The GDPR applies to organisations processing personal data of people in the EU regardless of where the processor sits. Enforcement remains active: national authorities continue to fine controllers for weak consent, missing processor contracts and poor transparency — including cases where call-centre subcontractors lacked a processing agreement.
If you hand customer files to an operations partner, you need a written standard for entry, cleansing, profiling, hosting and physical storage — not only a non-disclosure agreement.
Why database partners are a GDPR risk surface
CBI’s guidance for contact-centre services stresses that GDPR and ePrivacy rules travel with the data: processors outside the EU still face EU requirements when serving EU residents. The same logic applies to database hosting and cleansing vendors.
What good GDPR-aligned database management looks like
- Documented roles: you as controller, partner as processor (Article 28 contract).
- Lawful basis mapped per processing purpose (marketing, service, analytics).
- Entry and cleansing rules that do not create unlawful new profiles by accident.
- Access controls, retention schedule and secure physical storage for any offline media.
- Process for access, erasure and objection requests with measured response times.
Questions to ask before sharing a file
- Where is data hosted, and are international transfers documented?
- Who can export full extracts, and how are exports logged?
- How are suppression / opt-out lists applied across channels?
- What happens to copies at contract end — return, wipe, certificate?
How Dcode fits
Dcode’s database management covers entry, cleansing, profiling, hosting and secure physical storage with GDPR-aligned operating expectations for brand teams that need operational data work, not only cloud software.
Next step: review database management, then send a processing purpose list with your contact request.