- A call center handles sensitive personal data every day: numbers, names, addresses, voice recordings and WhatsApp chats. Protecting it is the company's responsibility before the vendor's.
- Key references in the Kingdom: the Personal Data Protection Law (PDPL), the National Cybersecurity Authority (NCA) controls and CST regulations.
- In practice: data in the Kingdom, precise permissions per role, two-factor authentication, recordings protected with backup, and a log of every sensitive access.
- This article is a practical summary, not legal advice; check with your legal counsel and compliance officer.
The call center is where more customer data flows than anywhere else in the company: every call carries a name and a number, sometimes an ID number, an address or order details. Every recording is personal data. Every WhatsApp chat holds photos and documents. Imagine that data leaking, or an employee leaving with the customer list, and it is clear why data security has become a core question when choosing a call-center system.
With the PDPL in force in the Kingdom and NCA controls expanding, companies now ask clear questions: where is our data stored? Who can see it? How do we protect recordings? This article answers them practically.
What is sensitive data in a call center?
| Data type | Examples | Sensitivity |
|---|---|---|
| Identity data | Name, mobile, e-mail, address | Medium to high |
| Voice recordings | Inbound and outbound call recordings | High: the customer's voice and what they said |
| Conversations and attachments | WhatsApp messages, ID photos, documents | High |
| Financial data | Invoices, amounts due, payment status | High |
| Health data | In clinics: appointment, service type and notes | Very high |
| System logs | Who logged in, when and what they did | Important for investigation and review |
The good news is that most security requirements do not need a huge project. They need clear decisions: where data is stored, who sees it, how people log in, and how data is restored after a failure. When the platform itself is built on these principles, compliance becomes part of daily work rather than an extra burden on IT.
The regulatory references in brief
The Personal Data Protection Law
Overseen by the Saudi Data and AI Authority (SDAIA), it sets how companies collect, use and store personal data. The key practical principles for a call center: collect data for a clear purpose, inform the customer, do not use it for other purposes without a legal basis, store it securely, enable customer rights such as access and correction, and watch the rules on transferring data outside the Kingdom.
NCA controls
The NCA has issued Essential Cybersecurity Controls and Cloud Cybersecurity Controls. They are mandatory for certain entities (such as government bodies and critical infrastructure) and an excellent reference for any company. They focus on identity and access management, protection against intrusion, backup, logging and monitoring, and incident management.
The Communications, Space and Technology Commission (CST)
CST regulates telecom services in the Kingdom, including numbers and calls, so your communications provider should be licensed. For the legal side of call recording specifically, see our article on call recording rules in Saudi Arabia.
In-Kingdom hosting: why it matters
One of the first questions to ask any cloud call-center vendor: where are the servers? Hosting data inside the Kingdom gives you:
- Easier compliance: the PDPL places conditions on transferring personal data abroad, and some sectors and entities require data to stay in the Kingdom.
- Better call performance: nearby servers mean lower latency and better voice quality.
- Clear accountability: data sits directly under Saudi law.
On the Klamna platform, servers and core data are inside the Kingdom on cloud infrastructure in partnership with Alibaba Cloud, and the platform aligns with cybersecurity requirements and the PDPL. More on the trust and security page.
Protecting voice recordings
Recordings are the most valuable and most risky data in a call center: you need them for quality, training and disputes, and a leak is a serious problem. Core practices:
- Listening permissions: not everyone hears every recording. Reps hear their own calls, supervisors their team, quality as needed.
- Limited downloads: decide who can download a recording as a file, because a downloaded file leaves the system's control.
- Backup: recordings must be backed up so a failure or mistake cannot wipe months of calls.
- Retention: set how long you keep recordings based on your needs and sector requirements; do not keep them forever without reason.
In Klamna, recording backup uploads recordings to secure cloud storage during the day, verifies them every night, and lets you choose how many days they stay on the main server, so no recording is lost. Recording itself is controlled from call recording settings.
Permissions: everyone sees only what they need
Most data leaks in companies do not come from a hacker; they come from permissions wider than necessary. The golden rule: the least access that gets the job done.
| Role | Needs to see | Does not need |
|---|---|---|
| Customer service agent | Their assigned chats and calls, and the customer record | Full company reports, settings, all recordings |
| Sales rep | Their own customers and leads only | Other reps' customers, database export |
| Team supervisor | Their team: calls, recordings, reports and live monitoring | Other teams, financial settings |
| System administrator | Settings and users | Not necessarily every recording |
In Klamna you can edit the built-in roles or create custom ones, and set view, create, edit and delete rights per page. You can also restrict a role so the user sees only contacts and leads assigned to them or their team, even in imports and campaigns. Details in CRM for sales teams.
Secure login and logs
- Two-factor authentication: a password alone is not enough. Enable 2FA, especially for managers and anyone with wide access.
- Disable accounts immediately: when someone leaves, disable their account the same day. In Klamna their data and conversations stay with the company.
- Logging sensitive access: in team chat, for example, management access to staff conversations is logged: who and when. That protects both sides.
- Scoped API keys: any connected external system gets only the permissions it needs, and you can revoke the key at any time.
- Live call monitoring by permission: listen, whisper and barge (for training and quality) are reserved for designated supervisors.
WhatsApp and customer chats: special security points
WhatsApp is now a core part of the call center, and it brings its own risks. The biggest is staff using personal phones to answer customers, so ID photos, contracts and addresses end up on devices the company does not own. The fix is to run every conversation on the company's official number through the WhatsApp API, with staff replying from the platform under their permissions and attachments staying in the company system. When someone changes role or leaves, conversations stay with the company and the customer is unaffected.
A practical checklist for choosing a secure call-center vendor
- Are servers and data inside the Kingdom?
- Is the vendor licensed by CST for communications services?
- Does the platform align with cybersecurity requirements and the PDPL?
- Are roles and permissions editable per page?
- Is two-factor authentication supported?
- How are recordings protected? Is there backup with regular verification?
- Can you set retention for recordings and conversations?
- What happens to your data if you cancel? Can you export it?
- Are there logs showing who accessed sensitive data?
Steps to start this week
- Review the user list: remove or disable accounts of anyone who has left.
- Review who can play and download recordings, and cut it to the minimum.
- Enable two-factor authentication for managers.
- Move work messaging from personal WhatsApp groups to team chat.
- Write a short retention policy for recordings and conversations.
- Make sure recording backup is running and verified regularly.
Want to review the state of your call-center data? Talk to us and our well-equipped team will show you how to set permissions, recordings and backup in Klamna, or sign up, build your own package and see the price before you pay.
FAQ
Is in-Kingdom hosting mandatory for every company?
Not to the same degree for every company, but the PDPL sets conditions on transferring data abroad, and some entities and sectors require it to stay in the Kingdom. Local hosting removes much of the complexity. Check your own case with legal counsel.
Does call recording require informing the customer?
Good practice is to tell callers the call may be recorded for quality purposes, usually with a voice prompt at the start. Details in our call recording article.
What is the right retention period for recordings?
It depends on your sector, needs and obligations. What matters is a defined, justified period written into a policy, not indefinite storage.
Does Klamna stop staff from leaking data?
No system prevents everything, but precise permissions, limiting each rep to their own customers, restricting downloads and exports, and logs reduce the risk significantly.
What happens to recordings if a server fails?
With recording backup, recordings are uploaded to secure cloud storage during the day and verified nightly, so they are not lost.
Does two-factor authentication slow staff down?
Hardly. It asks for a code at login only; a few seconds protect an account holding data on thousands of customers.
Your customers' data is a trust. Book a demo to see permissions, recordings and backup, or WhatsApp us on 966920031338.