FAQ 1210: Are audio/voice recordings permitted to contain sensitive authentication data?

Publisher

PCI Security Standards Council

URL

https://www.pcisecuritystandards.org/faqs/1210/

Published

2025-06-01

Updated

unknown

Accessed

2026-09-30

HTTP status

200

License

PCI SSC website terms; all rights reserved; no-redistribution; short excerpts and locators only

Source notes citing this source

• Agent-initiated recording pause (Webex Contact Center pause, Genesys Secure Pause) depends on the agent acting in time, so a missed pause leaves SAD in the recording and triggers the FAQ 1210 duty to delete it securely after authorization. inferred in context
• Storing card validation codes (CAV2, CVC2, CVV2 or CID) in any form of digital audio recording after authorization violates PCI DSS Requirement 3.3.1. in context
• FAQ 1210 states that PCI DSS does not override local or regional laws on retaining audio recordings. in context
• Compensating controls for SAD retained in call recordings are validated during the annual PCI DSS assessment and shared with acquirers or payment brands as needed. in context
• Where secure deletion of SAD from recordings is not feasible, FAQ 1210 sets minimum compensating controls: a risk assessment annually and after significant change, protection of the SAD under applicable PCI DSS requirements, controls that prevent access to the SAD and querying of call recordings, and documented justification and evidence. in context
• If sensitive authentication data cannot be kept out of a call recording, FAQ 1210 requires it to be securely deleted immediately after the transaction is authorized. in context
• The PCI DSS prohibition on keeping sensitive authentication data in call recordings after authorization applies even when the recording is encrypted. in context
• PCI SSC FAQ 1210 says that where sensitive authentication data is collected during a call, the entity should prevent it from being recorded, enabling audio suppression or redaction technology where it exists. in context

Cite this source record

APA

WarmTransfer. (2025, June 1). FAQ 1210: Are audio/voice recordings permitted to contain sensitive authentication data?. WarmTransfer. https://warmtransfer.net/knowledge/sources/pcissc-faq-1210-audio-recordings-sad

BibTeX

@misc{warmtransfer-pcissc-faq-1210-audio-recordings-sad,
  title  = {FAQ 1210: Are audio/voice recordings permitted to contain sensitive authentication data?},
  author = {{WarmTransfer}},
  year   = {2025},
  url    = {https://warmtransfer.net/knowledge/sources/pcissc-faq-1210-audio-recordings-sad},
  note   = {PCI Security Standards Council, accessed 2026-09-30}
}