How Long Should a Business Keep Voicemail?

Why this question matters

Most businesses never decide how long to keep voicemail. Messages pile up in a mailbox, get copied to email, and sit there for years. That is convenient until a caller asks what you hold about them, a staff member leaves with access to the inbox, or a breach exposes five years of messages nobody needed.

This guide explains what the rules actually say (as of October 2026), suggests a simple schedule you can adopt, and covers how to delete properly. It is educational, not legal advice. If you are in a regulated field such as health care, law or finance, check with your professional body or a lawyer.

Why voicemail is a record, not just a message

A voicemail is a recording of a person's voice, usually with their name, phone number and a reason for calling. Many also contain more sensitive details: an account number, a health concern, a complaint about an employee, a home address for a service call.

Under Canadian privacy law, that is personal information. Under US sector rules, it can be protected health information or part of a business record. Either way, it is data you are holding about someone, and the same questions apply as for any other customer file:

• Why do we keep it?
• Who can listen to it?
• When do we get rid of it, and how?

A transcript or an emailed MP3 is the same record in another form. Treat all copies together.

There is no voicemail-specific retention period

As far as the sources reviewed for this article show, no Canadian or US statute sets a retention period specifically for voicemail. There is no rule that says "keep business voicemail for 90 days" or "delete it after a year."

What exists instead is three kinds of rule that can apply to a voicemail depending on what is in it:

1. Privacy rules (Canada, Quebec, British Columbia, Alberta) that say keep personal information only as long as you need it, then destroy or anonymize it.
2. Record-keeping rules (CRA, IRS) that say keep tax records for a set number of years. These only matter if a voicemail is part of a tax record.
3. Sector and security rules (HIPAA for covered health entities, the US Stored Communications Act) that govern how stored messages are protected and who can access them.

So the honest answer to "how long should we keep voicemail?" is: as long as you have a real reason to, and no longer, unless a specific law requires a particular message to be kept.

Canada: PIPEDA retention and destruction

PIPEDA applies to private-sector organizations that collect personal information in the course of commercial activity, outside provinces with their own substantially similar law. Its Schedule 1 sets out ten principles. Three matter most here:

• Clause 4.5: personal information "shall be retained only as long as necessary for the fulfilment of those purposes" ^[1].
• Clause 4.5.2: organizations "should develop guidelines and implement procedures with respect to the retention of personal information," and those guidelines "should include minimum and maximum retention periods" ^[1].
• Clause 4.5.3: personal information no longer required "should be destroyed, erased, or made anonymous," and organizations "shall develop guidelines and implement procedures to govern the destruction of personal information" ^[1].

Clause 4.5.2 also says that information used to make a decision about someone must be kept long enough for them to access it afterward. If a voicemail led you to refuse a refund or cancel a booking, keep it until that matter is truly closed.

What the 2026 OPC findings add

On March 5, 2026, the Office of the Privacy Commissioner of Canada published findings on the PC Optimum loyalty program ^[2]. The case is about loyalty accounts, not voicemail, but three points translate directly to a small business phone line:

• Customer support records need a schedule. The OPC found it reasonable to keep logs of customer support interactions "for a limited amount of time," but said the company "must establish retention schedules for the deletion of these records as required by Principle 4.5.2" ^[2]. Voicemails left on a support or sales line are the same kind of record.
• Anonymizing is not a shortcut. If you choose to anonymize rather than delete, "the onus is on the organization to ensure, and demonstrate, that the information is sufficiently anonymized" ^[2]. A recording of someone's voice is hard to anonymize. For voicemail, deletion is the practical choice.
• Keeping too long is a contravention in itself. The OPC found the company was "retaining personal information longer than needed to fulfil the identified purpose," contrary to Principle 4.5.3 ^[2].

Quebec and British Columbia

Quebec's private-sector privacy act is stricter in wording. Section 23 says that once the purposes for which personal information was collected or used are achieved, the business "must destroy the information, or anonymize it to use it for serious and legitimate purposes, subject to any preservation period provided for by an Act" ^[3]. The same section says anonymized information must irreversibly no longer allow the person to be identified, which again points to deletion for voice recordings.

British Columbia's PIPA, section 35, adds a floor and a ceiling. If you use personal information to make a decision that directly affects someone, keep it "for at least one year after using it." Otherwise, destroy it or de-identify it as soon as it is reasonable to assume the purpose is no longer served and retention "is no longer necessary for legal or business purposes" ^[4].

Alberta's private-sector act says the same in plainer terms. Section 35 of PIPA lets a business keep personal information "only for as long as the organization reasonably requires the personal information for legal or business purposes," and then, within a reasonable time, destroy it or make it non-identifying ^[5].

When tax rules apply in Canada

The CRA requires businesses to keep "all required records and supporting documents for a period of six years" from the end of the last tax year they relate to, and dissolved corporations to keep certain records for two years after dissolution ^[6]. The rule covers electronic records too. A routine "please call me back" message is not a tax record. A voicemail would only fall under this rule in the rare case where it is the supporting document for a transaction, such as a recorded order or price agreement with no written confirmation.

US: tax records and sector rules

The US has no general federal privacy law that sets a retention limit for small-business records, so the rules that touch voicemail are narrower.

IRS record retention

The IRS says to keep records for 3 years in the usual case, 6 years if you fail to report income that is more than 25% of the gross income shown on your return, 7 years if you claim a loss from worthless securities or a bad debt deduction, and employment tax records for at least 4 years after the tax is due or paid ^[7].

As with the CRA rule, this only reaches a voicemail that is itself part of the record supporting a tax item.

HIPAA, for covered entities only

HIPAA applies to covered entities (health plans, health care clearinghouses and providers that transmit health information electronically) and their business associates. It does not apply to a plumber or a law office just because a caller mentions a medical issue.

For a covered clinic, two points are often confused:

• HHS says the Privacy Rule "does not include medical record retention requirements"; state laws generally decide how long medical records are kept. But covered entities must apply safeguards to protected health information "for whatever period such information is maintained," including disposal ^[8].
• The well-known 6-year figure comes from 45 CFR 164.316(b)(2)(i). It applies to the documentation of your security policies and required assessments, which must be kept "for 6 years from the date of its creation or the date when it last was in effect, whichever is later" ^[9]. It is not a rule to keep every patient voicemail for six years.

So a clinic's voicemail policy is mostly about protection and disposal, plus whatever its state's medical-records law says about messages that become part of a chart. Our voicemail-to-email checklist for small clinics covers the day-to-day handling.

A practical schedule: 30 / 90 / 365 days

This is a suggestion, not a legal rule. No statute sets these numbers. They are a simple starting point that fits the "keep only as long as needed" principle and gives you the written minimum and maximum periods PIPEDA clause 4.5.2 asks for. Adjust them to your business.

A few rules make the schedule work:

• Copy the facts, not the audio. Note the caller's request in your CRM or job file, then delete the recording. The note serves the business purpose; the audio rarely does.
• Name an owner. One person reviews the mailbox each month and deletes what is past its date.
• Write it down. A half-page policy with these four rows is the "guidelines" PIPEDA expects.

Deleting properly: mailbox, email copies, backups

PIPEDA clause 4.7.5 says "care shall be used in the disposal or destruction of personal information, to prevent unauthorized parties from gaining access to the information" ^[1]. In the 2026 findings, the OPC noted that disposal "applies to originals as well as copies and archived records," and that effective anonymization must include removing information "from back-up systems" ^[2].

For voicemail, that means a message is only gone when every copy is gone. Check each place it can live:

1. The phone system or dashboard. Delete the recording and any transcript.
2. Email. If your system sends voicemail to email, each message is now also an email, and it falls under your email retention policy. Delete it from the inbox, then from Deleted Items or Trash.
3. Forwarded copies. Staff often forward a voicemail to a colleague. Those copies need the same treatment.
4. Downloaded files. MP3s saved to desktops, phones or shared drives.
5. Backups. Know how long your email and file backups keep data. If backups roll over after 30 days, say so in your policy; you do not need to restore and scrub them, but you should not keep them forever.

Retention checklist

• Written schedule with a maximum period for each message type
• One named person responsible for monthly cleanup
• Voicemail-to-email messages covered by the email retention policy
• Deleted Items and Trash emptied on a schedule
• Backup retention period known and written down
• Legal hold process: who can pause deletion, and how it is recorded
• Former employees' access removed the day they leave

Who can listen: access control and unauthorized access

In the US, the Stored Communications Act, 18 U.S.C. 2701, makes it an offence to intentionally access without authorization (or exceed authorized access to) a facility through which an electronic communication service is provided and thereby obtain, alter or block access to a communication "while it is in electronic storage in such system." A first offence in the basic case carries a fine, up to 1 year in prison, or both. Up to 5 years applies where the offence is for commercial advantage, malicious damage or private gain, or follows a prior conviction ^[10]. The section exempts conduct authorized by the service provider or by the user the communication is for. Whether it applies to a particular voicemail system is a question for a lawyer, but the practical lesson is clear: control who has the mailbox PIN or login.

In Canada, the same clause 4.7.5 duty to prevent unauthorized access applies while you hold the message, not only when you delete it.

Practical steps:

• Give each person their own mailbox or menu option where possible, so messages go only to the person who needs them. Our explainer on what an auto-attendant is shows how a menu splits calls by department.
• Send voicemail emails to role addresses you control (for example, a front-desk inbox), not personal accounts.
• Change shared PINs and passwords when staff leave.
• Ask callers not to leave sensitive details. A line in your greeting such as "Please don't leave card numbers or health details in your message" helps. See our phone menu scripts for wording.

FAQ

Is there a legal minimum time to keep business voicemail? Not for voicemail as such, as far as the sources reviewed show. A minimum only applies through another rule: BC's one-year rule when a message was used to make a decision about someone, PIPEDA's expectation that you keep decision records long enough for access, a tax rule if the message is part of a tax record, or a legal hold.

Do I need to keep voicemail for tax purposes? Usually not. CRA's six-year rule and the IRS periods cover records that support your tax filings. A voicemail only qualifies if it is itself that support, which is rare. Confirm orders and agreements in writing instead.

What about voicemail delivered to email? Each emailed voicemail is an email and falls under your email retention policy. Deleting the original from the phone system does not delete the email copy, and the reverse is also true.

Should we anonymize voicemail instead of deleting it? For audio, rarely practical. A voice can identify someone, and the OPC puts the burden on you to prove anonymization works. Delete.

Auto Attendant keeps voicemail recordings and transcripts in the dashboard for 365 days and lets you delete them sooner; emailed copies stay in recipients' inboxes until deleted.