Accountability
Document decisions, owners, policies, training, and evidence that shows how your organization meets its obligations.
01 Privacy, security & responsible calling
GDPR compliance,
from A to Z.
A practical guide to protecting personal data in business communications and contact center workflows, from notices and call recordings to access controls, vendors, and incident response.
The short version
Protect people’s data
at every touchpoint.
GDPR applies to personal data processing in its territorial scope. It can apply to an organization outside the EU when it processes data in connection with offering goods or services to people in the EU, or monitoring their behaviour there. A company’s role, processing purpose, and local law determine the specific duties.
Important
This guide is general information, not legal advice, a certification, or a claim that a particular deployment is compliant. JS CloudData customers remain responsible for deciding their legal basis, notices, retention periods, and configuration. Confirm requirements with your privacy or legal adviser and the relevant supervisory authority.
A–Z checklist
Build privacy into
every interaction.
Use this as a working checklist for PBX, recordings, transcripts, analytics, CRM connections, and outsourced contact center teams.
Basis for processing
Identify and record an applicable Article 6 lawful basis for each purpose: consent, contract, legal obligation, vital interests, public task, or legitimate interests where its conditions are met. Consent is one basis; it is not the default for every call or recording.
Clear notices
Explain who is processing data, why, the legal basis, recipients, retention, rights, and contact route in clear language at the right time.
Data minimisation
Collect and display only the personal data needed for the task. Avoid asking callers to repeat sensitive details unnecessarily.
Erasure and retention
Set purpose-based retention periods for recordings, transcripts, call logs, and exports. Delete or anonymise data when it is no longer needed, subject to lawful retention duties.
Fairness and purpose limits
Use data fairly for specified purposes. Do not quietly reuse support-call data for marketing, profiling, or model training without assessing a valid basis and providing required information.
Geography and transfers
Map where data is stored, accessed, and supported from. For restricted transfers, assess an applicable transfer mechanism and safeguards before moving data internationally.
Human oversight
Review automated routing, scoring, transcription, and analytics for accuracy and unfair impacts. Assess additional rules if decisions significantly affect people.
Individual rights
Provide a process for access, correction, erasure, restriction, objection, portability where applicable, and rights related to automated decisions.
Just-in-time recording notices
Tell callers and agents when calls are recorded or monitored, why, and where to learn more. The lawful basis and notice requirements depend on the context and applicable national rules.
Keep access limited
Use individual accounts, role-based permissions, least privilege, strong authentication, and prompt access removal when staff change roles or leave.
Logs and audit trails
Record administrative and access events where appropriate, protect logs from tampering, and review them to investigate unusual activity.
Minimise sensitive data
Special-category and criminal-offence data have extra rules. Avoid collecting them in ordinary call flows; restrict access and establish the required legal condition and safeguards when processing is necessary.
Notice every channel
Align phone scripts, IVR prompts, websites, chat, email, and agent screens so people receive consistent privacy information.
Objection and opt-outs
Provide a clear way to object where the right applies. Direct marketing objections must be respected; suppress the relevant contact from future marketing.
Processor agreements
When a service provider processes data on your behalf, put the required terms in place, define instructions and security responsibilities, and control subprocessor use.
Quality and accuracy
Keep CRM records accurate, correct errors promptly, and distinguish verified facts from call summaries or automated transcription that may contain mistakes.
Requests workflow
Train agents to recognise privacy requests, verify identity proportionately, preserve relevant records, and route requests to the responsible privacy team without delay. The usual response deadline is one month; a permitted extension of up to two further months may apply to complex or numerous requests, with notice and reasons given within the first month.
Security safeguards
Use risk-appropriate technical and organizational measures such as encryption, secure configuration, backups, resilience, vulnerability handling, and regular review.
Training and confidentiality
Give agents role-specific training on identity checks, social engineering, safe screen handling, disclosure limits, and escalation procedures.
Use of subprocessors
Maintain a current vendor list. Understand which providers can access call data, their locations, safeguards, and how changes or incidents are communicated.
Voice, video, and screen data
Voice recordings, screen recordings, transcripts, caller IDs, and searchable metadata can all identify people. Protect and govern each format, including copies and exports.
Workflows for incidents
Give staff a fast reporting route for lost devices, misdirected recordings, exposed credentials, suspicious access, and other possible personal data breaches.
eXamine high-risk processing
Before high-risk monitoring or new technology, assess necessity, proportionality, and risks. Complete a DPIA when required and consult the authority beforehand if high residual risk remains.
Your privacy contact
Publish a working privacy contact and, where required, appoint and publish a Data Protection Officer. A DPO is mandatory only in specified circumstances.
Zero-trust mindset
Verify who is requesting access, share only what is necessary, and treat recordings, exports, and admin credentials as sensitive assets.
India-specific requirements
GDPR and India’s
DPDP framework.
GDPR and India’s Digital Personal Data Protection Act are separate laws. A business may need to assess both when its services, people, or processing connect India and the EU.
India law status · reviewed 10 October 2026
The DPDP Act 2023 and DPDP Rules 2025 use a phased commencement schedule. Some provisions are already in force; a one-year phase is scheduled for November 2026, while many core processing obligations and related rules are scheduled for May 2027. Check the latest Gazette notifications before relying on these dates.
Digital personal data in India
The DPDP Act covers digital personal data processed in India, including data collected offline and later digitised. It can also cover processing outside India connected with offering goods or services to people in India. Its scope is not identical to GDPR’s; assess each law independently.
Data Fiduciary and Processor
India uses the terms Data Principal, Data Fiduciary, and Data Processor. The business deciding why personal data is used will commonly be the Data Fiduciary; a PBX or contact center supplier may be a Data Processor for some operations. Confirm roles from the real workflow and contract.
Explain the purpose clearly
For processing based on consent, the DPDP framework sets requirements for clear, specific notice and a purpose-linked consent process, including a way to withdraw consent. Map this separately from GDPR lawful-basis and call-recording notice requirements.
Requests and grievances
The Act provides rights that include access to information about personal data, correction and erasure, grievance redressal, and nomination. Prepare a process to receive, verify, route, and answer requests across PBX recordings, transcripts, CRM, and support tools as applicable provisions take effect.
Security and breach response
Plan reasonable security safeguards, processor oversight, incident escalation, and required breach communications under the applicable Indian framework. Keep a single incident playbook that can assess India and GDPR reporting duties separately, since their triggers, recipients, and timelines differ.
Extra protection for minors
The DPDP Act treats a child as a person under 18 and includes additional consent and processing protections, subject to statutory exemptions. Review age-related services, recordings, analytics, and automated monitoring with counsel before processing children’s data.
Check both transfer regimes
India’s Act allows transfers subject to restrictions the Central Government may specify. GDPR international-transfer requirements are separate. Map storage, support access, and subprocessors in both directions and verify the rules and safeguards that apply to each transfer.
TRAI commercial communications rules
For commercial calls and messages to Indian subscribers, assess TRAI’s current Telecom Commercial Communications Customer Preference Regulations (TCCCPR), including customer consent and preferences and applicable sender/telemarketer procedures. Keep promotional campaigns distinct from service or transactional communications and use current provider guidance.
Phased commencement published by MeitY
14 Nov 2025
Initial provisions and Rules 1, 2, and 17–21 commenced.
14 Nov 2026
Scheduled one-year phase for DPDP Act sections 6(9) and 27(1)(d), and DPDP Rule 4.
14 May 2027
Scheduled eighteen-month phase for many core Act provisions and Rules 3, 5–16, 22, and 23.
Contact center operations
Important compliance practices
to keep in mind.
Apply these controls to inbound support, outbound service, quality review, remote agents, and outsourced operations.
Make recording transparent
Before recording or monitoring, explain the practice and purpose in the appropriate notice. Establish and document a lawful basis; consent is not automatically required under GDPR in every case. Check national e-privacy, telecommunications, employment, and call-recording laws. Provide an alternative route where required.
Protect payment details
Design payment flows so sensitive authentication data such as card security codes, PINs, and full track data are not captured in call recordings. Use a secure payment route, pause/resume or redaction controls where appropriate, and validate the design against current PCI DSS requirements.
Control agent and supervisor access
Use unique accounts, least-privilege roles, MFA where available, approved devices, session controls, and auditable supervisor permissions. Call monitoring, whisper, and screen capture should be restricted to defined purposes and authorised users.
Handle requests across systems
Search relevant PBX, CRM, ticketing, recording, transcript, and backup systems. Coordinate with processors and other teams so responses are complete, on time, and do not expose another person’s data.
Set recording and transcript lifetimes
Choose retention periods based on documented business and legal needs. Limit access during retention, apply deletion schedules, and explain any longer retention or legal hold in the privacy information.
Prepare for breaches
Contain incidents, preserve evidence, assess risk, and involve the controller/privacy lead promptly. A controller must notify the supervisory authority within 72 hours of awareness when a breach is likely to risk people’s rights and freedoms; high-risk breaches also require communication to affected people without undue delay. Processors notify controllers without undue delay.
Check international access
Map hosting, support, and remote-agent locations. Where GDPR Chapter V applies to a transfer, confirm an adequacy route or an appropriate safeguard and assess whether supplementary measures are needed.
Keep sector rules separate
GDPR is not the only possible requirement. Depending on the service and jurisdiction, assess PCI DSS for payment-card environments, HIPAA for covered US healthcare entities and business associates, and rules such as TCPA or debt-collection laws for relevant US calls. These laws have different scopes and are not substitutes for GDPR.
Who does what?
Know your role
before you configure.
The customer deciding why and how personal data is used is commonly the controller. A provider processing data only on the customer’s documented instructions may be a processor. Some providers may act as independent or joint controllers for particular activities. The contract and actual processing matter.
Chooses purposes and essential means; sets the lawful basis, gives notices, handles rights, and determines retention.
Processes on documented instructions; protects data, supports the controller, manages subprocessors, and reports breaches without undue delay.
Document the role split, data flows, locations, security settings, retention rules, and support escalation path before launch.
Primary references
Read the official
guidance.
Use the current regulation and your supervisory authority’s guidance to check requirements for your specific processing.
Need to review your call flow?