Do not reduce the assessment to the location of one server. Map every organisation that can process or access the information, and contract explicitly for permitted uses.
The ICO explains that a restricted international transfer can involve making information accessible to a separate organisation abroad, including remote access. UK storage therefore does not, by itself, settle the transfer question. The rules also distinguish separate organisations from employees within the same legal entity. (ico.org.uk)
Ask for a data-flow diagram covering:
- Telephone infrastructure.
- Speech recognition and voice generation.
- The language-model provider.
- Automation and integration hosting.
- Recording, transcript and monitoring storage.
- Agency support personnel and subcontractors.
For each, record its role, location, access, retention and applicable transfer arrangements.
Separately ask whether data is used for model training, evaluation, product improvement or human review. The ICO distinguishes AI development from deployment when considering purposes and lawful bases; permission for handling an enquiry should not be assumed to cover every secondary use. (ico.org.uk)
Our recommended procurement default is no secondary training or reuse of your customer submissions without an expressly reviewed arrangement. Verify that promise across the supplier chain, not just in the agency’s sales proposal.
Sources cited on this page
- ico.org.uk ↗ico.org.uk
- ico.org.uk ↗ico.org.uk