Redaction, PCI and Sensitive Data in Recordings

A recorded call contains whatever the customer said, including things you are not permitted to store.

What ends up in recordings

Payment card data. Card number, expiry, security code, read aloud. Storing this brings the recording into scope of payment card security requirements.

Identity data. Date of birth, national identifiers, account numbers, addresses.

Health information, in any sector where customers explain why they need something.

Special category data — health, religion, sexuality, union membership — disclosed incidentally in the course of a call.

Other people's data. A caller discussing a family member.

The two approaches

Pause and resume. Recording stops while sensitive data is taken and restarts afterwards.

Advantages: the data never enters the recording. Simplest to justify.

Failure modes: the agent forgets to pause, pauses late, or resumes early. Automated triggers based on screen context are more reliable than manual buttons and are not universal. Gaps in recordings also remove evidence of what happened during them, which creates a different problem for dispute resolution.

Redaction after recording. The recording is made, then sensitive segments are located and removed or masked.

Advantages: no gaps, no agent action required, and the full call is available for analytics up to the redaction point.

Failure modes: detection is imperfect. A card number spoken unusually, split across pauses, or misrecognised may be missed. The unredacted original exists for some period before processing.

Many deployments use both: pause-and-resume for card data, automated redaction as a backstop for everything else.

Where redaction fails

Unusual phrasing. Numbers read in groups, with corrections, or interrupted.

Transcription error. Redaction driven by the transcript misses what the recogniser misheard.

Non-numeric sensitive data. Health disclosures and personal circumstances are not pattern-matchable and are largely not redacted at all.

Metadata. Redacting the audio while the transcript, the CRM note and the screen recording retain the same data.

Screen recording, which is frequently overlooked and captures everything the agent sees.

Testing it

Sample recordings after redaction and check by listening. Automated redaction reporting a success rate is reporting its own detection, not its accuracy.

Deliberately test edge cases: numbers read unusually, corrections mid-number, customers who repeat themselves.

Test across accents, since detection driven by transcription inherits the accuracy gap.

Test the whole estate: audio, transcript, screen recording, CRM notes, analytics index. Redaction applied to one and not the others is not redaction.

The retention question

Redaction reduces what is stored; it does not answer how long.

Define retention per data type and per purpose: dispute resolution, compliance evidence, training, analytics.

Shorter is easier to defend. Recordings held indefinitely because storage is cheap are a liability that grows.

Analytics indexes are copies. Deleting a recording without deleting its transcript and its index entries deletes nothing meaningful.

Legal hold has to be able to override deletion selectively, which requires it to have been designed in.

The practical position

Pause and resume for card data, with automated triggers rather than manual buttons where possible.

Automated redaction as a second layer.

Test both by sampling, by hand, including edge cases and across accents.

Apply the same controls to transcripts, screen recordings and analytics indexes, which are the copies people forget.

Set retention deliberately, per purpose, and confirm deletion actually propagates.

The redaction test protocol

A defined test, run quarterly, that establishes whether redaction actually works.

Twenty calls known to contain card data, selected from the payment queue.

Listen to the redacted audio. Count any digits still audible.

Read the redacted transcript. Count any digits still present.

Search the analytics index for fragments of the numbers. This is the step that most often fails.

Check the CRM notes for the same calls.

Check the screen recording, if captured.

Repeat with awkward cases: numbers read in groups, corrected mid-sequence, repeated at the customer's request, spoken by a customer with a strong accent.

Any leak is a finding, and the redaction rate the vendor reports is not evidence — it reports detection, not accuracy.