How long should call recordings be kept?

Most businesses retain call recordings for 30 days to 90 days for general quality assurance purposes. Regulated industries require significantly longer windows. Financial services firms under FINRA Rule 4511 must retain records for a minimum of 6 years, per FINRA compliance requirements. Healthcare organizations handling calls that touch protected health information must retain those records for 6 years under HIPAA, per HHS guidance. For general commercial operators without specific regulatory obligations, 90 days covers most dispute resolution windows and coaching cycles. The right retention period is the longest window required by any applicable regulation, not the shortest one that feels convenient. For a deeper look at how call data feeds coaching workflows, see the call coaching solutions page.

Legal requirements for call recording retention vary by industry and jurisdiction. The FCC's telemarketing and recording rules establish federal baseline obligations, including consent disclosure requirements. State privacy laws add additional layers. California's CCPA, for example, requires businesses to disclose retention periods in their privacy policy and to honor deletion requests within 45 days. Financial services firms operating under MiFID II must retain call recordings for 5 years, per EU MiFID II regulation. Broker-dealers under FINRA must retain for 6 years. Healthcare operators must follow HIPAA's 6-year rule for records touching PHI. The safest approach is to document the longest applicable requirement across all jurisdictions where you operate and apply it uniformly.

Compliance retention periods depend entirely on the regulatory frameworks that apply to your business. The table below maps the most common frameworks to their required retention windows.

OSHA's 30-year retention rule, codified in 29 CFR 1910.1020, applies to employee exposure records and related medical records in industries where workers are exposed to toxic substances or harmful physical agents. It does not apply to standard call recordings in most commercial settings. However, if a call recording documents an incident involving a workplace exposure, injury report, or safety complaint, that recording crosses into the category of records OSHA's rule governs. OSHA requires exposure records to be retained for 30 years, per 29 CFR 1910.1020. Manufacturing, construction, and chemical processing operators should consult legal counsel to determine whether any call recordings qualify as exposure-adjacent records under this framework. For most service-sector operators, this rule does not apply directly.

You can retrieve call history from 2 years ago only if your platform retained the recordings and your retention policy covers that window. Most entry-level call tracking platforms default to 30 to 90 days of storage. If your policy was set to 90 days and you need a recording from 24 months ago, that data is gone. 96% of inbound calls are analyzed by zero humans, according to Convirza data across 72,000+ operator locations. That figure means most recordings sit unreviewed until a dispute, audit, or coaching need surfaces. By then, short retention windows have already deleted the relevant calls. Setting retention to match your longest regulatory requirement, not your shortest storage budget, prevents this problem. For guidance on configuring retention windows, see the call recording retention glossary entry.

Deleting recordings before the applicable retention window closes creates three specific risks.

Storage requirements depend on audio quality, compression format, and call volume. At standard compression (MP3, 8kHz mono), a 1-hour call recording runs approximately 30 MB of storage, per standard audio compression benchmarks. A location handling 500 calls per month at an average of 4 minutes per call generates roughly 1 GB of audio data per month. Over a 6-year HIPAA retention window, that single location accumulates approximately 72 GB of recordings. Cloud storage costs for audio files run $0.02 to $0.05 per GB per month on major platforms, making long-term retention affordable for most operators. The cost of storage is rarely the binding constraint. The cost of not having a recording when you need it is.

You can delete call recordings after your retention window closes, and in some cases you are legally required to do so. The FTC's consumer privacy guidance recommends data minimization, meaning businesses should not retain personal data, including call recordings, longer than necessary for the stated purpose. California's CCPA requires businesses to delete consumer data upon verified request, subject to certain exceptions for legal holds. The practical rule: retain recordings for the full required window, then delete them on a documented schedule. Holding recordings indefinitely creates its own liability. A recording that exists can be subpoenaed. A recording that was deleted on schedule, per a documented policy, is a defensible business practice.

Retention policies differ across three primary dimensions: duration, scope, and enforcement mechanism.

Automatic call recording deletion requires three configuration steps inside your call intelligence platform.