Running a contact centre in Europe

#Starting point

A contact centre handles more personal data in a day than many departments do in a month: calls, recordings, transcripts, evaluations, shift plans. In Europe, three bodies of rules apply at once: the GDPR, the EU AI Act and, in Germany, workplace co-determination.

This guide maps those rules onto what a contact centre actually does: distribute contacts, record conversations, analyse results and use AI. It is not legal advice. It is meant to help you ask the right questions before a contract is signed.

#Clarify roles: who is responsible for what

Before features come roles. Your organisation is almost always the controller under the GDPR. The platform provider processes data on your behalf and is therefore a processor.

That relationship is governed by a contract under Art. 28 GDPR, the data processing agreement. It sets out subject matter, duration, data types, technical and organisational measures and how sub-processors are handled. Ask for the sub-processor list before the contract review, not afterwards.

#Data residency and third countries

The second basic question is where data and media live. That covers more than customer records: recordings, transcripts, logs and backups count too. A clean answer names regions per data type and says whether access from outside the EU is possible.

Transfers to countries outside the EU are only lawful under the conditions of Art. 44 et seq. GDPR. Ask to see which services run outside your chosen region, for example support or speech processing. The post Data residency: the five questions goes deeper.

#Routing: who gets which contact

Routing is data processing. Which attributes routing uses is a decision with consequences: phone number, channel and time of day are harmless; purchase history and inferred mood are not. The GDPR principle of data minimisation in Art. 5 applies here as well.

Decide which attributes a routing rule may use and record that in your record of processing activities. That way it stays traceable why a contact ended up in a particular queue.

#Predictive routing and the AI Act

Predictive routing matches each contact to the person most likely to achieve the best result for a chosen KPI. To do that, the model needs data about employees’ past outcomes. That is where a second look pays off.

Annex III of the AI Act lists as high-risk the systems that allocate tasks based on workers’ individual behaviour or personal traits, or that monitor their performance. Whether your routing falls under it depends on its design. Have it assessed before go-live.

Routing can affect customers too, for instance when a model decides on waiting time or priority. Art. 22 GDPR protects people from decisions based solely on automated processing that significantly affect them. Write down where people can step in.

#Recording: legal basis, purpose and retention

Calls cannot simply be recorded. In Germany, recording the non-public spoken word without authorisation is a criminal offence under Section 201 of the Criminal Code. On top of that, every recording needs a legal basis under Art. 6 GDPR.

In practice that is usually consent, obtained at the start of the call with a genuine option to decline. The consent is stored with the conversation. The same applies to employees; their side of the recording also belongs in the works agreement.

#Purpose determines retention

Recordings kept for quality management are retained differently from recordings that prove a contract was concluded. Art. 5 GDPR requires that data is kept no longer than its purpose requires. A retention and deletion policy therefore answers three questions per purpose.

Check whether the platform can apply retention per purpose, queue or channel, and whether deletions are logged. A retention period that only exists on paper will not help you in an audit.

#Screen recording

Many quality programmes record the screen as well as the call. The screen shows customer data, internal notes and often other applications. Limit screen recording to the applications the evaluation needs, and mask fields that hold sensitive data.

Screen recording is also a technical system in the sense of co-determination. It belongs in the same works agreement as call recording, with its own purpose, its own retention period and its own circle of authorised people.

#Analytics: insight, quality, performance

Conversation analytics, quality evaluation and performance metrics are the most sensitive area. In Germany, technical systems that are capable of monitoring employees’ behaviour or performance are subject to co-determination under Section 87(1) no. 6 BetrVG. What counts is the capability, not the intention.

In practice: which reports exist, who sees them and what they may be used for is agreed with the works council. The platform has to be configurable to match. The post Talking to the works council about analytics helps you prepare.

Univerx Assist· active

Conversation

AI agent, disclosedHandover from AI agent · context complete

I received the decision letter, but the amount does not match my application.

I have the case in front of me. One moment, I am checking the calculation.

Sentiment: calmVoice

Univerx Assist

Suggested reply

The letter deviates from the application. I will propose a correction and send you the confirmation by message.

InsertAccept

Summary

Request: deviation in the letter. Documents on file. Next step: correction, confirmation by message.

#Sentiment and emotion: a hard line

Art. 5(1)(f) of the AI Act prohibits AI systems that infer the emotions of people in the workplace, with narrow exceptions for medical or safety reasons. The prohibition concerns systems that use biometric data, such as the voice, to do so.

#Planning and working time

Workforce planning processes employee data as well: availability, absences, shift preferences and real-time adherence to the plan. Under Section 87(1) no. 2 BetrVG, the start and end of working hours, breaks and the distribution across weekdays are subject to co-determination.

Real-time adherence is also an analysis in the sense of no. 6. Agree who sees deviations, how long they are kept and whether they may feed into performance conversations. The guide Workforce planning in the contact centre covers the planning basics.

#AI in dialogue: disclosure and oversight

Art. 50 of the AI Act requires that people are informed when they interact with an AI system, unless that is obvious anyway. This transparency duty has applied since 2 August 2026.

For AI agents on the phone and in chat, that means disclosure at the start, repetition on request and a route to a person at any time.

Disclosure belongs in every channel, including SMS and messaging apps, where no avatar or voice gives the difference away.

For assistance features such as suggested replies, the person decides what is sent. Log which suggestions were accepted so that quality and responsibility remain traceable.

Since February 2025, Art. 4 of the AI Act has also required providers and deployers to ensure sufficient AI literacy among their staff.

In a contact centre, that means training for everyone who uses, reviews or approves AI output. The guide Introducing AI agents responsibly shows what that looks like.

#Preparing the impact assessment

A data protection impact assessment under Art. 35 GDPR is required when processing is likely to result in a high risk to the people concerned. Systematic analysis of conversations, new technologies such as AI and large-scale processing are typical triggers.

The assessment is your responsibility. A provider can make it much easier, though, by describing its processing openly.

1. Describe the processing. Channels, data types, purposes, recipients, regions, retention.
2. Test necessity. Justify why each data type is needed.
3. Assess risks. Separately for customers and for employees.
4. Define measures. Role rights, pseudonymisation, aggregation, deletion, disclosure.
5. Document the result. And review it whenever the configuration changes significantly.

#Data subject rights in daily operations

The contact centre is often where access and erasure requests arrive. Anyone who asks for access under Art. 15 GDPR is entitled to all data about them, including recordings, transcripts and chat histories.

So check whether every contact of a person can be found, exported and deleted across channels. An erasure request under Art. 17 GDPR that reaches telephony but not the transcript archive has not been fulfilled.

#Security and regulated sectors

Banks, insurers, energy suppliers and other regulated organisations face further rules. DORA requires financial entities to manage the risks arising from ICT third-party providers. NIS2 extends cybersecurity duties to many sectors and their supply chains.

For the contact centre, that means the platform provider becomes part of your supply chain. Plan early for documents on security measures, continuity plans, reporting lines and exit scenarios. The Trust Center covers NIS2, DORA and BSI C5.

#Questions for your provider

Procurement and privacy teams are often handed seals and slogans. Documents that can be checked are more useful. The table shows what a reliable answer looks like.

#In operation: keep changes in view

A clean review before launch is half the work. A cloud platform keeps changing: new features, new AI models, new sub-processors. Any of these can touch one of your decisions.

Agree how you will be told about changes and how long you have to object. Internally, a simple rule helps: new reports, new AI features and new data types are only switched on after review by privacy and, where needed, the works council.

Accessibility belongs in this rhythm too. Since 28 June 2025, the European Accessibility Act, implemented in Germany by the BFSG, has applied to many consumer services, including customer interfaces such as chat and self-service. The guide Accessibility in customer service shows the way.

#Checklists for the start

The first list belongs in procurement and privacy preparation. The second is the basis for the conversation with the works council. Both should be answered before the pilot begins.

#How Univerx supports you

Univerx is built so that these questions are configuration, not a special project. Data and media stay in EU regions of your choice; hosting in Germany is planned. The data processing agreement, the sub-processor list and material for your impact assessment are available on request.

AI agents disclose themselves as AI, hand over with context at any time and log every action. Conversation analytics and quality management can be configured so that role rights and aggregation follow the rules you have agreed.

The Trust Center shows the status of each item: “designed for”, “on request” or “available”. The pages on the GDPR, the EU AI Act and data residency go into detail. If you would like to work through your questions directly, talk to us.