Klytic

Home›Guides›Telephony

Telephony · Understand

How long to keep call recordings

There is no single period that applies to every company. The retention period follows from the reason you record: training, evaluation, quality improvement, or proving a transaction where a legal text provides for it. For recordings made in the workplace, the CNIL, France’s data protection authority, sets a benchmark of six months at most, unless a specific legal text or justification applies.

Updated October 20267 minOfficial sources cited

Recording is data processing

A recording contains the voice of an employee and that of the other party, often their names, sometimes sensitive information mentioned during the conversation. It is processing of personal data within the meaning of the GDPR. Two principles of Article 5 apply directly: data is collected for specified, explicit and legitimate purposes, and it is kept for no longer than is necessary for those purposes.

The retention period is therefore not chosen first. It is derived from the purpose. A company that cannot say why it records cannot say how long it keeps recordings.

Permitted purposes, and what they justify

The CNIL’s guidance on listening to and recording calls in the workplace lists permitted purposes: employee training, employee evaluation, improving service quality and, in the limited cases provided for by a legal text, proof of a contract or transaction. The system must meet a recognized need and remain proportionate to the objective.

PurposeWhat needs to be keptWho needs to listen
TrainingA few selected calls, for the duration of a session or a training cycleThe trainer, the employee concerned
Evaluation and qualityThe calls needed for an evaluation grid; the grid itselfThe team leader or the quality department
Proof of a transactionCalls that involve a commitment, where a legal text provides for itThe department managing contracts or disputes

The same guidance sets limits. An employer may not set up a permanent or systematic listening or recording system, unless a specific legal text provides for it. Recording all calls to deter abusive behavior is not permitted: a recording triggered by the employee is considered less intrusive. Employees must be able to make personal calls on unrecorded lines, or switch recording off; the same applies to employee representatives in the exercise of their mandate.

Inform people and restrict listening

Informing people comes before enabling recording.

  • Employee representatives are informed and consulted before the system is set up.
  • Employees know when they may be listened to or recorded, why, by whom and for how long.
  • Callers are informed at the start of the call, usually by a short announcement, with a pointer to full information. The CNIL specifies that they must be informed of their right to object before the end of the conversation.
  • The record of processing activities mentions the system, and the DPO is involved if one has been appointed.

Access must be limited to the departments concerned by the purpose, with authorizations and logging of the actions performed. In practice: few people have the right to listen, this right is separate from the right to make calls, and the list of authorized people is reviewed regularly. For Klytic Tel, implementation is described in Who can listen to recordings in Klytic Tel.

Retention periods: what the CNIL says

The CNIL’s guidance gives two benchmarks for recordings made in the workplace:

  • recordings may be kept for up to six months at most, unless a legal text imposes a specific period or there is a particular justification;
  • analysis documents, reports or evaluation grids may be kept for up to one year.

It also recommends a good practice: use the recordings within the following days, write up the analysis documents, then delete the recordings promptly. Six months is a ceiling, not a target.

These benchmarks do not cover every case. Some sectors have their own legal texts, which impose a longer or shorter period for calls involving a commitment. If your business is regulated, the sector rule takes precedence: check it with your DPO or legal advisor before setting your own.

The CNIL page used here dates from 2009 and is marked “obsolète, en cours de mise à jour” (obsolete, being updated). It remains the reference published by the authority on this subject as of the date it was consulted. Check whether a more recent version exists before finalizing your policy.

A method for setting your retention period

  1. Write down the purpose, line by line or queue by queue: customer reception for quality, the sales department for proof, and so on.
  2. Limit the scope: only lines with a reason to be recorded are recorded.
  3. Set a period for each purpose, without exceeding the CNIL benchmark unless there is a legal text or a written justification.
  4. Deal with derived data: transcripts, summaries, evaluation grids and voicemails copied into the email system have their own retention periods. Deleting the audio file does not delete its transcript.
  5. Review the policy and the list of authorized people at least once a year.

Backup is not the retention period

Two clocks coexist, and they must not be confused.

The retention period is your decision: how long the recording remains available for listening in the service. Backup retention is a technical measure taken by the operator: how long a copy of the entire service is kept so that it can be restored after an incident.

When you delete a recording, it disappears from the service. A copy may remain in the backups until they expire. This copy is not accessible to users; it is used only for a restore. Mention it in your notice to individuals and in your record of processing: it is more accurate than claiming immediate and complete deletion.

Frequently asked questions

Can we record all of the company’s calls?

The CNIL states that permanent or systematic recording is not permitted, unless a specific legal text provides for it. Record the lines that have a purpose.

Must the other party be informed?

Yes, at the start of the call, with the possibility to object before the end of the conversation.

Who should be able to listen?

Only the people concerned by the purpose. See Who can listen to recordings in Klytic Tel.

Where are recordings stored?

On the phone platform, along with other traces of the call. See What a phone platform knows about your company.

Where Klytic fits

Call recording is a Klytic Tel feature, available from the Basic Line upward. It is not enabled everywhere by default: you choose, with Klytic, the lines or queues where it serves a purpose. Call transcription and summaries are part of the Business Line; they are derived data, to be covered by your policy.

Recordings are kept on the phone server dedicated to your organization, in the chosen hosting zone or on your servers. The retention period is set according to your policy. Klytic does not set a legal period on your behalf and does not take the place of your DPO.

Telephony is backed up every day, with a retention of 30 days. A copy of a deleted recording may therefore remain in the backups for up to 30 days, without being accessible to users. A data processing agreement is provided at signing.

This page describes a general framework. It does not replace the advice of your DPO or legal advisor, nor the legal texts specific to your sector.

Legal status as of October 11, 2026. The retention benchmarks (six months for recordings, one year for analysis documents) come from the CNIL guidance “L’écoute et l’enregistrement des appels sur le lieu de travail” (Listening to and recording calls in the workplace), published in 2009 and flagged by the CNIL as obsolete and being updated. A sector-specific legal text may impose a different period.

Sources

Consulted in October 2026.

  • CNIL, “L’écoute et l’enregistrement des appels sur le lieu de travail” (Listening to and recording calls in the workplace) (published May 5, 2009, marked “obsolète et en cours de mise à jour”, obsolete and being updated): permitted purposes, prohibition of a permanent or systematic system unless provided for by a legal text, unrecorded lines for personal calls, informing employee representatives, employees and callers, right to object, limited access and logging, retention of up to six months for recordings and one year for analysis documents. cnil.fr
  • GDPR, Article 5: purpose limitation and storage limitation. cnil.fr
  • Klytic, Klytic Tel page: call recording from the Basic Line upward, transcription and summaries on the Business Line. klytic.com
  • Klytic, frequently asked questions: daily backup of Klytic Tel, kept for 30 days. klytic.com

Set up call recording

We prepare with you the recorded lines, the announcement to callers and the people authorized to listen.

Talk to an advisor →

Discover Klytic Tel

Further reading

Use · TelephonyWho can listen to recordings in Klytic TelWhere your recordings are in Klytic Tel, how to restrict listening to a few people, which lines to record, and the case of voicemail sent by email.5 min readRead →Understand · TelephonyWhat a phone platform knows about your companyA call leaves traces even without recording: call history, directory, voicemail, logs, backups. Who holds them, and who can see the numbers.7 min readRead →Understand · TelephonySecuring IP telephony and limiting fraudPhone fraud is paid for in calls to premium-rate numbers, often outside business hours. What is exposed, the controls, the signs of a hijacked account.7 min readRead →

Welcome offer

30 days free trial, migration support included

No-commitment trial. An advisor calls you back to understand your needs and prepare your Klytic workspace.

🚀 Start the free trial See pricing