Regulated contact centres, 2026

Privacy and technology-risk rules around the world now ask the same questions: where is customer data stored, who can reach it, and can you prove it. Examples include Singapore's Personal Data Protection Act and the MAS Technology Risk Management Guidelines, Indonesia's Personal Data Protection Law (fully in force since October 2024) and OJK rules for financial institutions, Bank Negara Malaysia's Risk Management in Technology policy, and the GDPR in Europe.

For a contact center, that means recordings, transcripts, screen captures and their backups. Many regulated organisations now prefer to run contact center and recording platforms on-premise or in a cloud account they own, in a region they choose, rather than in a vendor's shared cloud.

Speech analytics and automated quality management can now cover every call, not a small sample. Supervisors see call drivers, sentiment and compliance gaps across the whole floor.

The catch is that a transcript is as sensitive as the recording. Regulated teams are asking for models that run in their own environment, personal data redacted before anyone reads a transcript, an audit of every unmask, and a person confirming any score that affects an employee. The EU AI Act, in force since August 2024, adds to the expectation that AI decisions about people are explainable and supervised.

PCI DSS v4.0 made a set of future-dated requirements mandatory from 31 March 2025. Any contact center that takes card payments over the phone must show that card numbers and security codes are not stored in recordings or transcripts in a readable form.

The usual controls are a pause in recording while the card is read, with the reason audited, plus automatic redaction of card numbers, security codes and one-time passwords in transcripts, search and playback.

Rules differ by country and sector, but the pattern is the same: keep each kind of conversation for its own period, freeze recordings under legal hold when a case opens, and delete on time with evidence that it happened. A single retention setting for the whole archive no longer satisfies an auditor.

NIST published its first post-quantum standards in August 2024. Because recordings are kept for many years, they are exposed to harvest-now, decrypt-later attacks. Expect auditors to ask how recording keys are protected and when post-quantum protection will be in place.

Many organisations still run recording platforms bought ten or more years ago. Hardware and operating systems fall out of support, yet the archive must stay searchable until retention ends. Migrating that archive without losing a call has become a planned project rather than an afterthought.

• Map every place conversations are stored, including transcripts and backups.
• Check that AI tools run inside your environment and redact personal data by default.
• Test that card numbers cannot be found in recordings or transcripts.
• Set retention per source and per campaign, with legal hold and approved purge.
• Ask your vendors how recording keys are protected against quantum attacks.
• Plan the retirement of legacy recorders before support ends.

This briefing is general information, not legal advice. Your compliance team decides how each rule applies to you.