Call centres: destroying recordings and customer data
A call centre or customer contact centre processes thousands of calls a day and the data that goes with them: call recordings, customer data, notes, scripts and quality assessments. Part falls under the tax retention obligation, but the call recordings are precisely a category that should be kept as briefly as possible. This guide shows, by type of data, what you keep, when it may go and how to destroy it confidentially.
The quick answer: the administration you keep for seven years for the tax retention obligation. Call recordings you keep as briefly as possible, tied to the purpose, and erase afterwards. Customer data and CRM data you keep as long as there is a purpose. What is on paper or on old data carriers you have destroyed confidentially with a certificate.
Why call recordings need extra care
A call recording is more sensitive than it seems. The voice is itself personal data, and the content of a call can contain anything: an address, a payment detail, a complaint and sometimes information about health or a financial situation. In a sales call or a collection call that happens regularly. That makes a recording not just an audio file, but a collection of personal data that requires care.
The GDPR requires storage limitation, and with recordings that weighs heavily. You keep them only as long as there is a concrete purpose, such as quality, training or proof of an agreement. As soon as that purpose has been served, the recording should be erased. Keeping just in case is not a valid ground.
Retention periods by type of data
The period depends on the type of data. The overview below gives the main line. Count the tax period from the end of the financial year and the other periods from the call or the settlement.
| Type of data | Starting point | Period |
|---|---|---|
| Administration and invoicing | Tax retention obligation | 7 years |
| Recording for quality or training | As briefly as possible | often a few months |
| Recording as proof of an agreement | Until settlement | purpose-bound |
| Customer data and CRM | As long as there is a purpose | clear out afterwards |
| Special data within a call | Extra protection | destroy finely |
| Notes, scripts and drafts | No retention obligation | clear out at once |
Use this as a guideline, not a final legal ruling. When in doubt about a specific case, consult your data protection officer or legal adviser. The tax side is in the 7-year tax retention obligation.
Erasing recordings and destroying carriers
For call recordings, erasing after the retention period is the standard. Make sure your system deletes recordings automatically as soon as their purpose has expired, so that no archive of years of calls is left behind. A recording you no longer need is only a risk.
If recordings are on physical carriers, or old equipment is freed up in a system migration, deleting a file is not enough, because the data stays on the disk. Have those carriers destroyed confidentially. The same applies to printed customer data, scripts with personal data and notes that lay by the phone.
The chain of customer contact
Call centres often work on behalf of other organisations, such as an energy company or an insurer. The customer data you process is then that client's, and you record the arrangements about keeping and destroying in a processor agreement. Match your periods to those arrangements. How the clients themselves handle their data is in energy and utilities: destroying customer data and insurers: destroying claim and policy files.
How to handle it in 6 steps
- Split the data into administration, recordings, customer data and loose notes.
- Set up erasure so recordings disappear automatically after their purpose.
- Assess customer data for purpose and the arrangements with the client.
- Clear out notes and scripts without a retention obligation confidentially at once.
- Collect paper and old carriers in sealed containers, not in the paper bin.
- Have it destroyed confidentially with a certificate and record it in your register.
Destroy confidentially with a certificate
Paper with customer data and old data carriers with recordings you have destroyed confidentially, because they contain personal data and sometimes special data. The material travels sealed and stays that way until destruction, so the chain is closed. Digital recordings you erase in the system, the carriers they were on go along for destruction.
Afterwards you receive a certificate of destruction with the date, quantity and level. That certificate is your proof towards the GDPR and your client that you acted carefully. Record the destruction in your record of processing. We collect within 20 km of Amsterdam with no call-out charge, work nationwide through pooled collection rounds and charge a fixed price per box or roll container. Drop-off on site is not possible; it works by appointment through collection.
Call centre data to be destroyed?
Tell us what you have and you get a fixed price. We collect it sealed, destroy it at the right DIN level and you receive a certificate for your GDPR file. No call-out charge within 20 km of Amsterdam.
Request a quoteCommon mistakes
- Keeping recordings indefinitely. A recording should be kept as briefly as possible and erased afterwards.
- Not seeing the voice as personal data. Both the voice and the content fall under the GDPR.
- Ignoring arrangements with the client. The processor agreement co-determines your periods.
- Disposing of old recording carriers unwiped. The data is still on them until they are destroyed.
- Keeping no proof. Without a certificate you cannot demonstrate the destruction.
Frequently asked questions
How long may a call centre keep call recordings?
As briefly as possible and tied to the purpose. For quality or training you often keep a recording for a few months, for proof of an agreement concluded by phone until it has been settled. After that the recording is erased.
Is a voice recording personal data?
Yes. The voice is personal data and the content of a call can contain special data, such as health or financial situation. So handle recordings carefully and do not keep them longer than necessary.
How long do I keep a call centre's customer administration?
Invoicing and administration fall under the seven-year tax retention obligation. Customer data and CRM data you keep as long as there is a purpose and clear out afterwards.
How do I destroy call centre data in line with the GDPR?
Erase recordings after the retention period and have paper and old data carriers destroyed confidentially with a certificate. The destruction is recorded in the record of processing.
Conclusion
A call centre processes calls that contain more than just an audio file, from the voice to sensitive content. Keep the administration seven years, keep call recordings as briefly as possible and erase them after their purpose, and match customer data to the arrangements with the client. Paper and old recording carriers you have destroyed confidentially with a certificate as proof. That way you keep nothing too long and stand with proof in hand in an audit or a client's query.
Read also: debt collection agencies: destroying debtor data, opticians and hearing care: destroying client files, insurers: destroying claim and policy files and the GDPR retention periods cheatsheet.
Have call centre data collected? Request a quote via desnipperaar.nl. Within a few minutes you have a fixed price, including a certificate as proof.