Call Detail Recording

Call detail recording (CDR) is the log a phone system writes for every call it handles. Each record shows who called whom, when, how long, at what cost, and by which route, the metadata layer behind billing, quality reviews, and audits.

A CDR is not the audio. It is the transaction record — origin number, destination number, timestamp, duration, disposition code, trunk ID, and often the agent extension.

Voice files, if kept, live in a separate archive under different retention rules. Every private branch exchange (PBX), softswitch, and cloud contact center platform emits CDRs by default.

Outsourcing buyers rely on CDRs to verify vendor service levels, reconcile carrier invoices, and spot toll fraud before it compounds into a material loss. The log looks dull until the month it settles a carrier dispute in your favour.

Key takeaways

• CDR is metadata about calls, not the call audio itself.
• Every telephony platform, from legacy PBX to cloud Voice over Internet Protocol (VoIP), generates CDRs continuously.
• Buyers use CDRs to audit business process outsourcing (BPO) invoices, staffing accuracy, and compliance posture.
• Retention windows are dictated by regulation, not IT preference.
• Cost per call sits inside the CDR, which is why vendors usually redact that field.

How it works

CDRs are written the instant a call clears the switch. Fields vary by vendor, but the core schema has stayed consistent from on premise PBXs to cloud platforms since the 1990s. A typical record carries 20 to 40 fields.

The fields that matter look like this, using a Manila outbound campaign as the example. Trunk identifiers name the Session Initiation Protocol (SIP) route the carrier used.

Records stream to a mediation server that normalises formats, then land in a billing database or data warehouse. Analytics tools query that warehouse to feed dashboards on average handle time, occupancy, and abandonment.

Run a million calls a month at the $0.018 shown above and telecom lands near $18,000. A 2% gap between your CDR count and the carrier invoice is roughly $360 a month — money you should not be paying.

Retention is typically 6 to 24 months for operational use — and longer where the rules demand it. Healthcare work under the Health Insurance Portability and Accountability Act (HIPAA) keeps its own documentation clock.

The PCI Security Standards Council sets the floor: Requirement 10.7 of the Payment Card Industry Data Security Standard (PCI DSS) obliges at least one year of audit log retention.

Europe’s General Data Protection Regulation (GDPR) pulls the other way. Article 5(1)(e), the storage limitation principle, allows only as long as the documented purpose needs.

Examples

CDRs earn their keep in four places: telecom billing, shift planning, regulatory defence, and platform migration. The cases below sit inside Philippine and Indian delivery centres, where one unmatched field can hide six figures of telecom overspend.

Billing reconciliation. Concentrix and Teleperformance, the two largest global BPO providers, run nightly CDR jobs to match carrier invoices against internal traffic. Across a 50,000 seat estate, one missing field hides real money.

Workforce staffing. A Manila delivery centre feeds CDRs into its Verint or NICE platform each morning. Supervisors read occupancy by half hour, reforecast the next shift the same day, and tighten workforce management accuracy.

Regulatory audits. Financial services campaigns handling American consumers must prove that call disclosures happened.

During a 2024 Consumer Financial Protection Bureau (CFPB) examination of a debt collection vendor, CDRs proved which agents dialled which consumers and when — a defence impossible without the log.

Platform migration. When a centre moves from a legacy PBX to Amazon Connect or Genesys Cloud, the CDR schema changes shape and field names. Map the old fields to the new ones first, or every historical dashboard breaks on cutover day.

The same audit patterns show up in customer service queues and virtual assistant services desks.

Outsourced software development support desks keep CDRs too, since escalation calls ride the same trunks.

Related terms

Call detail recording sits inside a small cluster of telephony and delivery terms. The boundary that matters is purpose: some name the place a call happens, some the transport that carries it, and some the discipline that reads the log afterwards.

• Call Center: the facility or team that runs the phone campaigns emitting CDRs.
• Contact Center: broader than a call centre, covering email, chat, and social alongside voice.
• VoIP: the transport layer whose SIP signalling generates most modern CDRs.
• Quality Assurance: the review discipline that pairs CDR metadata with scored audio.
• Workforce Management: the staffing discipline that consumes CDRs as raw input.
• Business Process Outsourcing: the wider sector that runs voice operations end to end.

FAQ

Buyers ask the same handful of questions before they sign a telephony schedule. These answers cover the split between metadata and audio, how long to keep records, what regulators expect, and how much of the schema a client actually gets.

What is the difference between a CDR and a call recording?

A CDR is metadata about the call: who, when, how long, and by which route. A call recording is the audio itself. Systems store the two separately, and their retention policies usually differ.

How long should we retain CDRs?

Operational teams typically hold 6 to 24 months, and many keep 12 to 18 on fast storage first. PCI-scoped environments must keep at least one year of audit logs. GDPR work retains only as long as the documented purpose requires.

Are CDRs personal data under GDPR?

Yes. A CDR ties a phone number to a call event, which meets the Article 4(1) definition of personal data. Treat CDR stores with the same access controls as any customer database.

Do cloud contact centres still produce CDRs?

Yes. Every major cloud platform, including Amazon Connect, Genesys Cloud, Five9, and NICE CXone, emits CDRs through vendor interfaces or streaming exports. Field names vary, but the core fields carry over from the PBX era.

Can a BPO client access the vendor’s CDRs?

Most master service agreements grant clients read access to the CDRs tied to their campaign. Full schema access, including cost fields, is usually redacted. Negotiate that in the statement of work, not after go live.

What frameworks reference CDR retention?

The National Institute of Standards and Technology (NIST) Cybersecurity Framework treats call logs as audit records under its Detect function, PCI DSS 10.7 sets the retention floor, and sector rules add further duties.

Compare CDR-savvy vendors on the Outsource Accelerator hub, or start with the Top 40 BPO companies in the Philippines shortlist before your next telephony contract review.