Call Recording and Privacy: What to Know
Call recording is an important tool for service, training and documentation, but it is also a collection of personal information. This article explains, as general knowledge, the questions worth thinking about: the notice to the caller, how long to keep recordings, who listens, and when to delete. It is not legal advice.
An important note before you start
The rules on recording calls differ from country to country, and sometimes also by type of organization, type of information and purpose of the recording. They also change over the years.
So this article presents general principles and questions worth asking, not legal answers. Before deciding on a recording policy in an organization, and especially in an organization that handles sensitive information (medical, financial, or information about children), we recommend consulting a lawyer or an advisor who specializes in privacy.
What can be said with confidence: an organization that thinks ahead about these questions and sets clear rules is in a much better place than one that simply records everything and keeps it forever.
For the avoidance of doubt: nothing in this article is legal advice, and it does not refer to any specific law. It is meant to help you ask the right questions.
Why record at all
Before talking about privacy, it's worth being clear about the purpose. Organizations record calls for several reasons:
- Service and quality control — to hear how agents talk with customers, and to improve.
- Training — to play examples of good calls for a new employee.
- Documentation — to know what was agreed when a dispute arises.
- Transcription and analysis — to produce summaries and tasks, as in the article on call transcription.
The purpose matters, because it determines everything else: what to record, how long to keep it, and who needs to listen. A recording with no clear purpose is mostly information lying around waiting to leak.
A notice to the caller
Most organizations that record calls play a short notice at the start of the call, such as "Please note, this call is being recorded to improve our service." This is a very common practice, and it is considered fair to the caller: they know they are being recorded, and can decide what to say.
This notice is usually played as part of the greeting or the IVR menu, before the call reaches an agent. It's best to keep it short and clear, and to say why the call is recorded.
Outgoing calls are a separate question, when the agent calls a customer. There is no menu there to play a notice, and the usual practice is for the agent to say at the start of the call that it is being recorded. Here too, exactly what is required depends on the case, and it's worth checking with an advisor.
What to record: everything or part
You don't have to record every call. In many phone systems you can choose: record only certain extensions, only a certain queue, or only incoming calls.
A good rule is to record what has a purpose, and no more. If the purpose is quality control in the service center, there is no need to record the CEO's calls. If the purpose is documenting orders, there is no need to record internal calls between employees.
Remember the employees too. Recording an extension also records the employee who speaks on it, including personal calls they may make from it. It is customary to tell employees in advance which extensions are recorded, and to give them a way to make private calls that are not from the recorded extension.
Retention period: how long to keep
The most common mistake is keeping recordings forever, "because maybe one day we'll need them." Every recording that is kept is more personal information that must be protected, and one more thing that could leak. A common principle in the privacy world is to keep only as long as there is a need, and then delete.
How long is "as long as there is a need"? It depends on the purpose:
| Purpose | A question that helps set a period |
|---|---|
| Quality control | Within what time does a manager actually listen to sample calls? |
| Training | Do you need all the calls, or only a few selected examples? |
| Order documentation | How long after an order do customers usually come back with a complaint? |
| Disputes | Is there an obligation or need to keep for a certain period? Here it's worth asking an advisor. |
Once a period has been set, it's better for the system to delete automatically at its end, rather than relying on someone to remember.
Who listens
Recordings are not a public document inside the organization. Whoever listens should be someone whose role requires it: the service center manager for quality control, the training coordinator, and perhaps a manager handling a complaint.
This is where the principle of least privilege comes in. The permission to listen to recordings is one of the sensitive permissions in the control panel, and it's best to give it to few people, by name, and not through a shared user.
The same logic applies to listening to live calls — silent monitoring. It is an important tool for training, but only in the hands of the person whose role it is, and it's best if employees know it exists.
Copying, downloading and sending
A recording that stays in the system is protected by permissions. A recording that was downloaded to a computer, sent by email or passed around in a messaging group is not. It can end up anywhere, and it can't be deleted when the retention period ends.
So it's worth setting a simple procedure: listen to recordings inside the system. Download only when there is a defined need, for example when a lawyer asks for a specific recording in a disputed matter. And if you downloaded one, delete the copy when the matter is over.
The same is true for transcripts, and even more so. Text is easily copied and pasted, and looks more innocent than an audio file, but it contains exactly the same information.
Deletion on request
Sometimes a caller asks that the recording of their call be deleted, or asks to hear it. How to respond to such requests depends on the rules that apply to the organization and on the reason the recording is kept, and here especially it's worth getting guidance from an advisor.
What is worth having ready in advance, in any case: knowing how to find the recording of a particular call (by the caller's number and the date in the call log), who is authorized to decide on such a request, and how to delete in practice, including copies that may have been downloaded.
Especially sensitive information
Some calls involve especially sensitive information: health conditions, financial hardship, family situation, information about children. Yeshivas, schools, chesed organizations and gemach funds run into this often.
In such calls it's worth considering whether to record at all, and if so, keeping the recording for a shorter period and limiting even further who listens. An organization that handles this kind of information is exactly the one that should consult an expert before setting a policy.
One more thing: don't ask over the phone for a full credit card number while the call is being recorded, if it can be avoided. A card number stored in a recording is a risk with no reason to take.
Securing the recordings themselves
Beyond the question of who may listen, there is the question of how the recordings are protected from those who may not. In a cloud PBX, recordings are stored on the system's servers and not on a computer in the office, which is usually an advantage: they don't get lost when a computer breaks, and access to them goes through the control panel with a username and password.
What remains the organization's responsibility is the door: who holds a user with listening permission, how strong their password is, and from which computers they can sign in. A shared password written on a sticky note makes all of the server's protections meaningless.
It's also worth asking the provider simple questions: where the recordings are stored, whether they are encrypted, and whether deletion at the end of the retention period is a real deletion. See also encryption.
A written policy: one page is enough
You don't need a twenty-page document. One page, written in plain language, answers the important questions:
- Why do we record?
- What is recorded: which extensions, which queues, incoming only or outgoing too?
- How does the caller know: which notice is played, and what does the agent say on outgoing calls?
- How long do we keep recordings, and what happens at the end of the period?
- Who may listen, and who may download?
- What do we do when someone asks to hear or delete a recording?
It's worth showing this page to an advisor, giving it to employees, and updating it when something changes. It is also what you'll want to present if anyone ever asks how you handle recordings.
An example from the field
The registration line of a talmud torah in a Jerusalem neighborhood recorded all calls and kept them without limit. After three years the system held thousands of calls with parents, including details about children's difficulties, and no one had listened to most of them.
The principal sat down with an advisor and set new rules: only the registration line is recorded, a notice is played at the start of the call, recordings are kept for a fixed period set with the advisor, and only the head secretary and the principal can listen. Old recordings that were no longer needed were deleted.
The result: less information to protect, and the same benefit. When a parent called with a claim about what was said at registration, the relevant recording was still there.
How it works with us at Kesher
In the Kesher control panel you define recording groups, and for each group a retention period. This way you can decide in advance how long recordings are kept, instead of holding them forever.
Recording is turned on in the settings of each extension, so you can record only the extensions where it's needed. The recording notice to the caller can be built into the IVR menu or the greeting.
In the Users and Permissions screen you set who sees what, and you can restrict sign-in by IP address. Managers can listen to live calls with silent or open monitoring.
Those connected to our CRM also get transcription and analysis of the recordings, so it's worth including transcripts in the policy as well. We don't provide legal advice; for questions about what is permitted and what is required, we recommend consulting a lawyer.
FAQ
Is it required to tell the caller that the call is recorded?
This is a legal question, and the answer depends on the case. What can be said is that such a notice is a very common practice and is considered fair. For a binding answer, consult a lawyer.
How long should recordings be kept?
As long as needed for the purpose you recorded them for, and no longer. Quality control usually calls for a short period; documenting disputes perhaps longer. The exact period is a decision worth making with an advisor.
Who should hear recordings?
Only whoever's role requires it: the service center manager, the training coordinator, whoever handles a complaint. The permission is given by name, not through a shared user.
A caller asked to delete their recording. What do we do?
Find the recording by number and date, and pass the request to whoever is authorized to decide. Exactly how to respond depends on the rules that apply to you, and it's worth getting guidance on this in advance.
Do we need to tell employees that their extension is recorded?
It is customary to tell them in advance, and to give them a way to make private calls that are not from the recorded extension. Here too, it's worth consulting for details.
What about call transcripts?
A transcript contains exactly the same information as the recording, so the same rules apply: who may read it, how long it's kept, and when it's deleted.
Should recordings be downloaded to a computer?
Only when there is a defined need. A recording that was downloaded is no longer protected by permissions and is not deleted automatically at the end of the retention period.
Can you record only some of the extensions?
In many phone systems, yes, and that is also what we recommend: record only what has a clear purpose, for example the service line or the orders line, and not every phone in the organization.
Is it allowed to play a recorded call to a new employee during training?
It's a common use, but worth thinking about: choose calls that contain no sensitive information, or blur identifying details, and play them only to those who really need them. If in doubt, ask an advisor.
What is the difference between recording and silent monitoring?
A recording is saved and can be heard later. Silent monitoring is listening to a live call while it is happening, without the parties hearing the listener. Both are sensitive, and both should be in the hands of few people.