How long can you keep call recordings? Retention rules

UK GDPR doesn't set a number — it sets a principle: keep personal data no longer than necessary for your purpose. For call recordings, "necessary" is a judgement you make and document. Here's how to make it defensibly.

What the law actually says

The storage-limitation principle: personal data kept "no longer than is necessary" for the purposes collected. The ICO expects a written retention policy — the specific period is yours to justify.

What drives the right period for you

• Dispute windows — how long do billing disputes realistically surface? For most services, weeks-to-months, not years.
• Quality use — transcripts for improving your service have a shorter useful life than you think — recent calls matter, two-year-old ones rarely.
• Contractual records — where the call formed a contract (a booked job), keeping it while the contract relationship continues is defensible.
• Regulatory overlays — some sectors have specific rules (financial services keeps records for years). Most trades/salons/small firms have none.

Sensible defaults

• 30 days — quality and immediate-dispute window. Minimal exposure, defensible anywhere.
• 90 days — the common balance: covers slow disputes and seasonal follow-ups.
• 365 days — where you genuinely use year-old calls (long-cycle businesses).
• Forever — almost never defensible. Don't.

On Agentric, retention is a setting — recordings and transcripts auto-purge on the schedule you choose. Set it, document it, honour it.

Retention ≠ "keep everything anyway"

Two things people get wrong:

• Transcripts and recordings are separate — you might keep summaries/transcripts (needed for service records) longer than raw recordings (heavier privacy weight).
• Deleted means deleted — a retention policy you don't enforce is worse than none, because it's documented inconsistency. Automated purging (ours) beats good intentions.

DSAR interaction

A retention policy doesn't trump data subject rights — if someone validly requests erasure and you have no overriding legal basis to keep the data, it goes. The tools handle this; the policy defines the default.

The bottom line

Pick a period you can justify in one paragraph ("we keep recordings 90 days for quality and dispute purposes"), write it in your privacy notice, set it in the dashboard, and you're doing retention properly.