Transcription and call-recording retention in the GCC: windows, deletion, redaction, audit trails

How long must call recordings be kept in the GCC?

The anchored numbers come from sector regulators. In the UAE, TDRA Telecommunications Consumer Protection Regulations (v3.0, 2022) require licensed operators to retain customer-care call recordings at least one year for general calls and longer for disputed transactions. In the DIFC, DFSA COB Rule 3.4.6 requires authorised firms to retain telephone communications relating to client orders for a minimum of six years, with FSRA equivalents in ADGM. In Saudi Arabia, SAMA's Banking Consumer Protection Principles and the Insurance Authority's conduct-of-business rules set windows for KYC verbal-verification, investment-sales, and dispute calls typically running five to ten years, while CST rules scale general operator-call retention to interaction type.

Where no sector rule fixes a number — general retail support, internal QA on unregulated traffic — the data-protection laws supply the principle instead: keep personal data no longer than the purposes require. Defensible practice in unregulated GCC call-centre operations clusters around one to two years for QA recordings, with shorter windows (90 days is a common default) where the only purpose is coaching and quality sampling. The honest answer for any specific licence class is "check the current circulars with counsel" — windows are revised, and insurance, brokerage, and payments licences within one country can carry different numbers.

Do transcripts count as the same record as the audio?

Plan as if yes, with one asymmetry. A transcript of an identifiable caller is personal data carrying the same lawful-basis, transfer, and retention obligations as the recording. Where a regulator requires retention of "the communication" — DFSA client-order recording is the clearest case — conservative practice retains the audio as the primary record and treats the transcript as a derived working record, because the audio carries evidentiary weight (tone, interruptions, exact phrasing under dispute) the transcript summarises.

The asymmetry: nothing requires the two to share one retention window in the other direction. A common, sensible configuration keeps audio for the regulatory minimum while keeping the searchable transcript on the same or a shorter clock — and conversely, deleting audio at expiry must cascade to transcripts, embeddings, analytics extracts, and exports derived from it, or the deletion is incomplete. Inventory the derivatives: sentiment scores tied to a call ID, QA scorecards quoting transcript snippets, coaching evidence packs, CSV exports sitting in a BI tool. Retention policy that only covers the recording platform misses most of the copies.

When must recordings and transcripts be deleted?

Three deletion triggers operate in parallel. Expiry of the retention window: the storage-limitation principle in the Saudi PDPL, the UAE federal PDPL, and the DIFC and ADGM regimes means data kept past its justified purpose is itself a violation — regulatory minimums are floors, not licences to hoard. Data-subject erasure requests: the GCC data-protection laws grant erasure rights, qualified by legal-obligation carve-outs — a bank can decline to erase a KYC call inside its SAMA-aligned window, but must be able to explain the basis and delete once the window closes. Contract end: processor obligations in a DPA typically require deletion or return of all personal data on termination, which a controller should verify, not assume.

Make deletion a system behaviour rather than a calendar reminder: per-category retention rules with automated expiry deletion, deletion certificates or logs as evidence, and a tested workflow that locates everything tied to one caller across recordings, transcripts, and derivatives. CallScribe's configuration model reflects this — retention is set per project (30 days, 1 year, 5 years, 10 years, or indefinite with manual deletion), so a bank keeps general support calls one year and KYC calls ten without manual re-classification, and deletion at expiry covers transcript and analytics records together.

How should PII be redacted in transcripts?

Redaction is the control that makes long retention survivable. A six-year archive of searchable transcripts containing card numbers, Emirates IDs, and IBANs is a breach amplifier; the same archive with identifiers masked is a compliance asset. The standard pattern is masking at transcription time using a combined regex-and-NER pipeline: pattern-based detection for structured identifiers (card PANs, IBANs, SWIFT/BIC codes, Emirates ID and Saudi national ID formats, phone numbers) and named-entity recognition for unstructured ones — and for GCC traffic the pipeline must handle Arabic-script and code-switched content, including digits spoken in Arabic words, or it misses the half of the PII that occurs in Arabic segments.

Two design choices matter. First, mask the searchable transcript while retaining original audio under the retention rule — compliance can still pull the full call for an investigation, but everyday search, QA, and coaching surfaces never expose raw identifiers. Second, make redaction rules tunable per project: a healthcare project may need to retain the medical record number in the transcript because clinical workflow depends on it, while masking the Emirates ID; a collections project may need the opposite. Default-on redaction with per-project exceptions beats per-field opt-in, because opt-in redaction reliably lags new data categories.

What audit trails do regulators expect on recordings and transcripts?

When SAMA, the DFSA, a data-protection authority, or a court asks about a call, three questions follow the recording itself: who has accessed it, has it been altered, and can you produce it promptly. The corresponding controls are access logging (every transcript view and audio retrieval logged with user, time, and scope — with privileged compliance-team access logged separately), integrity protection (append-only storage so transcripts and logs cannot be silently edited; any redaction or correction recorded as a new auditable event), and retrievability (full-text search that finds the disputed call in seconds, not a week of manual trawling).

These mechanics also serve the data-protection side: access logs evidence that the purpose limitation is real (QA staff are not browsing celebrity callers), and deletion logs evidence that retention policy executes. CallScribe ships them as defaults — append-only storage, per-view transcript access logs, role-based access via PostgreSQL Row-Level Security, and per-project retention enforcement — but tooling only covers the operational half. The governance half (who is entitled to access, quarterly privileged-access review, how regulator requests are handled) belongs in your written procedures, and it is the half inspections ask about first.

Retention schedule starting points by sector

Starting numbers practitioners use when drafting a GCC retention schedule — every line should be confirmed against current circulars for your specific licence with counsel before adoption.

• DIFC-authorised firms, client-order calls — minimum six years (DFSA COB Rule 3.4.6); FSRA equivalents for ADGM firms
• Saudi financial services (KYC verbal verification, investment sales, disputes) — typically five to ten years under SAMA-aligned and Insurance Authority rules
• UAE licensed telecom operators, customer-care calls — at least one year, longer for disputed transactions (TDRA v3.0, 2022)
• Saudi licensed-service operator calls — retention scaled to interaction type under CST rules; disputes held longer than general support
• Unregulated QA and coaching recordings — commonly 90 days to 2 years, set by documented purpose; CallScribe's platform default is 90 days, user-configurable
• Healthcare-adjacent calls — follow health-data rules (in-UAE storage under Federal Law No. 2 of 2019) and provider record-keeping policy; commonly 5 years or more
• Legal hold — any litigation or investigation suspends deletion for affected calls until the hold lifts; the hold workflow must override automated expiry
• Transcripts and analytics derivatives — same clock as the source audio unless deliberately configured shorter; deletion cascades to all derivatives