GDPR Regulation for Call Centres

Under GDPR, consent must be freely given, specific, informed, and unambiguous. Pre-ticked boxes and implied consent are no longer acceptable. If your call centre relies on consent as the legal basis for contacting individuals, you must be able to demonstrate that each person has actively opted in to receive communications.

This means:

• Consent must be recorded with a clear audit trail — when it was given, how, and what it covered
• Individuals must be told exactly what they are consenting to before they agree
• Consent can be withdrawn at any time, and withdrawing must be as easy as giving it
• Separate consent is required for different processing activities — you cannot bundle consent
• Children's data requires additional safeguards and parental consent

For outbound calling operations, this has significant implications. Data lists must be sourced from compliant providers who can prove valid opt-in consent, and your dialler system needs to maintain a clear record of consent status for every contact.

Article 17 of the GDPR gives individuals the "right to erasure" — commonly known as the right to be forgotten. When a person requests that their data be deleted, your call centre must comply without undue delay (typically within one month).

For call centres, this means:

• You must be able to locate all data held on an individual across every system — your dialler, CRM, call recordings, email, spreadsheets, and backups
• The data must be securely and permanently deleted, not just archived or hidden
• If data has been shared with third parties, you must inform them of the erasure request
• You need documented processes for handling erasure requests and tracking completion
• Call recordings containing personal data are included — these must also be deletable on request

Without a dialler platform that supports secure, auditable data deletion, meeting this obligation can be extremely difficult and time-consuming — especially at scale.

GDPR requires that every processing activity has a lawful basis. For call centres, the most relevant bases are:

• Consent — The individual has given clear consent for you to process their data for a specific purpose (e.g., marketing calls)
• Contract — Processing is necessary for a contract you have with the individual (e.g., calling an existing customer about their account)
• Legitimate Interest — Processing is necessary for your legitimate business interests, provided these are not overridden by the individual's rights. This is often used for B2B calls but must be carefully assessed
• Legal Obligation — You are required by law to process the data (e.g., regulatory record-keeping)

You must identify and document your legal basis before processing begins. You cannot retrospectively decide which basis applies. If you are relying on legitimate interest, you must conduct a Legitimate Interest Assessment (LIA) to balance your interests against the individual's rights and freedoms.

Your dialler and CRM systems should be configured to reflect the legal basis for each data set and campaign, ensuring that agents only contact individuals where a valid basis exists.