Source note · PCI DSS for contact centers
Where secure deletion of SAD from recordings is not feasible, FAQ 1210 sets minimum compensating controls: a risk assessment annually and after significant change, protection of the SAD under applicable PCI DSS requirements, controls that prevent access to the SAD and querying of call recordings, and documented justification and evidence.
Checked 2026-09-30
- Vendor
- PCI SSC
- Product
- PCI DSS
- Subsystem
- call recording
- Deployment
- any
- Region
- not restricted
- Release range
- PCI DSS v4.x as of 2026-09-30
- Checked
- 2026-09-30
Sources
- FAQ 1210: Are audio/voice recordings permitted to contain sensitive authentication data? — PCI Security Standards Council · tier 1 standards and regulators · FAQ 1210, compensating-control list
Cite this note
APA
WarmTransfer. (2026, September 30). PCI DSS for contact centers: source note pci-dss-contact-center-recording-sad-compensating-controls. WarmTransfer. https://warmtransfer.net/knowledge/claims/pci-dss-contact-center-recording-sad-compensating-controls
BibTeX
@misc{warmtransfer-claim-pci-dss-contact-center-recording-sad-compensating-controls,
title = {PCI DSS for contact centers: source note pci-dss-contact-center-recording-sad-compensating-controls},
author = {{WarmTransfer}},
year = {2026},
url = {https://warmtransfer.net/knowledge/claims/pci-dss-contact-center-recording-sad-compensating-controls},
note = {Source note pci-dss-contact-center-recording-sad-compensating-controls, checked 2026-09-30}
}