Contact center compliance basics
Contact center compliance is the set of operational controls that keep customer calling within legal and contractual limits: suppression of do-not-call numbers, recorded consent for contact and recording, respecting local calling hours, disclosing that a call is recorded, retaining recordings for a defined period, restricting who can access them, and keeping an audit trail of sensitive actions.
Enforce before the dial, not after the complaint
The single most useful principle is that checks belong in the path of the call, not in a report someone reads later. A do-not-call list that is reconciled weekly is a record of calls you should not have made. The same list checked before every dial is a control.
- Suppression checked at dial time, centrally, across every campaign and list
- Consent status attached to the customer rather than to a campaign record
- Local calling windows evaluated against the customer's own timezone
- Recording disclosure prompted during the call while it can still be corrected
- Every check leaving a trail that shows it happened
Do-not-call and consent
- Suppression list
- A central register of numbers that must not be called, checked before placing a call. Centralised matters: a per-campaign list means a number suppressed in one campaign gets dialed by the next.
- Consent
- A record of what the customer agreed to, when, and through what channel. Because it attaches to the person rather than to a list entry, it survives being re-imported into a new campaign.
- Customer identity
- One customer often has several numbers and appears in several lists. Suppression only works reliably when those resolve to a single identity, otherwise you suppress one number and dial the same person on another.
- Audit trail
- Who added or removed a suppression entry and when. This is what you produce when a complaint is investigated.
Calling windows and time zones
Most jurisdictions restrict the hours during which customers may be called. The recurring operational mistake is applying the office's local time to a list that spans several time zones — perfectly reasonable at the desk, and a violation at the other end.
Windows should be evaluated per customer, derived from their number or address, and enforced at dial time so a call outside the window is refused rather than logged.
Recording, retention and access
- Disclosure
- Where required, the customer must be told the call is recorded. A prompt during the call is far more effective than discovering the omission during a review weeks later.
- Retention
- How long recordings are kept. Both directions carry risk: too short and you cannot evidence a dispute, too long and you are holding personal data with no basis for it.
- Pause on sensitive moments
- Capture should be pausable while payment or other sensitive details are read out, so that data never enters the recording in the first place.
- Access control
- Recordings and transcripts contain personal data. Access should follow role, and be narrower than 'anyone who can log in'.
- Export audit
- Exports are how data leaves a system. Each one should be attributable to a person and a time.
Where AI adds obligations
Adding AI to a contact center does not change the underlying rules, but it does add surface area worth being deliberate about.
- Transcripts are personal data, and inherit the same retention and access obligations as recordings
- Automated scoring that affects employment decisions may carry disclosure and appeal obligations for agents
- If AI recommendations act on customer records automatically, that automation should be opt-in and reversible
- Where an AI voice answers calls, disclosure that the caller is not speaking to a person may be required
- Any third-party AI provider processing call content is a processor in your data map
Frequently asked questions
- What is a do-not-call list?
- A register of numbers that must not be contacted, arising from national registries, customer requests, or internal policy. Operationally what matters is that it is centralised and checked before every dial rather than reconciled after the fact.
- Do you have to tell customers a call is recorded?
- In many jurisdictions yes, and the specifics vary — some require notification, some require consent from all parties. Because it is an in-call obligation, prompting the agent during the call is far more reliable than auditing afterwards.
- How long should call recordings be kept?
- Long enough to serve the purpose you collected them for — dispute resolution, quality review, regulatory obligation — and no longer. The answer is a policy decision rather than a technical one; the platform's job is to enforce whatever you decide.
- Does AI scoring of agents create obligations?
- Potentially. Automated evaluation that feeds employment decisions attracts transparency and appeal expectations in a growing number of jurisdictions. Keeping scores explainable, evidence-linked and appealable to a human is good practice regardless of where you operate.