Data residency: the five questions procurement and privacy ask

When a contact centre moves to the cloud, two departments arrive with similar questions: procurement and data protection. Both want to know where the data lives. And both are right not to settle for "The data stays in Europe".

Behind that sentence sit five more precise questions. Knowing them in advance saves long rounds of questionnaires. And when comparing providers, the answers quickly show how seriously each one takes the subject.

#Question 1: Which region holds the data, and who chooses it?

The question of location has two parts. First: where is the data actually stored? Second: who decides, and can that change without your consent?

A clean answer names the region specifically and explains how it is set. It also says what happens to backups and disaster recovery copies. A region whose backups live somewhere else is only half a region.

With Univerx, you choose the EU region, and data and media are designed to stay in it. Hosting in Germany is planned. Data residency & hosting in Germany has the details.

#Question 2: Who else processes the data?

Hardly any cloud service runs without third parties: data centres, telephony carriers, services for speech recognition or translation. Each of them is a sub-processor. Under Article 28(2) GDPR, each requires prior authorisation from the controller.

A clean answer is a list: name, service, place of processing. It comes with a procedure for informing you of changes and letting you object. For a general authorisation, the GDPR requires exactly that.

Pay particular attention to AI features. Language models, transcription and translation often run on specialised services. Ask where that processing takes place and whether your data is used there for other purposes, such as training.

#Question 3: Where do recordings, transcripts and attachments live?

In a contact centre, the most sensitive data is often not the records but the media: call recordings, screen recordings, transcripts, uploaded documents. They are large, often stored separately and sometimes processed by other services.

A clean answer addresses media explicitly, not just "the data". It names where recordings are stored and where transcription and analysis take place. If that distinction is missing, ask again.

#Question 4: How is data deleted, and how can that be proven?

In customer service, deletion has three levels: retention periods per type of data, erasure at the request of a data subject, and complete deletion when the contract ends.

For the end of the contract, Article 28(3)(g) GDPR provides for deletion or return, at the controller's choice.

A clean answer covers all three levels. It says whether retention periods can be set per data type, how backups are included in deletion and what confirmation you receive at the end.

#Question 5: How does the data come back out?

Procurement often asks this before data protection does: what happens if we want to switch? The point is a complete export in a usable format: contacts, histories, recordings, configurations.

A clean answer names formats, routes and timelines. It also says whether export is possible continuously, into your own data warehouse for example, or only once at the end. Continuous exports help with analytics too; see BI & data export.

#How to recognise a clean answer

The difference between an evasive and a reliable answer is often stark when you put them side by side.

#When data leaves the EU

If processing takes place outside the EU, the rules on transfers to third countries in Chapter V of the GDPR, Articles 44 to 49, apply as well. Ask for the legal basis, such as an adequacy decision or standard contractual clauses.

Access counts too. Maintenance or support from a third country can be a transfer, even if the data is stored in the EU. A clean answer therefore describes not only where data is stored but also where it is accessed from.

#Documents you should request

The answers to the five questions belong not only in the conversation but in documents you can review and file.

Univerx provides the data processing agreement, the list of sub-processors, the technical and organisational measures and the retention and deletion policy on request.

The GDPR page in the Trust Center sets out what is available and what is a goal. The related features are in Privacy and Regions & availability.

The guide Running a contact centre in Europe covers the full European framework. The glossary explains data residency and the data processing agreement (DPA).