Companies typically keep recorded phone calls anywhere from 30 days to six years, and in some financial contexts longer. Where a given call falls in that range depends on the industry, the regulators involved, and whether the conversation touched money, sensitive data, or a likely dispute. A routine call to a retailer’s help line may be gone within a few months. A call with a broker-dealer or a swap desk can sit in storage for years.
Retention by Industry
Financial Services
Broker-dealers work under SEC Rule 17a-4, which requires communications, including phone recordings, to be preserved for at least three years, with the first two years in an easily accessible location.1eCFR. 17 CFR 240.17a-4 – Records to Be Preserved by Certain Exchange Members, Brokers and Dealers Core financial records such as ledgers and trade blotters carry a six-year minimum under the same rule. FINRA’s own rules require member firms to keep records for at least six years when no other specific period applies.2FINRA. FINRA Rule 4511 – General Requirements
Swap dealers and major swap participants operate on a different clock under CFTC rules. They must retain records related to each swap for the life of the swap plus at least five years after final termination.3eCFR. 17 CFR Part 45 – Swap Data Recordkeeping and Reporting Requirements For long-dated derivatives, that can stretch well past a decade.
Debt Collection
Debt collectors who record calls must retain each recording for three years after the date of the call under CFPB Regulation F. The same three-year minimum applies to records that serve as evidence of compliance with the Fair Debt Collection Practices Act, measured from the collector’s last collection activity on the debt.4Consumer Financial Protection Bureau. 12 CFR 1006.100 – Record Retention
Telemarketing
The FTC’s Telemarketing Sales Rule requires sellers and telemarketers to retain records of their telemarketing activities for five years from the date each record is produced, including advertising materials, scripts, and promotional content. Scripts and prerecorded messages carry their own five-year clock starting from the date they’re no longer in use.5eCFR. 16 CFR 310.5 – Recordkeeping Requirements The rule doesn’t itself require companies to record calls, but companies that do are subject to these timelines for the resulting records.
Healthcare
HIPAA does not set a retention period for medical records or for call recordings containing protected health information. HHS has said so directly: state law, not HIPAA, governs how long medical records must be kept.6U.S. Department of Health & Human Services. Does the HIPAA Privacy Rule Require Covered Entities to Keep Medical Records for Any Period What HIPAA does require is that compliance documentation, such as written security policies and audit records, be kept for six years after creation or last effective date.7U.S. Department of Health & Human Services. Summary of the HIPAA Security Rule
In practice, many healthcare organizations apply that six-year compliance timeline across the board, including to call recordings, to avoid destroying anything a regulator or auditor might later ask about. But the actual legal floor for call recordings sits in state law, which varies.
General Customer Service
Retailers, software providers, and general service businesses have no federal mandate telling them how long to keep recorded calls. Typical retention runs 30 to 90 days, though some keep recordings for up to a year. The window usually reflects how long customers tend to call back about the same issue, weighed against the cost of keeping recordings in active storage.
What Determines the Timeline
No single federal law sets a universal retention period. Timelines are shaped by industry-specific regulations, internal company policies, litigation risk, and storage cost.
For regulated industries, federal agencies set minimum floors. The SEC, CFTC, FTC, and CFPB each impose their own recordkeeping timelines, and a company subject to multiple regulators generally follows the longest applicable period. Beyond those minimums, many companies add a buffer tied to the statute of limitations for the disputes most likely to arise from the call. A company that handles contract disputes with a four-year limitations period might hold recordings for five years even without a regulation forcing it.
Storage cost is the main reason recordings don’t stay forever. Cloud storage prices have dropped, but the ongoing expense often comes from data access charges, retrieval fees for archived files, and API call charges generated whenever automated systems interact with stored recordings. For businesses handling millions of calls a year, those costs create strong financial pressure to delete recordings once the legal retention window closes.
How to Get a Copy Before It’s Deleted
Getting your hands on your own recorded call is possible, but the path depends on whether a privacy law gives you a formal right of access.
California residents dealing with a business covered by the CCPA, and residents of other states with comparable privacy laws, can submit a formal data access request. The company is then legally required to provide the personal information it has collected, which can include call recordings. Most large companies run a privacy request portal or list a designated email address for these requests. Processing typically takes several weeks.
For companies serving European customers, the EU’s General Data Protection Regulation adds another layer. GDPR requires that personal data be kept no longer than necessary for the purpose it was collected, and it gives individuals the right to request access to their data and, in many circumstances, to request deletion. U.S.-based companies serving European customers need to comply with these rules for those interactions.
If no privacy law applies, you can still make a written request directly to the company. Address it to customer service or the legal or compliance team. Include the date and approximate time of the call, the phone number you called from, and any reference or case numbers. Be specific about which recording you want. The company isn’t legally obligated to comply in this scenario, but many will, especially if the request is tied to an unresolved dispute.
If the company refuses and the recording matters to a legal claim, the formal route is litigation. Once you file a lawsuit, discovery tools like a subpoena or request for production can compel the company to produce the recording.
Send a Preservation Notice Early
The biggest practical risk is that a recording gets deleted before you realize you need it. A general customer service recording kept for 90 days will be long gone by the time most disputes escalate. Even regulated industries eventually reach the end of their mandatory retention periods, and companies rarely announce when they’ve deleted a recording. They have no obligation to notify you.
If you think a recorded call might matter later, whether for a billing dispute, an insurance claim, or a workplace issue, act quickly. Send the company a written preservation notice while the recording still exists. That puts the company on notice not to delete the recording as part of its normal retention cycle, and destroying it after that notice can carry serious consequences in court. Waiting even a few months can be the difference between having proof and having nothing.