PCI DSS Call Recording for UK Showrooms: The Complete Compliance Guide
If your showroom records telephone calls and takes card payments by phone, PCI DSS v4.0.1 directly affects you. Here is what the standard requires, what most small showrooms currently get wrong, and what compliant call recording actually looks like. (This is general guidance. IBIOS does not record calls and has no feature that stops or restarts a recording.)
What does PCI DSS require for call recording?
The Payment Card Industry Data Security Standard (PCI DSS) is a set of security requirements developed by the PCI Security Standards Council. Version 4.0.1, which became mandatory for all businesses in March 2025, is explicit about what must not happen with call recordings.
Requirement 3.3.1 prohibits storing sensitive authentication data (SAD) after authorisation. SAD means full track data, the card verification code (CVV or CVC), and the PIN or PIN block. The full card number (PAN) is not SAD: it is cardholder data, which must be protected wherever it is stored. If your call recording system captures the security code during a phone payment, you are storing prohibited data, even if the recording is only kept for quality assurance and never intentionally accessed for payment data. If it captures the card number, the recordings themselves come into PCI DSS scope.
The standard does not prohibit recording calls that include card payments. It prohibits storing card data within those recordings. The distinction matters because it has a specific technical solution: pause/resume recording.
What is the legal position on call recording in the UK?
PCI DSS is not a UK law. It is a contractual requirement imposed by the card brands (Visa, Mastercard, American Express) through your acquiring bank. When you agreed to accept card payments, you agreed to comply with PCI DSS as part of your merchant agreement. Non-compliance can result in fines levied by the card brands against your acquiring bank, which will typically pass them on to you, and ultimately in the loss of your ability to accept card payments.
The ICO (Information Commissioner’s Office) adds a separate layer. Under UK GDPR, card numbers are personal data. Storing them in call recordings without a lawful basis, or retaining them longer than necessary, is a data protection breach. If card data stored in recordings is later accessed by an unauthorised party, you have a reportable data breach under Article 33 of UK GDPR.
The FCA does not regulate PCI DSS directly, but if your showroom offers consumer credit or finance options, FCA conduct requirements around customer data protection apply alongside the ICO framework. The practical effect for most small showrooms is that PCI DSS compliance and UK GDPR compliance are complementary requirements pointing in the same direction: do not store card data in call recordings.
What do small showrooms typically get wrong?
The most common failure mode for small showrooms is recording everything. A standard call recording system, enabled without any PCI DSS configuration, records every second of every call — including the portion where the customer reads out their 16-digit card number, expiry date, and CVV. The recording is stored on a server or in the cloud, retained for a defined period (often a long one, for QA purposes), and accessible to anyone with system credentials.
This creates a searchable archive of card numbers. If the server is breached, or if a staff member with legitimate system access decides to misuse it, the card data is available in a usable format. The fact that it was never intentionally stored as “card data” is irrelevant to the liability.
The second common failure is inconsistent manual pause/resume. Some showrooms instruct staff to manually pause the recording before asking for card details. In practice, this relies on every staff member remembering to do it for every call, every time, without exception. Human processes are not sufficiently reliable for a compliance requirement that carries financial penalties.
What compliant call recording looks like
Compliant call recording for phone card payments uses automatic pause/resume. The call flow is designed so that when the agent moves to the payment section, the recording pauses automatically — triggered by a specific point in the call script, an IVR step, or a system event when the payment gateway is initiated. The recording resumes once the payment confirmation is received and the card detail section is over.
The resulting audio file covers the full call minus the card entry section. You have a complete quality assurance record of the customer service interaction, the product discussed, the price agreed, and the confirmation of payment — without any card data in the recording. This keeps sensitive authentication data out of the recording, as PCI DSS Requirement 3.3.1 requires, keeps card numbers out of it too, and removes the UK GDPR data storage risk.
Access controls on stored recordings are a secondary requirement. Recordings should only be accessible to staff with a legitimate business reason to review them. Your call recording system should log who accessed which recording and when. Recordings should be retained only as long as needed for QA or legal purposes, and then deleted on a defined schedule.
How IBIOS handles this, and the cost of not acting
IBIOS does not record calls, and it does not stop or restart recordings during a payment: your phone provider makes the recordings, so ask your provider how it keeps card details out of them. What IBIOS offers today is a way to keep card details off the phone altogether: staff send the customer a pay by link through SumUp or Stripe, the customer pays on the provider's page, and the payment is recorded against the job. IBIOS does not store card numbers.
Which Self-Assessment Questionnaire (SAQ) applies to you depends on how you take phone payments and on your acquiring bank's requirements, so check with your acquirer. The administrative cost of completing the SAQ is modest. The cost of a breach is not.
Card brand fines for a data breach involving stored card numbers depend on the scale and whether the breach was preventable. The ICO can add GDPR fines of up to £17.5 million or 4% of annual turnover, whichever is higher — though in practice, fines for small businesses are substantially lower. The reputational damage of notifying customers that their card details may have been compromised is harder to quantify but real. For a small showroom with a local customer base, it is the kind of event from which recovery is difficult.
Key takeaways
- ✓PCI DSS v4.0.1 is mandatory from March 2025. It applies to any business taking card payments by phone, regardless of size.
- ✓Requirement 3.3.1 prohibits storing sensitive authentication data, such as the card security code, after authorisation. Recording the call is permitted; card details should be kept out of the recording.
- ✓Keep card details off recorded calls. Sending a payment link is the simplest route; if your phone system can stop recording automatically, that beats relying on staff to remember a manual pause.
- ✓UK GDPR applies alongside PCI DSS. Card numbers stored in recordings are personal data subject to ICO enforcement.
- ✓The cost of a breach is substantially higher than the cost of compliant call recording software.
Related IBIOS pages and free tools
IBIOS builds call reports and call briefings from the recordings your phone provider already makes; it does not need a second recording system.
IBIOS (Integrated Business Intelligence & Operations System) is made by IBIOS Limited (NI743167), Northern Ireland. Access is by waiting list; there is no free trial.
- Call intelligence: call reports and call briefings built from the recordings your phone provider already makes; coaching insights coming soon.
- Call recording: how IBIOS uses the call recordings your phone provider already makes.
- Taking card payments by phone under PCI DSS: short guidance on keeping card details out of recordings, including pay by link.
- IBIOS for showroom retailers: the sector page for UK trade showrooms.
- The hidden cost of missed calls: our article on what unanswered calls cost a trade business.
Frequently asked questions
Do UK small businesses need to comply with PCI DSS?
Yes. PCI DSS applies to any organisation that stores, processes, or transmits cardholder data — regardless of size. If your showroom takes card payments by phone, you are within scope. Which SAQ (Self-Assessment Questionnaire) you complete depends on how you take payments, so check with your acquirer, but the compliance obligation itself does not have a small-business exemption. From March 2025, PCI DSS v4.0.1 is the mandatory version.
Can I record calls where customers give card details?
You can record the call, but card details should be kept out of the recording. Under PCI DSS v4.0.1, Requirement 3.3.1 prohibits storing sensitive authentication data, such as the card security code (CVV or CVC), after authorisation. The card number itself is cardholder data, and keeping it in an audio file brings your recordings into PCI DSS scope. The standard approach for compliant call recording is pause/resume: the recording pauses before the caller reads out card details and resumes once the payment is complete. The resulting audio file contains no card data.
What is pause/resume call recording?
Pause/resume is a feature in call recording systems that stops the recording at a defined point — typically when a caller is about to provide payment card details — and restarts it once the sensitive section is complete. The recorded file contains the non-sensitive parts of the call only. The pause can be triggered manually by the agent or automatically by the call flow. Automatic triggering is more reliable for compliance purposes because it does not depend on the agent remembering to pause.
Does my call recording software need to be PCI DSS certified?
There is no formal PCI DSS certification for call recording software as a standalone product. What matters is that your overall system — including how calls are recorded, stored, and accessed — meets the requirements of your applicable SAQ. Using software that supports pause/resume and stores recordings in an access-controlled environment is the foundation. You should also ensure your provider has a Data Processing Agreement in place and that recordings are retained only as long as necessary.
What are the penalties for storing card data in call recordings?
If cardholder data is stored in call recordings and the recordings are accessed by an unauthorised party, the card brands (Visa, Mastercard) can impose fines on your acquiring bank, which are typically passed on to you. The size of any fine depends on the scale of the breach. The ICO can additionally impose fines under UK GDPR for personal data breaches. Beyond fines, a data breach involving card numbers typically requires customer notification and may result in the card brands removing your ability to accept card payments.
Keep card details off the phone.
Send a pay by link through SumUp or Stripe and record the payment against the job. Early access by waiting list.