Call centres process large volumes of personal data. CBI’s EU market guidance treats GDPR and ePrivacy rules as mandatory for contact-centre services serving European individuals — including when the operator is outside the EU. Finnish supervisory action has already fined a controller for robocall marketing without proper consent and without a processor agreement with its calling subcontractor.
Your brief must cover script, lawful basis, suppression and reporting — not only hours and language.
Why call centre briefs fail compliance reviews
Sales teams optimise for connect rate; legal teams need recorded consent logic and Article 28 terms. When those documents arrive after dialling starts, you inherit risk.
What good looks like
- Purpose and lawful basis per campaign (service, survey, marketing).
- Consent / soft opt-in / legitimate interest assessment documented where used.
- Suppression list handling before every dial wave.
- Script version control and call recording policy stated to the agent and the customer.
- Signed processor agreement and subprocessors list before go-live.
- KPI set that includes quality and complaint codes, not only conversion.
Questions to ask partners
- How are agent access rights revoked when staff leave mid-campaign?
- Where are recordings stored, and for how long?
- How do you evidence that suppression was applied to a specific wave?
How Dcode fits
Dcode’s call centre services cover outbound and inbound campaigns, customer service lines and telephone research for brands that need operational execution with privacy-aware briefing discipline.
Next step: review the call centre page and send campaign purpose + volume bands via contact.