Call recordings: setting your retention policy, data item by data item

A call handled by a modern tool leaves several traces: the audio recording, its transcript, a possible summary, the contact details collected, the timestamp and the caller’s number. Each is personal data, which must have a defined purpose and an appropriate retention period.

So start with a list: what data is produced, where it is stored, what it is used for. A transcript used to process a customer’s request does not necessarily have the same purpose as the audio recording kept to train the team. The retention policy follows from these purposes.

In its framework on retention periods in human resources management, published on 2 April 2026 and updated on 20 May 2026, the CNIL states that call recordings made for training, service quality improvement or evaluation purposes are kept for 6 months at most from the date of recording. Only the analysis documents drawn up from this listening may be kept in intermediate archiving, for 1 year at most.

The same framework describes the practice that the CNIL presents, in its page on listening to calls at work, as good practice: “buffer” recordings, that is, listening to the recordings in the days that follow, drawing up the necessary analysis documents, then deleting the audio shortly afterwards. That page, which the CNIL flags as obsolete and being updated, already applied these periods, except where a text imposes a specific period or there is a particular justification.

Recording to prove that a contract was concluded is accepted by the CNIL, provided it is necessary: the organisation must show that it has no other means of proof, such as a written confirmation. Recording cannot be triggered by default for all calls: only the part of the conversation concerning the conclusion of the contract is covered.

As for the period, the 2026 framework provides for no retention in the active database and gives, for intermediate archiving, the example of the sale of a good or a service: 5 years from the time the existence of the contract became known, by reference to article 2224 of the French Civil Code (code civil). The CNIL specifies that this period depends on the nature of the contract, the ordinary limitation period being five years. The CNIL also recalls that when a professional canvasses a consumer by phone, the consumer is bound only after signing the offer on a durable medium: the recording then does not appear necessary as proof.

The retention period is part of the information to be given to people, along with the identity of the controller, the purpose, the legal basis, the recipients, the rights of access and objection and the possibility of lodging a complaint with the CNIL. The CNIL recommends two-stage information: a spoken notice at the start of the call, then a pointer to full information, for example on your website.

The people recorded may access their recordings, the CNIL reminds us, citing article 15 of the GDPR. So plan how to find a specific call from a request, and who answers it.

Access to recordings must be limited to the people concerned by the purpose: the team in charge of training for training recordings, the department that handles disputes for evidential recordings. The CNIL calls for access authorisations and traceability of access, so as to know who consulted what and when. Where several purposes coexist, it considers that a physical or logical separation of databases helps to comply with these rules.

Minimisation also applies to content: the CNIL recommends, for example, being able to interrupt or quickly delete the recording when a customer dictates bank details. Finally, the system must appear in your record of processing activities, and your data protection officer, if you have appointed one, must be involved in its implementation.

A usable policy fits on one page: for each data item (audio, transcript, summary, contact details), the purpose, the period in the active database, any archiving, the people with access, the method of deletion and the person responsible for checking that the purge actually takes place. Review it whenever you change tool or use. If you use Alyas, the AI voice agent, be aware that recordings, transcripts and summaries are hosted in the European Union, and that transcripts and summaries can be consulted in your workspace: include them in this inventory and check, before drafting your policy, the retention periods and the deletion arrangements that apply. The free 10-day trial, with no credit card required, lets you see concretely what data a call produces.