How long do I have to keep call recordings?

It depends on your industry and the states you operate in — commonly 5–7 years for financial services and insurance, 6–10 for healthcare and banking, and 5+ for utilities. When several rules apply, default to the strictest one.

Can I record calls where customers read out their card number?

Yes, but you can't retain the security code (CVV), PIN, or full magnetic-stripe data after the payment is authorized — even encrypted. Use pause-and-resume, channel separation, or automatic redaction so that data never enters the recording.

Does HIPAA require 6 or 7 years?

HIPAA's six-year rule applies to compliance documentation. Recordings that contain patient information are treated as medical records, which are governed by state law — often 7–10 years, and longer for minors.

Do EU rules apply if I'm based in the US?

If you serve EU clients, MiFID II (5–7 years) and GDPR can apply regardless of where your company is headquartered.

Can a customer force me to delete a recording I'm required to keep?

Generally no. A valid legal retention obligation overrides a deletion or erasure request; you keep the recording and document the legal basis for doing so.

Is storing recordings enough on its own?

No. If you can't retrieve a specific recording quickly, you're still exposed during audits and litigation. Retrievability is part of the requirement, not an extra.

Call Recording Retention Requirements (2026)

Call Recording Retention Requirements — How Long to Keep Recordings in 2026

A plain-English guide to how long you're required to keep customer call recordings — by industry and regulation — and why meeting the minimum only helps if you can actually find a recording when someone asks for it.

Book an Assessment

The Short Version

There's no single federal rule. Retention is set by your industry and the states you operate in, so most companies work to several overlapping requirements at once.
Typical minimums run from about 3 years (some financial records) to 10+ years (healthcare and banking).
Payment-card calls are the exception: PCI DSS says there's card data you're required NOT to keep — even encrypted.
20 states now have comprehensive privacy laws in effect, adding rules on deletion, access, and opt-outs on top of industry retention.
Operating across industries or states? The safe default is the strictest rule that applies to you.
Retention is only half the job. If you can't retrieve a specific recording quickly, you're exposed during audits, lawsuits, and AI projects.

What "Retention Requirements" actually mean

Call recording retention requirements are the legal obligations that dictate how long you have to keep recorded customer interactions. In the US there's no universal standard. Instead, a patchwork applies: HIPAA in healthcare; SEC Rule 17a-4 and Dodd-Frank in financial services; MiFID II and GDPR for anyone serving the EU; PCI DSS for any call that touches payment-card data; and a growing set of state privacy laws on top.

Which period applies depends on what was said on the call and who regulates you. A billing call in a hospital, a trade confirmation at a broker-dealer, and a card payment in a retail contact center are all governed differently. When more than one rule applies to the same recording, the longest one wins — so the practical rule of thumb is to build your policy around the strictest standard you're subject to.

Retention periods by industry

Here's the landscape across the most commonly regulated industries. Treat these as typical minimums — your exact obligation depends on your jurisdiction and the content of the call.

Industry	Typical Retention	Main Rules	Watch out for
Energy & utilities	5+ years	State public-utility-commission rules Federal audit standards	Disputes and complaints buried in cold storage
Healthcare	6–10 years	HIPAA: 6 yrs for compliance documentation State medical-record law governs PHI recordings (often 7–10 yrs)	The recording platform itself must be HIPAA-compliant
Insurance	5–7 years	State insurance-department rules NAIC model regulations Solvency II (EU): 5 yrs	Producing recordings as evidence on a tight deadline
Banking	5–10 years	Financial-services rules plus state banking regulations	Huge volumes across legacy, siloed, proprietary systems
Financial Services	5-7 years	SEC Rule 17a-4 (broker-dealers: core records 6 yrs, 2 most recent easily accessible)	Business happening on unapproved channels (WhatsApp, personal text/email)

Financial services

SEC Rule 17a-4 requires broker-dealers to preserve core books and records for six years, with the two most recent years kept somewhere immediately accessible, and business communications for at least three. Registered investment advisers fall under a separate five-year rule (Investment Advisers Act Rule 204-2), and Dodd-Frank sets five years for swap-related records. Records also have to be stored so they can't be quietly altered — either in WORM (write-once) form or with a complete audit trail — and produced in a usable format on short notice.

Enforcement here has been aggressive. Since 2021 the SEC has pursued firms for billions in penalties, and increasingly the issue isn't just failing to keep records — it's letting business happen on unapproved channels like WhatsApp, personal email, and text. In one action in early 2025, a group of advisers and broker-dealers paid a combined $63 million-plus for messaging-preservation failures. Large names have been caught, which means smaller firms without dedicated compliance infrastructure are more exposed, not less.

EU-facing firms (MiFID II)

If you serve clients in the EU, MiFID II requires you to record the client conversations that could lead to a transaction and keep them for at least five years — up to seven if a regulator requests it — in a tamper-proof form that stays retrievable the whole time. Clients also have the right to ask for a copy. This applies regardless of where your company is headquartered.

Healthcare

Healthcare is where the "6 versus 7 years" confusion comes from, so it's worth being precise. HIPAA's six-year rule applies to compliance documentation — policies, patient authorizations, access logs — not to the recordings themselves. A recorded call that contains patient information (appointment scheduling, billing, a clinical question) is treated as a medical record, and how long you keep medical records is set by state law, which frequently lands at seven to ten years, and longer for minors.

Either way, if a recording holds protected health information, the platform storing it has to be HIPAA-compliant: encrypted in transit and at rest, with role-based access and audit logs showing who retrieved what. A newer wrinkle: as of January 1, 2026, Texas requires electronic health records to be stored inside the United States, so data-residency now matters too.

Insurance, banking, and utilities

Insurance retention is driven by state insurance-department rules and NAIC model regulations, usually landing at five to seven years, with EU insurers under Solvency II at five. Claims, fraud investigations, and disputes all depend on being able to pull the right recording as evidence on a deadline. Banking overlaps heavily with financial-services rules and adds state banking regulations that can push retention toward ten years, against enormous interaction volumes. Utilities typically face five-year-plus windows set by state public-utility commissions and federal audit standards.

THE PAYMENT-CARD EXCEPTION (what you're required NOT to keep)

Almost every rule above is about keeping recordings long enough. PCI DSS is the opposite — it's about what you must delete.

If an agent takes a card payment on a recorded line, the security code (CVV / CVC2 / CAV2 / CID), the full magnetic-stripe data, and the PIN are classed as "sensitive authentication data." PCI DSS Requirement 3.2 says you must not store that data once the payment is authorized even if it is encrypted. A call recording counts as storage, so a recording that captures a spoken security code puts you out of compliance.

PCI DSS doesn't ban call recording; it bans keeping that specific data. The usual fixes are pause-and-resume around the payment moment, separating the payment audio so the digits never reach the recording, or automatically redacting the numbers and tones. Anything that does stay (e.g. the card number) has to be encrypted, access-controlled, and logged.

Two shifts worth noting

State privacy laws keep expanding

Twenty states have comprehensive consumer-privacy laws in effect as of 2026, with Indiana, Kentucky, and Rhode Island switching on January 1 and several more enacted and waiting for their dates. These laws largely require companies to give consumers control over their own data, meaning access to what a company holds on them, deletion on request, and honoring universal opt-out signals such as Global Privacy Control. Most set a response window of around 45 days.

These obligations stack on top of whatever retention rules a company already follows rather than replacing them. A broker-dealer subject to SEC Rule 17a-4 still has to keep its records for six years, whether or not a consumer in Kentucky files a deletion request.

The EU works along similar lines. GDPR's storage-limitation and right-to-erasure provisions include a carve-out for records that another law requires a company to keep, and in those cases an erasure request can generally be refused so long as the legal basis for keeping the record is documented. Compliance teams working in both regimes tend to build the retention schedule first and handle consumer requests as exceptions against it.

AI changed the question

Most contact centers built their archives to satisfy their audit needs, so the cheapest storage that met the retention rule was good enough. Many companies went went years without opening the archive at all unless a lawyer or a regulator asked them to.

Companies now realize that their archives are useful and are training internal models on them now to understand what customers actually call about. Storage methods that worked fine when nobody looked at it become a constraint once people want to look at it every week.

A company can hold five years of calls across three legacy platforms, be entirely compliant, and still not be able to get much out of any of it. The audio sits in whatever proprietary format the old vendor used, and pulling together a dataset anyone can work with takes weeks of somebody's time.

So the consolidation work usually comes first. Companies move what they already have into one archive they can search.

Retention without retrieval is a liability

While most companies can prove they kept the recordings, far fewer can hand over one particular call when a lawyer asks for it on a short deadline. Many organizations retain everything and still cannot produce a given recording quickly. The audio is spread across legacy systems in formats the old vendor controlled, and much of it sits in cold storage, so retrieval becomes a multi-day scramble that stalls the audit it was meant to serve. It is the same when someone wants five years of history for an AI project and finds that assembling it is a quarter's worth of work.

A retention setup that works is one somebody can actually pull from. That means a single archive that can be searched, and one that does not lock the recordings to whichever platform happened to capture them.

The anatomy of a call recording policy

Map the rules that apply to you. List every federal, state, and industry regulator with authority over your business.
Set each window to the strictest applicable standard. When rules overlap, keep to the longest period so you never delete something that's still inside a compliance window.
Automate retention and deletion. Configure your platform to apply retention rules and securely delete on schedule. Manual processes don't scale and can lead to costly mistakes.
Encrypt and control access end to end. Encrypt at rest and in transit, restrict retrieval to authorized roles, and keep audit logs of who accessed what and when.
Review annually. Regulations move every year, so put a yearly policy review on the calendar so your practice keeps pace with new state laws and updated federal rules.

How MediaVault helps

We capture interactions across your contact center and CCaaS channels, and redact PCI- and HIPAA-sensitive content so you're never storing what you're not allowed to keep. Everything is stored in a secure, tamper-resistant archive with encryption, role-based access, and full audit trails, and retention and deletion schedules run automatically to whatever standard you set.

Because the archive is centralized and searchable, you can produce a specific recording in minutes for an audit or a lawsuit, and provide clean, compliant data to your analytics and AI initiatives. If your recordings are trapped in older systems, we can also extract and consolidate them from legacy platforms into one searchable place.