Social data protection in the contact centre: roles, recording, analytics

A call to a health insurer, a job centre or a family benefits office rarely takes long to become personal. After a few sentences, a diagnosis comes up, or a level of debt, or a separation.

For the contact centre of a social benefits agency, that is everyday work. For its systems, it is a requirement that goes beyond ordinary data protection. This post looks at what it means for routing, roles, recording and analytics, using the German legal framework.

#Two terms worth keeping apart

In conversations between privacy officers and business teams, two terms are often mixed up. They overlap, but they are not the same.

Social data is personal data that a benefits agency processes in connection with its tasks under the German Social Code. Social secrecy under section 35 SGB I requires that, even inside the agency, only authorised people can access it.

Special categories under Art. 9 GDPR include health data, among others. In a call with a health insurer, both terms often meet in a single sentence.

#Routing: as much as needed, as little as possible

The first decision is made before anyone picks up. Call distribution needs to know what the call is about, but not in detail. A voice menu asks for the type of request, not for the illness.

Three questions help with the design:

• Do queue names or wallboards contain terms that allow conclusions about individuals?
• Is free text from chat or speech dialogue stored for routing, and for how long?
• Does a skill really need the health context, or is the benefit area enough?

#Roles and rights

Social secrecy applies internally. Not everyone in the contact centre needs to see everything. Agents need the current case, team leads need metrics, quality management needs selected conversations.

A role model reflects that: who sees the history, who sees transcripts, who hears recordings, who may export? The platform's privacy capabilities are designed for role-based rights, retention and deletion policies, and deletion and export functions.

#Information only to those entitled

Social secrecy also applies externally. Before anyone gives information about a case over the phone, it must be clear who is calling. Date of birth and case number are weak evidence, because both appear on letters that other people read too.

For information that matters, such as payments or decisions, stronger identification makes sense. The Univerx Channel is designed for the German online ID card and brings it into the live conversation. The post The online ID card in customer contact shows how.

The reverse case matters just as much: when a relative or legal guardian calls, a documented power of attorney on the case is needed, not just a convincing voice.

#Recording: only with a reason and consent

Recording calls is no side issue in Germany. Section 201 of the Criminal Code makes unauthorised recording of privately spoken words a criminal offence. Without consent or another lawful basis, nothing is recorded.

Benefits agencies also face the question of purpose. Quality assurance is legitimate, but it does not require recording every call. Consent-based samples and a documented retention and deletion policy with short periods usually go further.

Service EN· active

Queues

Voice3 waiting

Chat5 waiting

Email2 waiting

Messaging1 waiting

Conversation

AI agent, disclosedHandover from AI agent · context complete

I received the decision letter, but the amount does not match my application.

I have the case in front of me. One moment, I am checking the calculation.

Sentiment: calmVoice

Context

Case

2026-0412

History

3 · 14 d

Univerx Assist

Suggested reply

The letter deviates from the application. I will propose a correction and send you the confirmation by message.

InsertAccept

Summary

Request: deviation in the letter. Documents on file. Next step: correction, confirmation by message.

#Analytics: topics, not people

Conversation analytics shows why people call: topics, root causes, recurring questions. For a benefits agency that is valuable. At the same time, transcripts contain exactly the data this post is about.

Where special categories are processed on a large scale, Art. 35(3) GDPR requires a data protection impact assessment. It should be in place before launch, not after.

A simple line works well in practice: analytics show topics and trends in aggregate. Individual conversations are visible only to those with a role for it. Performance analytics on employees also touch co-determination; in the German public sector, that means the staff council.

#When a service provider is involved

If the contact centre runs in the cloud, the provider is a processor. Besides the contract under Art. 28 GDPR, section 80 SGB X applies to social data. Among other things, it requires notifying the supervisory authority before the contract is awarded.

Section 80(2) SGB X also limits where processing may happen: Germany, the EU, equivalent states, or third countries with an adequacy decision. Choosing the region is therefore not a technical detail. Univerx runs data and media in EU regions; hosting in Germany is planned.

#AI follows the same rules

AI agents and Univerx Assist see what a conversation contains. The same roles and retention periods apply to them as to people. Every action of an AI agent is logged, and handover to a person is possible at any time.

#A checklist for the start

How this fits into citizen service without broken hand-offs is shown in Citizen service without broken hand-offs. The GDPR basics are collected in the Trust Center.