VoIP telephony must comply with the AVG by implementing appropriate technical and organizational data protection measures. This means organizations are required to secure personal data such as call metadata and recordings, ensure data location within the EU, justify retention periods, and be transparent about data processing. These requirements apply to all organizations using telephone voip for customer contact.
What personal data does VoIP telephony actually process?
VoIP systems process several categories of personal data, including call metadata (caller ID, time, call duration, call transfers), complete call recordings, contact information in directories, employee user profiles, and login information. This data falls under the AVG because it is directly or indirectly traceable to natural persons.
The key distinction for AVG compliance is that between traffic data and call content. Traffic data includes metadata about who contacted whom when and how long it lasted. Conversation content refers to actual audio recordings and transcripts of what was said. This distinction is relevant because different retention obligations and security levels may apply.
VoIP systems generate significantly more data than traditional telephony. Whereas classic phone systems often recorded only basic call data, modern phone voip solutions collect detailed information about user behavior, choices in IVR menus, wait times, call transfers, and interactions across multiple channels. This wealth of data provides valuable insights for customer service optimization, but also brings increased AVG responsibilities.
Organizations must document all processing in their processing log, including the purpose for which each data category is collected, who has access, and how long data is retained. This transparency is the basis for responsible data processing.
Where should VoIP call data be stored according to the AVG?
The AVG requires that personal data be adequately protected, with data location playing a crucial role. For Dutch and European organizations, this means that VoIP call data should preferably be stored within the EU, where full AVG protection is guaranteed without additional safeguards.
Storage outside the EU is not necessarily prohibited, but it requires appropriate safeguards such as standard contract provisions or binding corporate rules. Organizations should check with their VoIP provider as to where servers are physically located and where backups are kept. Cloud solutions with U.S. data centers pose specific risks since the Schrems II ruling by the European Court of Justice.
This ruling made it clear that the Privacy Shield agreement provided insufficient protection against U.S. government access to European data. For VoIP telephony, this means that providers who store data on U.S. servers must take additional technical measures, such as end-to-end encryption where the provider itself does not have access to decrypted call data.
Dutch organizations in sensitive sectors such as healthcare, government or legal services often consciously choose VoIP vendors with exclusively Dutch or European data centers. This eliminates complex legal issues surrounding international data transfers and provides clarity towards privacy officers and regulators.
When selecting a phone voip solution, it is wise to contractually stipulate that call data will be processed and stored exclusively within the EU, including all backups and disaster recovery provisions.
How long can call recordings be kept under the AVG?
The AVG has no fixed retention period for call recordings, but uses the principle of storage limitation. This means that organizations may not retain personal data longer than necessary for the purpose for which it was collected. Each organization must set its own retention period appropriate to their specific processing purpose.
Typical retention periods vary by industry and purpose. For quality assurance in customer service, organizations often use 30 to 90 days. Financial institutions sometimes retain recordings longer because of legal obligations for dispute resolution, for example, 5 to 7 years for mortgage opinions. Healthcare institutions often use shorter periods of several weeks, unless specific medical or legal reasons warrant longer retention.
For training and coaching purposes, a retention period of a few months is usually sufficient. Organizations that use recordings for dispute resolution must consider statutes of limitations, but cannot by default keep all recordings for years “just in case.” The AVG requires that retention remain proportional.
It is essential that organizations set up automatic deletion in their VoIP system. Manual selection of recordings to be deleted is impractical with large volumes and increases the risk of AVG violations. Modern phone voip solutions offer configurable retention policies that automatically delete recordings after the set time period.
All retention decisions should be documented in the processing register, including the rationale for why a specific time period was chosen. This documentation is essential in case of audits or questions from the Personal Data Authority.
What are the security obligations for VoIP under the AVG?
The AVG requires appropriate technical and organizational measures to protect personal data from unauthorized access, loss or theft. For VoIP systems, this means a combination of encryption, access control, logging and regular maintenance.
Encryption is fundamental to VoIP security. Call data must be encrypted both in transit (between phones and servers) and in storage. For transport, professional phone VoIP typically uses TLS for signaling and SRTP for the audio streams themselves. Stored call recordings should also be kept encrypted, preferably with strong encryption algorithms.
Access control determines who can listen to call recordings or view metadata. Organizations must maintain strict authorizations where only authorized employees (e.g., quality assurance team leaders) have access. Multi-factor authentication for access to the VoIP management portal is an important additional safeguard.
Logging and audit trails record who listened to or exported which call recordings when. These logs are essential for demonstrating compliance and detecting unauthorized access. They themselves must be protected from tampering.
Regular security updates and patches for VoIP systems are crucial. Outdated software often contains known vulnerabilities that attackers can exploit. Backup procedures should ensure that call data is not lost, but these backups should also be encrypted and access-protected.
The AVG takes a risk-based approach. Organizations that conduct sensitive conversations (healthcare, legal, financial advice) must implement more stringent security measures than organizations with standard customer service on product inquiries. The sensitivity of call content helps determine the level of protection required.
How do you ensure AVG-compliant VoIP telephony in practice?
Practical AVG compliance for VoIP systems starts with entering into a processing agreement with your VoIP provider. This agreement describes what personal data the provider processes on behalf of your organization, what security measures apply, where data is stored, and for how long. Without a valid processor agreement, use of external VoIP services is not AVG-compliant.
Large-scale call recording often requires a Data Protection Impact Assessment (DPIA). This is especially true when large volumes of calls are systematically recorded, such as in contact centers. A DPIA analyzes privacy risks and describes how they are mitigated. The outcome helps design a proportional and lawful processing design.
The information requirement requires that callers be informed about call recording. This is usually done through an automated warning message at the beginning of the call. This notification must make it clear that the call is being recorded, for what purpose, and how long the recording will be kept. Silent recording without warning is not permitted.
Explicit consent is required in certain situations, for example when recording calls that are not directly related to the performance of a contract. For standard customer service recordings, a legitimate interest (quality control) is usually sufficient, provided callers are informed and can refuse.
Organizations must establish processes for exercising privacy rights. Callers have the right to access their call recordings, correction of inaccurate data, and deletion when there is no longer a valid ground for retention. Your VoIP system should allow specific recordings to be retrieved and deleted upon request.
For a complete security architecture to support these requirements, it is important that the technical fundamentals are in place. A professional phone system provides the necessary compliance features such as automatic retention policies, role-based access control, and audit logging that are essential for AVG compliance.
We support organizations in implementing AVG-compliant VoIP solutions by cleverly combining proven modules into customized solutions, without the cost of traditional development. Our ISO 27001 certification ensures that information security is structurally secured in all systems and processes. For organizations looking to integrate multiple channels, we offer omnichannel business telephony solutions, while larger organizations with complex customer service needs can benefit from our advanced ContactCenter platform.
Frequently Asked Questions
Moet ik toestemming vragen aan bellers voordat ik gesprekken opneem?
Niet altijd. Voor klantenservice-opnames ten behoeve van kwaliteitsbewaking of contractuitvoering volstaat meestal een ‘gerechtvaardigd belang’ als rechtsgrondslag, mits je bellers informeert via een waarschuwingsmelding. Expliciete toestemming is wel nodig wanneer opnames niet direct gerelateerd zijn aan de dienstverlening, of wanneer bijzondere persoonsgegevens (zoals gezondheidsdata) verwerkt worden. Bellers moeten altijd de mogelijkheid hebben om bezwaar te maken tegen opname.
Wat moet ik doen als een klant verzoekt om verwijdering van een gespreksopname?
Je moet het verzoek binnen één maand beoordelen en uitvoeren, tenzij je een geldige weigeringsgrond hebt zoals een wettelijke bewaarplicht of een lopend geschil waarbij de opname als bewijs dient. Zorg dat je VoIP-systeem het mogelijk maakt om specifieke opnames te identificeren en te verwijderen op basis van datum, telefoonnummer of andere zoekparameters. Documenteer het verzoek en je respons voor je verwerkingsregister.
Hoe kan ik controleren of mijn huidige VoIP-provider AVG-compliant is?
Vraag je provider naar hun verwerkersovereenkomst, de fysieke locatie van datacenters en back-ups, hun beveiligingsmaatregelen (encryptie, toegangscontrole), en of ze audits of certificeringen hebben zoals ISO 27001. Controleer of ze subverwerkers gebruiken en waar die gevestigd zijn. Een betrouwbare provider kan deze informatie direct verstrekken en heeft standaard verwerkersovereenkomsten beschikbaar die voldoen aan AVG-eisen.
Wat zijn de risico's als ik geen verwerkersovereenkomst heb met mijn VoIP-aanbieder?
Zonder verwerkersovereenkomst ben je niet AVG-compliant en loop je het risico op boetes van de Autoriteit Persoonsgegevens tot €20 miljoen of 4% van de wereldwijde jaaromzet. Daarnaast heb je geen contractuele garanties over hoe je provider met gespreksdata omgaat, waar deze opgeslagen wordt, en welke beveiligingsmaatregelen gelden. Bij een datalek ben je als organisatie aansprakelijk, ook al vond het lek plaats bij de provider.
Kunnen medewerkers zomaar gespreksopnames van collega's beluisteren?
Nee, toegang tot gespreksopnames moet strikt beperkt worden op basis van functie-eisen. Alleen geautoriseerde personen zoals teamleiders of kwaliteitsmedewerkers mogen opnames beluisteren voor legitieme doeleinden zoals coaching of kwaliteitsbewaking. Implementeer rolgebaseerde toegangscontrole in je VoIP-systeem en registreer via audit logs wie wanneer welke opnames heeft beluisterd. Medewerkers moeten ook geïnformeerd worden dat hun gesprekken opgenomen kunnen worden.
Wat moet ik doen bij een datalek met VoIP-gespreksdata?
Bij een datalek dat waarschijnlijk risico’s oplevert voor betrokkenen moet je binnen 72 uur melding doen bij de Autoriteit Persoonsgegevens. Documenteer wat er gebeurd is, welke data gelekt is, hoeveel personen getroffen zijn, en welke maatregelen je neemt. Bij hoog risico moet je ook de betrokkenen direct informeren. Voorkom datalekken door sterke encryptie, toegangscontrole en regelmatige beveiligingsupdates te implementeren in je VoIP-infrastructuur.
Mag ik gespreksopnames gebruiken voor training van AI-modellen of chatbots?
Alleen als dit doel expliciet vermeld is in je privacy statement en je hiervoor een rechtmatige grondslag hebt. Als bellers alleen geïnformeerd zijn over opname voor kwaliteitsbewaking, mag je de data niet zomaar voor AI-training gebruiken zonder aanvullende informatie of toestemming. Overweeg anonimisering van gespreksdata waarbij alle persoonsherleidbare elementen verwijderd worden, zodat de AVG niet meer van toepassing is. Documenteer dit nieuwe verwerkingsdoel in je verwerkingsregister.
