What about call recordings and customer service screens?

Short answer: Yes, with notice, a retention period and masking

Call recordings, chat transcripts and agent screens hold a lot of personal data. Tell callers that calls are recorded and why, keep recordings for a set period, limit who can listen, and mask card numbers and passwords on screen and in recordings.

What the law says

Section 5 needs notice, Section 8(5) needs safeguards, and Section 8(7) needs erasure after the purpose.

Section 5 · Rule 3: When you ask for consent, give a clear notice that stands on its own: what data, for what purpose, how to withdraw consent, how to use the rights and how to complain to the Data Protection Board. For data collected before the Act, a notice is due as soon as reasonably practicable.
Section 8(5) · Rule 6: Protect personal data with reasonable security safeguards. Rule 6 lists the minimum: encryption, masking or tokenisation; access control; logs and monitoring; backups for continuity; keeping logs for at least one year; and security terms in contracts with processors.
Section 8(7) · Rule 8: Erase personal data when its purpose is over or consent is withdrawn, unless a law requires you to keep it, and have your processors erase it too. Rule 8(3) asks every Data Fiduciary to keep personal data, traffic data and logs for at least one year for purposes listed in the Rules.

Steps

Play a short recording notice at the start of calls.
Set a retention period by call type.
Pause recording when card or other sensitive details are given.
Limit replay rights to quality and complaint teams.
Lock agent screens and stop phones on the floor if data is sensitive.

Evidence to keep

Recording notice script
Retention settings
Replay access list

Common mistakes

Recordings kept indefinitely
Card numbers in recordings
Open replay access for all supervisors

How it plays out by sector

Banking, financial services and insurance: Never record card numbers or OTPs. Pause recording when customers read them out.
IT, ITeS, BPO and GCC: BPO call recordings must pause for card details and follow client retention rules.
Central government: ministries and departments: Helpline recordings need a notice and a retention period.
Public sector undertakings and utilities: Booking and complaint lines record calls.
Healthcare and hospitals: Appointment and lab call centres record names and conditions.

From each seat

Operations head: Call scripts need a recording notice, and agents need to know when to pause the recording.
Customer service department: Play the recording notice and pause recording for card details.

What a good answer from management sounds like

“Callers hear a notice, recordings expire on schedule, and card details are never recorded.” Effort and time: Light to medium · 4 to 8 weeks.