GDPR & PECR Guide for Contact Centres

The two most applicable lawful bases for B2C outbound calling are: Consent (Article 6(1)(a)) — freely given, specific, informed, unambiguous consent. Must be as easy to withdraw as to give. Or Legitimate Interest (Article 6(1)(f)) — the contact centre or its client has a legitimate business interest that is not overridden by the individual's rights. A Legitimate Interest Assessment (LIA) must be documented. For B2B calling in the UK under PECR, a 'soft opt-in' from existing customers may apply.

The Telephone Preference Service (TPS) is the UK's version of the DNC registry. The Corporate Telephone Preference Service (CTPS) covers business numbers. Under PECR, organisations must screen against TPS and CTPS before making live marketing calls. Unlike GDPR, PECR does not provide a legitimate interest override for TPS-registered numbers — explicit prior consent is required to call a TPS-registered consumer.

Recording calls involving EU/UK residents requires a lawful basis (consent, legitimate interest, or legal obligation). The recipient must be informed at the start of the call that it may be recorded and the reason why. Recordings constitute personal data and must be: stored securely with appropriate access controls; retained only for as long as necessary (document your retention policy); subject to data subject access requests (individuals can request a copy); and deleted upon a valid erasure request, unless a legal hold applies.

GDPR grants individuals eight rights that directly affect contact centre databases: Right of access (provide a copy of data within 30 days), Right to erasure ('right to be forgotten'), Right to rectification, Right to restrict processing, Right to data portability, Right to object (stop processing for marketing — must be honoured immediately), Right not to be subject to automated decisions, and Right to be informed. Contact centres must have documented processes to respond to all eight rights within 30-day response windows.