Privacy in the cloud: where your call recordings and call data end up

What data a call leaves behind (more than you think)

When you think of a business call, you probably picture just the audio. In reality, a call that goes through a cloud phone system generates several layers of information:

• The recording: the voice of the customer and your agent, with everything that was said. It may include names, ID numbers, addresses or, in sectors like healthcare, highly sensitive information.
• The call record (CDR): who called, which number, at what time, how long it lasted and which agent answered. Even without audio, it says a lot about a person.
• Transcripts and summaries: if you use AI voice agents or conversation analytics, the audio becomes text that can easily be searched, copied and shared.
• Customer data: the record in your CRM, the agent's notes, the purchase or payment history associated with each contact.

In Colombia, anything that can identify a person is personal data, and that includes their voice. That's why all these layers fall under the data protection framework.

Where it is stored and why you should care

“It's in the cloud” is not a complete answer. Behind it are physical servers in a specific country, managed by specific people. These are the questions that really matter:

• Storage country: if the data leaves Colombia, you enter the realm of international transfer or transmission, which has its own rules.
• Encryption in transit: the call and the files must travel protected between the phone, the phone system and storage, so no one can intercept them along the way.
• Encryption at rest: stored recordings must be encrypted, so that a stolen copy of the disk is useless without the keys.
• Backups: backups are personal data too. If you delete a recording from the main system but it lives on in a backup for years, you haven't really deleted it.
• Who has access: your team, the provider, the provider's subcontractors. Every access should be justified and logged.
• How long it is kept: keeping everything “just in case” and forever increases risk without adding value.

What the law requires in Colombia

The main framework is Ley 1581 de 2012 (Colombia's personal data protection law) and its implementing regulation, Decreto 1377 de 2013, now compiled in Decreto 1074 de 2015. As of October 2026, Ley 1581 remains in force; bills to modernize it have been introduced in Congress, but until they complete the legislative process, these are the rules that apply:

• Prior, informed authorization: you need the data subject's permission no later than the moment you collect the data, and you must be able to prove it afterwards. It can be given in writing, orally or through unequivocal conduct, but silence never counts as consent.
• Recording notice and purpose: the person must know they are being recorded and why: quality, supporting a sale, contractual compliance. If you later want to use the recordings for another purpose, such as training an AI model, you need new authorization.
• Sensitive data: health information is sensitive. Processing it requires explicit authorization, and you must state that answering questions about that data is optional.
• Data subjects' rights: your customers can access, update, correct and request deletion of their data, request proof of authorization and file complaints with the Superintendence of Industry and Commerce (SIC). Claims have response deadlines set by law.
• Limited retention: data may only be kept for the reasonable and necessary time for its purpose, taking into account legal, accounting or contractual obligations. Once the purpose is fulfilled, it must be deleted.
• Data processing policy: you must have a written data processing policy in plain language, available to data subjects.
• Data outside the country: the law prohibits transferring data to countries without an adequate level of protection, with exceptions (such as the data subject's express authorization). When the foreign provider only processes the data on your behalf, as a processor, Decreto 1377 allows it under a data transmission agreement that sets out its security and confidentiality obligations.
• National Database Registry (RNBD): under Decreto 090 de 2018, companies and nonprofit entities with total assets above 100,000 UVT, as well as public entities, must register with the SIC. If your company doesn't reach that threshold, it must still comply with all other obligations.

The law also empowers the SIC to impose sanctions, including fines of up to 2,000 monthly minimum wages and suspension of activities. And if you use artificial intelligence on your calls, keep in mind the SIC's Circular Externa 002 de 2024, which asks companies to assess risks and, when the risk is high, conduct a privacy impact assessment.

If you also operate in Ecuador or Peru

Both countries have their own rules, so complying with Colombian law isn't enough:

• Ecuador: the Ley Orgánica de Protección de Datos Personales (Organic Law on Personal Data Protection) was published in the Official Registry in May 2021, and its sanctions regime has been in effect since May 2023. Its General Regulation was issued through Decreto Ejecutivo 904 and published in November 2023. It applies even to foreign companies that process data of people in Ecuador.
• Peru: Ley 29733 has a new regulation, approved by Decreto Supremo 016-2024-JUS, in force since March 30, 2025. Among its new features is the obligation to notify the authority of security incidents within a maximum of 48 hours and to appoint a personal data officer in certain cases, for example when processing large volumes of data or sensitive data as a core activity.

For example: a clinic that records its calls

Imagine a clinic in Medellín that books appointments by phone and records every call. In them, patients mention symptoms, medications and diagnoses: sensitive data. This is what it should have in order:

1. A message at the start of the call saying it is being recorded, why, and where to find the data policy.
2. Explicit authorization to process health data, stored in a way that can be proven.
3. A clear retention rule: for example, keeping scheduling recordings only as long as needed to handle complaints, then deleting them, including from backups.
4. Role-based access: the receptionist sees her schedule, the quality coordinator listens to samples, and nobody else downloads audio without leaving a trail.
5. A contract with its cloud telephony provider stating which country the servers are in, how files are encrypted and what happens to the data if the relationship ends.

A collections company would have a similar case, with an extra twist: in addition to data protection, it must follow the rules for contacting debtors set out in Ley 2300 de 2023.

Best practices you can apply right away

• A notice at the start of every call: short, clear and stating the purpose. Do the same on outbound calls and on calls handled by AI voice agents.
• A retention policy by call type: sales, support and collections don't need the same timeframe. Define each one and automate deletion.
• Role-based access and audit logs: make sure each person sees only what they need and that there is a record of who listened to or downloaded what.
• End-to-end encryption: in transit and at rest, including backups and exports.
• Contracts with your provider: a data transmission agreement that defines the storage country, security measures, subcontractors and return or deletion at the end.
• Security benchmarks: the ISO/IEC 27001:2022 standard describes how to set up a risk-based information security management system. A provider that knows it or is certified is a good sign, although it doesn't replace your own obligations.

What to ask your cloud telephony provider

Before signing up for a cloud PBX or a call center platform, ask for written answers to these questions:

1. In which country and which data center are recordings, logs and transcripts stored?
2. Are they encrypted in transit and at rest? Who manages the keys?
3. Where are backups kept and how long do they last?
4. Can I configure retention periods and automatic deletion?
5. Which provider staff can access my data, and is that access logged?
6. Do you use subcontractors or third-party AI services that process my audio?
7. Will you sign a data transmission agreement in line with Colombian law?
8. How will you notify me if there is a security incident?
9. What happens to my data if I cancel the service?

At 19 80 TIC Cloud we believe these questions should have clear answers from day one; if you'd like to review your case, you can write to us.

This article is general information and does not constitute legal advice. For specific decisions, consult a lawyer who specializes in data protection.