Ensuring data sovereignty in compliance call recording

Data sovereignty is becoming a pressing concern for all organisations. All data needs to comply with local data privacy storage and processing requirements. How can you ensure the sovereignty of your data, particularly if your organisation spans several countries?

It’s estimated that around 74% of businesses worldwide currently use data warehouse services of public cloud providers^[1]. Perhaps more worrying is that 45% of organizations faced four or more cloud-related security incidents over the last year^[2].

As a result, data sovereignty has become a pressing subject. While many organisations place the onus on the service provider for cloud data security, 44% still consider the exposure of personal data as their main concern when it comes to storing data in the cloud, above governance and compliance^[3]. Of course, data security and compliance go hand in hand, and most decision makers believe that it is the responsibility of the cloud service provider to protect their data.

Data sovereignty governs how and where your data is stored

Data sovereignty relates to the laws governing the country in which the data resides. So, for example, there are strict laws under the General Data Protection Regulation (GDPR), which prioritise safeguarding citizens’ privacy rights.

One of the most important aspects of the GDPR is that data transferred outside the EEA must comply with strict rules — through ‘adequacy’ decisions, Standard Contractual Clauses (SCCs) or other recognised transfer mechanisms.

It requires organisations to have a comprehensive understanding of where the data is stored and processed, and to put in place data sovereignty strategies across the board to ensure GDPR compliance.

However, if data is shared across borders, it remains subject to GDPR while also becoming subject to the local legislation of the country in which it is subsequently stored or accessed.

Therefore, multinational companies are likely to have different regulations depending on the location, which can make things complicated, especially when data is being collected and stored by different departments – for example, sales, marketing, and billing – in different countries, and potentially then shared across borders.

For example, data stored in, or shared with, the U.S. can also be subject to the California Consumer Privacy Act, while data shared with, or stored in Singapore will need to comply with obligations of the Personal Data Protection Act. It means that data sovereignty or data storage is by no means a simple requirement.

Other reasons for storing data elsewhere might include for tax or performance requirements. Either way, data is subject to the location in which it is stored and processed… and where it is shared.

Ensuring data sovereignty regardless of location

It means that any compliance solution must support local data sovereignty rules by storing and processing customer data according to the locale’s regulations, while offering the ability to securely share calls across borders while still adhering to all local rules. 

Touch Call Recording Service has been ensuring call recording compliance for customers throughout Europe for 15 years.  We support compliance with local regulations through configurable residency, contractual safeguards, and audited controls.

Our service covers more than 60 channels, including PBX deployments (of all types), fixed and mobile calls ( via specific operator integrations), MS Teams, vertical enterprise applications such as Bloomberg Chat and LSEG Messenger, and many others.

At the end of every conversation — voice or digital — we apply a two-stage encryption process to all files,  in line with ETSI security guidance for lawful interception and data retention.

First, a new, random secret key is generated for each data file (AES, 256 bits). Then, the random key is encrypted with an RSA asymmetric encryption algorithm with a key length of 2,048 bits. The encrypted file-key is stored securely together with the metadata in the database, ensuring that no unencrypted keys are ever exposed and that the recordings maintain the strongest security, as well as verifiable integrity.

Files are stored in our private cloud/secure data centre and then replicated to ensure geo-redundancy and business recovery. Cross-border replication is only performed under approved transfer mechanisms, meaning that you can rest assured we are taking care of your data sovereignty concerns — both at the point of recording and for the resulting storage.

Our continuous technology and compliance roadmap also ensures that your data will always comply with the relevant regulations, regardless of where it is stored and according to any new compliance obligations.

Contact us today to discuss how we can align your call recording with data sovereignty requirements, in every jurisdiction in which you operate.

^[1] https://www.statista.com/statistics/1476419/firms-usage-of-public-cloud-services-global/

^[2] https://spacelift.io/blog/cloud-security-statistics#

^[3] https://www.checkpoint.com/cyber-hub/cloud-security/what-is-cloud-security/top-cloud-security-issues-threats-and-concerns/