What is data retention?

Definition

Data retention is how long an organization keeps data and the rule for when it deletes it. For a voice agent it covers call audio, transcripts, logs and extracted fields. Some laws set limits or minimum periods, but most periods come from policy and contract.

What it covers

Data retention is a policy with two parts: how long each kind of data is kept, and what happens at the end, usually deletion or anonymization. One voice agent call creates several kinds of data that can have different periods. There is the audio, the transcript, the structured fields the agent extracted, the payloads sent to tools and webhooks, summaries and scores from analytics, and operational logs. Copies may also sit with each vendor in the call path.

What it requires

There is no single retention law for call data. Different regimes pull in different directions.

GDPR Article 5(1)(e) says personal data may be kept in identifiable form for no longer than is necessary for the purposes it is processed for. That sets a ceiling, but it does not name a number of days. See GDPR.
PCI DSS Requirement 3.2.1 asks that storage of account data be kept to a minimum through retention and disposal policies, and Requirement 3.3.1 forbids keeping sensitive authentication data after authorization. The PCI Council’s FAQ 1210 adds that PCI DSS does not override local or regional audio retention laws. See PCI DSS.
HIPAA requires a covered entity to keep required documentation, such as privacy policies and records of actions it must document, for six years (45 CFR 164.530(j)(2)). That rule is about the documentation HIPAA requires, and it does not by itself set how long call recordings are kept. See HIPAA.
Sector and state rules, such as recordkeeping duties for financial services or collections, may require some records to be kept for a minimum period. Check yours.

The result is often a range: keep as little as the purposes need, but not less than any rule that requires a record.

What it means for a voice agent

Set a period for each kind of data, not one for “call data”. Audio is the most sensitive and often the shortest. Transcripts may be needed longer for quality review or disputes, and redaction of names, numbers and card digits before storage can shorten the exposure.

Deletion has to reach the vendors. Ask whether each one offers a deletion interface, how backups and logs are handled, and how quickly deletion completes. Retention set in your own system does not cover the copy held by a speech vendor, an LLM provider or a carrier.

Retention and recording interact. Whether you may record at all is covered under call recording consent, and what you store is covered under call recording. A vendor option to store nothing is described under zero data retention. For infrastructure choices, see the guide on on-premise voice AI.

Questions to ask counsel

What minimum and maximum periods apply to our recordings, transcripts and logs?
Does a legal hold or a dispute change the schedule, and who can place one?
How do we prove that deletion reached our vendors and backups?
May we keep a redacted transcript longer than the audio, and on what basis?
Which of our records are required by sector rules, and for how long?

Guides

Use cases

Sources

This page is general information, not legal advice. Rules differ by country, state and use case, and they change. Check the linked sources and ask qualified counsel before you rely on it.

Last reviewed October 19, 2026