Are there any guidelines around the storing of voice recordings?
Many merchants use a call center to accept payments from their customers and this generally means that payments will be taken over the phone. If this data is being recorded in an analogue format (i.e. on tape) and there is no way to access this data other than by manually searching through it, then the tapes must be subject to the same level of security as normal paper transaction records. Access must be restricted to this data and it must be held in a secure storage facility. If this data is stored electronically and could be searched using data mining or other automated means, the same access controls methods would need to be adopted as for any storage of digital media. This will include the removal of the CVV2 checks after authorization, and will involve rendering the PAN unreadable using any of the accepted techniques. If in doubt you must contact a Qualified Security Assessor (QSA).
