When a company moves customer support to a provider in another country, that provider handles the personal data of its customers. If any of those customers are in Europe, the arrangement falls under the GDPR, and your own compliance team will ask a specific set of questions before it signs. Knowing them in advance turns a three-month approval into a three-week one.
This is a description of the questions, not legal advice.
Where the data goes, and what that means
Under the GDPR, personal data can move freely to countries the European Commission has decided offer adequate protection. The Commission's own page puts it plainly: with an adequacy decision, "personal data can flow from the EU (and Norway, Liechtenstein and Iceland) to that third country without any further safeguard being necessary."
The list is short. As of the Commission's page read on 18 September 2026 it covers Andorra, Argentina, Brazil, Canada (commercial organisations), the Faroe Islands, Guernsey, Israel, the Isle of Man, Japan, Jersey, New Zealand, the Republic of Korea, Switzerland, the United Kingdom, the United States (for organisations certified under the EU–US Data Privacy Framework), Uruguay and the European Patent Organisation.
Most outsourcing destinations are not on that list — India, the Philippines and Jordan among them. That does not make the arrangement impossible; it means the transfer needs another lawful basis, and in practice that usually means standard contractual clauses in the contract. The question your compliance team will ask is simply: which mechanism are we relying on, and is it in writing?
The document they will ask for by name
A data processing agreement. When your provider handles personal data on your behalf, you are the controller and they are the processor, and the relationship has to be documented. Many European companies cannot proceed without one, regardless of how good the provider is.
Ask for the provider's standard DPA early. A provider who has one ready has done this before.
The questions under the document
Who else is involved? Any other company touching the data — a telephony provider, a cloud host, a quality-assurance tool — is a sub-processor, and your compliance team will want them listed.
What is recorded? Call recordings are personal data, and often special in their own right because they capture voice. Ask whether calls are recorded, who can play them back, and how long they are kept.
How long is anything kept? Retention is a policy question, not a technical one, and "as long as necessary" is not an answer a reviewer accepts.
What can an agent see? The least-privilege question: does an agent handling a billing query see the full customer record, or only the part they need?
What happens in a breach? Who tells you, how quickly, and with what detail.
Who answers a data subject request? If a customer asks for a copy of their data or asks to be forgotten, the request lands on you, and the provider has to be able to help you answer it inside the statutory window.
How are agents trained on this? Not whether there is a policy. How often, and what happens when someone breaks it.
Two mistakes to avoid on your side
Do not accept "we are GDPR compliant" as an answer. It is a claim, not evidence. The evidence is the DPA, the sub-processor list, the retention schedule and the transfer mechanism. A provider who leads with the slogan and cannot produce the documents is telling you something.
Do not leave it to the end. These questions decide whether a deal closes, and they take weeks to answer if the provider has to build the answers from scratch. Ask them in the first meeting.
What a good provider sounds like
Specific and quick. They know where the data sits, they can name the sub-processors, they have a retention schedule, and they will tell you which transfer mechanism their contract relies on. Where something is not in place yet, they say so plainly rather than reaching for the word "compliant".
We hold ourselves to the same standard on this site: our call center page states what we do and does not claim a compliance position, because that is a statement for the company's owner and its lawyer to make, not for a marketing page.
Sources
- European Commission, "Adequacy decisions", read 18 September 2026: https://commission.europa.eu/law/law-topic/data-protection/international-dimension-data-protection/adequacy-decisions_en