GDPR compliance for call centers: lawful basis, data minimization, call recording notice, data subject rights, processor contracts, transfers and UK GDPR.
What does GDPR require of a call center?
GDPR requires a call center handling EU residents' personal data to process it under a lawful basis, collect no more than the task needs, give clear notice including of recording, secure the data, honor data subject rights, operate under a written processor contract with its client and transfer data outside the EU only with a valid mechanism.
The General Data Protection Regulation has applied since 2018 to any organization that processes personal data of people in the EU, whether or not the organization itself is located there. A call center is an intensive processor of personal data: every call, chat and email carries names, contact details, account information and often sensitive details such as health or financial circumstances, and recordings capture voices, which are personal data in their own right. This guide explains how the main GDPR requirements apply to a contact center, what the client and the provider each must do and how a buyer checks a provider. It is a general explanation and not legal advice; a data protection officer or counsel should confirm the position for any specific program. Providers serving EU markets are listed at top 15 call center companies in Ireland, and the wider service at global BPO services.
Who is the controller and who is the processor?
In most outsourced call center arrangements the client is the controller, because it decides why and how customer data is processed, and the call center is the processor, because it processes the data on the client's documented instructions. The distinction drives everything else: the controller is responsible for lawful basis, privacy notices and responding to data subject rights, while the processor must follow instructions, secure the data, assist the controller and process nothing for its own purposes.
A call center becomes a controller for some processing of its own, such as its employee records or analytics that use client call data to improve its general operations. A buyer should ask the provider to state which processing it performs as processor and which, if any, as controller. Where the provider proposes to use call data for its own model training or benchmarking, that is a controller purpose that needs its own lawful basis and should be refused or tightly limited.
Subcontractors are sub-processors. A telephony platform, a transcription service, a cloud host and a workforce management tool that touch personal data all need to be disclosed to the controller, bound by equivalent terms and changed only with notice and a right to object.
What lawful basis covers contact center processing?
Most contact center processing rests on the controller's performance of a contract with the customer or on the controller's legitimate interests, with consent reserved for cases where the law specifically requires it or where no other basis fits. Answering a customer's billing question, taking an order or resolving a fault is processing necessary to perform the contract. Quality monitoring, fraud prevention and service improvement are usually assessed under legitimate interests, which requires the controller to balance its interest against the customer's rights and document that assessment.
Outbound sales and marketing calls engage both GDPR and the ePrivacy rules implemented in each member state, which vary on whether consent or an opt-out register governs cold calling to consumers. Special category data, such as health information disclosed on a call to an insurer or a utility's vulnerable customer team, needs an additional condition under Article 9. The call center does not pick the lawful basis; the controller does, and the processor contract should record it so agents are not asked to process in ways the basis does not cover.
How does GDPR treat call recording?
GDPR treats a call recording as personal data and requires a lawful basis for making it, transparent notice to the caller before recording starts, a defined purpose and retention period, security appropriate to the content and the ability to provide a copy or delete it when a data subject asks. Consent is not the only available basis; many controllers record under legitimate interests for quality, training and dispute resolution, or under a legal obligation in regulated sectors such as financial services, but the choice must be documented and the notice must be accurate.
In practice a compliant recording setup has the following features:
- Pre-recording announcement. A clear statement that the call is recorded and for what purposes, with a pointer to the full privacy notice, played before any personal data is spoken.
- Pause and redaction. Recording paused or payment card data masked during card entry to meet PCI DSS, and redaction of special category data where the purpose does not need it.
- Purpose limitation. Recordings used only for the stated purposes; using them for a new purpose, such as voice biometrics or analytics, requires a fresh assessment and usually a new notice.
- Retention schedule. A documented period after which recordings are deleted, with evidence that deletion runs, and a hold process for disputes and legal claims.
- Access control and logging. Playback limited to defined roles and every playback logged.
- Subject access readiness. The ability to find and export a specific caller's recordings and transcripts within the response deadline.
Member states layer their own rules on top of GDPR for recording, and some employment laws affect how agent voices may be recorded and monitored. The general practice for notices and consent across jurisdictions is at call recording compliance.
What does data minimization look like in a call center?
Data minimization in a call center means agents see, ask for and record only the personal data needed to resolve the contact, and the systems are designed so that is the default rather than a matter of agent discipline. The principle in Article 5 says personal data must be adequate, relevant and limited to what is necessary. In a contact center that becomes a design question for scripts, screens and storage.
Examples include role-based screen layouts that hide fields a role does not need; identity verification that uses the fewest identifiers that still work; free-text notes fields with guidance and periodic review so agents do not record sensitive remarks that have no purpose; retention periods for tickets and chat transcripts that match the business need rather than defaulting to forever; and analytics that work on pseudonymized or redacted data. Minimization also reduces the impact of any breach and the effort of answering access requests. The security side of this is covered in the call center data security checklist.
How do data subject rights work in a contact center?
Data subject rights work in a contact center through a documented process in which agents recognize a request, log it, verify identity and route it to the controller's privacy team, while the processor retrieves recordings, transcripts and records from its own systems to support the controller's response within the statutory deadline. The rights most often raised on a call are access to the data held about the caller, rectification of errors, erasure, objection to marketing and restriction of processing during a dispute.
Agents do not need to be data protection experts, but they need to know that "send me everything you have about me" or "delete my data" is a legal request with a clock on it. The script should include verification steps, a confirmation to the caller and a handoff to the controller, and the processor contract should set the time within which the call center must locate and provide the relevant records. Recordings are frequently the hardest item to produce, which is another argument for a searchable recording platform and a disciplined retention schedule.
What are the rules on processor contracts and international transfers?
GDPR requires a written contract between controller and processor containing the terms listed in Article 28, and it allows personal data to be transferred outside the European Economic Area only where the destination has an adequacy decision, where appropriate safeguards such as the European Commission's standard contractual clauses are in place, or where a narrow derogation applies. Both requirements bear directly on outsourced call centers, since the provider is the processor and may be located, or may have agents and systems located, outside the EEA.
The processor contract must cover the subject matter, duration, nature and purpose of processing; the types of data and categories of individuals; the controller's documented instructions; confidentiality of personnel; security measures; sub-processor rules; assistance with data subject rights, security, breach notification and impact assessments; deletion or return at the end; and audit rights. A provider should offer a data processing agreement that maps to these terms without being asked.
For transfers, the controller and processor must identify the mechanism, usually standard contractual clauses, and carry out a transfer impact assessment that considers the laws of the destination country and whether supplementary measures such as encryption with keys held in the EEA are needed. Remote access by agents in a third country is a transfer, even if the data stays on EEA servers. A provider operating from several countries should be able to state exactly which agent locations, data centers and sub-processors would touch EU data for your program.
What about UK GDPR, and how do you choose a provider?
The United Kingdom retained the regulation after leaving the EU as UK GDPR, supplemented by the Data Protection Act 2018, so a call center serving UK customers meets substantially the same requirements under the supervision of the Information Commissioner's Office, with UK-specific transfer tools such as the International Data Transfer Agreement and the UK addendum to the EU standard clauses. The EU has recognized the UK as adequate for transfers from the EEA, and the UK recognizes the EEA, which simplifies programs that serve both markets. Divergence between the two regimes is possible over time, so counsel should check the current position. Providers serving that market are listed at top 15 call center companies in the UK.
Choosing a provider for EU or UK data comes down to evidence: a data processing agreement that meets Article 28, a sub-processor list, a clear statement of agent and data locations, the transfer mechanism and impact assessment for any non-EEA element, a recording setup with the features above, a data subject request process with defined turnaround, security attestations whose scope covers the relevant sites, and a breach notification commitment that lets you meet the regulatory deadline. Ask for each item rather than a general assurance of GDPR compliance, and apply that test to every provider including this one. For the broader service context see BPO services. If you are planning a contact center program for EU or UK customers and want to see how data locations, processor terms and recording would be set up, request a proposal with the markets, channels and data types involved.
GDPR for Call Centers: Frequently Asked Questions
Does GDPR apply to a call center located outside the EU?
Yes, if it processes personal data of people in the EU on behalf of a controller that is subject to GDPR, or if it offers services to or monitors people in the EU. Location of the agents does not remove the obligation; it adds an international transfer that needs a valid mechanism such as standard contractual clauses.
Is consent required to record calls under GDPR?
Not necessarily. Recording needs a lawful basis, which can be legitimate interests, performance of a contract or a legal obligation depending on the purpose, plus clear notice before recording begins. Consent is required where member state ePrivacy rules or the specific purpose demand it. The controller must document the basis and the notice must match it.
Who answers a data subject access request made on a call?
The controller is legally responsible for responding, but the call center as processor must recognize the request, verify and log it, pass it on promptly and retrieve its own records, including recordings and transcripts, in time for the controller to meet the deadline. The processor contract should set those internal timelines.
What must a GDPR processor contract with a call center include?
Article 28 requires terms covering the scope and purpose of processing, processing only on documented instructions, staff confidentiality, security measures, sub-processor approval, assistance with rights requests and breach notification, deletion or return of data at the end, and audit rights. Most providers offer a data processing agreement containing these terms.
Does UK GDPR differ from EU GDPR for call centers?
The substance is largely the same, since the UK retained the regulation as UK GDPR alongside the Data Protection Act 2018. The differences are mainly in the supervisory authority, the Information Commissioner's Office, and in transfer tools such as the International Data Transfer Agreement. A call center serving both markets usually runs one set of controls and documents both regimes.
Related Services
Sources and References
The laws, standards and certifications this page refers to, linked to their official text or publisher.
- PCI DSS (Payment Card Industry Data Security Standard), PCI Security Standards Council: handling of payment card data.
- SOC 2, AICPA & CIMA: independent audit of a service organization's security controls.
- PIPEDA (Personal Information Protection and Electronic Documents Act), Office of the Privacy Commissioner of Canada: private-sector privacy law in Canada.
- Québec Law 25 (privacy), Commission d'accès à l'information du Québec: privacy obligations for organizations operating in Québec.
- UK GDPR, Information Commissioner's Office: data protection law in the United Kingdom.
- GDPR, Regulation (EU) 2016/679, EUR-Lex, Publications Office of the European Union: data protection law in the European Union.