Section 10 of the Finnish Constitution explicitly protects the confidentiality of telecommunications. This is broader than the GDPR which protects personal data only. CDR records, signalling metadata, and call recordings all fall under the Section 10 protection. The Information Society Code (917/2014) implements the specifics.
In practice this affects how we and you treat SIP CDRs. Retention beyond what is operationally necessary triggers a justification requirement. For a small PBX, 90 days of CDR is the conventional ceiling unless you have a specific accounting or fraud-investigation reason.