recordings are kept no longer than necessary for the purpose they were made for, which means the right retention period depends on why you're recording in the first place, not a fixed number that applies to every business. In practice, most businesses settle on somewhere between 30 days and 12 months for general purposes, while FCA-regulated financial services firms are required to retain specified call recordings for a minimum of five years.
Why There's No Single Right Answer
GDPR's storage limitation principle is built around purpose, not a fixed calendar figure. A recording kept for staff training doesn't need the same retention period as one kept to resolve a contractual dispute, so applying one blanket policy across every type of call is rarely the right approach. The important thing isn't picking the "correct" number of days — it's being able to justify whatever period you choose, documenting it, and actually enforcing it through automatic deletion rather than letting recordings pile up indefinitely.
Typical Retention Periods by Purpose
| Purpose | Typical retention period |
|---|---|
| General quality assurance and staff training | 30–90 days |
| Sales calls and order verification | 6–12 months |
| Customer complaints and dispute resolution | 6–12 months, or until resolved |
| FCA-regulated financial services communications | 5–7 years (mandatory minimum under SYSC 10A / MiFID II) |
These figures are indicative starting points, not fixed rules — what matters under GDPR is that whatever period you choose is documented and genuinely tied to a stated purpose.
Why Financial Services Is Different
FCA-regulated firms operate under a separate, stricter requirement. Under the FCA's SYSC 10A rules, which implement MiFID II in the UK, firms carrying out specified investment-related activities must record relevant telephone conversations and retain them for a minimum of five years, extendable to seven years if the FCA requests it. This obligation exists alongside GDPR rather than instead of it, and it specifically overrides the general "keep only as long as necessary" principle for the call types it covers.
What Happens When a Retention Period Expires?
Recordings should be deleted automatically once their retention period ends, rather than relying on someone remembering to do it manually. Most modern phone systems and call recording platforms support automatic deletion rules, which is worth configuring properly from the outset — a default setting that was never actually applied is one of the more common GDPR gaps businesses discover only when something goes wrong.
What If There's an Ongoing Dispute or Legal Requirement?
Retention periods aren't absolute if a specific recording becomes relevant to an active dispute, investigation, or legal proceeding. In these cases, it's reasonable — and often necessary — to retain that specific recording beyond its normal retention period until the matter's resolved, provided this is handled as a deliberate exception rather than a reason to abandon retention policy altogether.
Frequently Asked Questions
Can I just keep every call recording indefinitely to be safe? No. Keeping recordings longer than necessary is itself a GDPR compliance issue, not a safer default — storage limitation is one of the core principles businesses are expected to follow.
Does the retention period start from the call date or from when an issue is resolved? This depends on the purpose. Straightforward quality assurance recordings typically count from the call date itself, while dispute-related recordings are often more reasonably retained until the matter is closed, then deleted after a defined period.
Do different call types need different retention periods within the same business? Yes, and this is common. A business might keep general customer service calls for 90 days while retaining sales calls related to contracts for 12 months, provided each period is documented and justified.
What happens if my retention period is challenged by a regulator or in a dispute? Having a documented, purpose-based retention policy — rather than an arbitrary figure — is what demonstrates compliance if it's ever questioned.
A clear, automatically enforced retention policy is one of the simplest GDPR wins available. Request a quote if you'd like T2K to help configure retention settings correctly, or read our guide to GDPR and call recording for the wider compliance picture.
