Contact Centre PCI Compliance: Requirements for UK Call Centres (v4.0.1)

Contact centre PCI compliance (contact center PCI compliance in US guidance) means handling card payments on calls without letting card data, above all the security code, end up where it should not: in call recordings, screen recordings, CRM notes or an agent’s notepad. Under PCI DSS v4.0.1, every person, system and location that hears, sees or keys card data is in scope. That makes the payment method you choose (agent-keyed, DTMF masking, IVR or payment links) the biggest single factor in the cost and effort of compliance.

This guide explains what PCI DSS requires from UK call and contact centres, where the payment method changes scope, and how to prepare for validation. If you are a small business taking the occasional card payment by phone rather than running a contact centre, start with our guide to taking card payments over the phone.

Key takeaways

• The card security code must never be stored after authorisation, including in call and screen recordings.
• DTMF masking and payment links can take agents, desktops and recordings out of scope.
• Home-based agents are in scope if they hear or key card data, which adds significant controls.
• Outsourced contact centres that handle card data for clients are service providers under PCI DSS.
• Look for card data beyond recordings: CRM notes, chat logs, emails and screen recordings.

What does call centre PCI compliance require?

PCI DSS sets the same rules for phone payments as for any other channel, but a phone channel spreads card data unusually widely. A single call can put card data in the telephony platform, the recording system, the agent’s screen, the CRM and a screen recording tool. The key requirements are:

• No storage of sensitive authentication data after authorisation (3.3.1), which for phone payments means the card verification code.
• Protection of stored card numbers (Requirement 3): only with a business need, for no longer than necessary, and unreadable wherever stored.
• Access control and MFA (Requirements 7 and 8) for agents and administrators who can reach payment systems.
• Screening and training (12.7.1 and 12.6): staff with access to the cardholder data environment are screened, and awareness training covers phishing and social engineering.
• Managing providers (12.8): telephony, masking and payment providers each need an agreement, a responsibility split and an annual compliance check.

The PCI SSC publishes guidance on protecting telephone-based payment card data in its document library; read it alongside the standard.

“Shadow” card data is a common finding. Agents write card numbers into free-text notes to be helpful, or customers send them by email or web chat. Sample your recordings, notes and transcripts, and use data discovery tools, to find it before your assessor does.

Can you record calls and stay PCI compliant?

Yes, provided the card security code never reaches call recordings, screen recordings, CRM notes or transcripts, even encrypted. Recordings that capture card numbers bring the recording platform into scope under Requirement 3, so the way you take payments on the call matters, as the next section explains.

Which phone payment methods take agents out of scope?

DTMF masking, a transfer to a payment IVR and payment links sent by SMS or email can each take agents, desktops and recordings largely out of scope, whereas agent-keyed payments with pause-and-resume leave agents, desktops, telephony and the workspace in scope. Where the masking or IVR sits and what your provider’s Attestation of Compliance covers decide how much leaves scope.

Our guide to DTMF masking for PCI compares these options in detail, including where masking happens and what to ask a provider for. If you only take the occasional phone payment, our guide to taking card payments over the phone covers the simpler options.

Is a PCI compliant IVR enough?

A payment IVR takes the agent out of the transaction, but it only reduces your scope if card data travels from the caller to the IVR without passing through, or being recorded by, systems you control. Check the provider’s Attestation of Compliance and your responsibility matrix to confirm which requirements it covers and which stay with you.

Can home-based agents take card payments?

Yes, but if they hear or key card data, their workstation, network connection and physical workspace are in scope. That typically means:

• Company-managed, hardened devices with current patching and anti-malware.
• Multi-factor authentication for all remote access from outside your network that could reach the CDE (8.4.3).
• No local storage of card data, and restricted copy, paste, print and screenshot functions.
• Workspace rules: no one else present during payments and no writing down card details.
• Clear procedures for reporting lost devices and suspected incidents.

Evidencing that across dozens or hundreds of home offices is hard. Many contact centres find DTMF masking or payment links the most practical way to support home working, because they take the agent out of scope.

Is an outsourced contact centre a PCI service provider?

Yes. A contact centre that handles card data on behalf of client businesses is a service provider. It must meet the service-provider-only requirements, such as six-monthly scope confirmation and quarterly checks that staff follow security procedures, and its clients will ask for its Attestation of Compliance. Larger service providers need a Report on Compliance from a QSA. Our guide to PCI compliance service provider assessments sets out the levels and extra obligations.

In-house contact centres taking payments for their own organisation are part of that merchant’s validation, at the level set by the card brands. Which SAQ applies depends on how card data reaches your systems: agent-keyed payments into a provider’s virtual terminal may fit SAQ C-VT if every condition is met, while larger contact centres often complete SAQ D or a Report on Compliance. Your acquirer confirms which applies.

How does UK law fit alongside PCI DSS?

PCI DSS is a contractual obligation through your acquirer, not a law, but it sits alongside laws that do apply. Call recordings contain personal data, so UK GDPR governs how you record, store and delete them, and the ICO expects appropriate security measures. FCA-regulated firms have their own systems and controls obligations. Aligning recording retention with both PCI DSS and your regulatory duties avoids keeping data longer than you need. Our PCI compliance UK guide explains how acquirers, the card brands and UK law fit together.

Contact centre PCI compliance checklist: preparing for assessment

Before your assessment, work through these steps:

• Map every route card data takes into and through the contact centre. Our PCI DSS scoping guide sets out the method, and our free PCI compliance check gives a quick first view of where you stand.
• Search recordings, notes and transcripts for card data, and fix what you find.
• Collect Attestations of Compliance and responsibility matrices from telephony, masking and payment providers.
• Confirm that remote agents’ devices meet your security standards and that you can prove it.
• Keep quarterly internal scans and ASV scans up to date for any in-scope internet-facing systems.
• Test your people. Contact centres are prime targets for pretexting, and social engineering testing shows whether agents follow verification procedures under pressure.

Getting help

The biggest savings in a contact centre come from choosing the right payment method before the assessment, not from preparing harder for it. Sovereign Secure is a PCI SSC-approved Qualified Security Assessor company. Our PCI DSS consultancy team can review your telephone payment flows and advise on scope, and we carry out the formal PCI compliance audit when you are ready. Advisory and assessment work are kept separate, as the PCI SSC expects of a QSA company.