Proposed lead: Jon Baines, with the buyer’s privacy adviser where necessary.
Draft answer framing: Require a documented account of the processing and responsibilities. A statement that a product is “GDPR compliant” is not the evidence pack.
Why it matters: ICO guidance covers transparency and international-transfer responsibilities, including processor arrangements and high-risk assessments. Its AI guidance is under review following the Data (Use and Access) Act, so an old generic checklist should not be presented as a complete 2026 assessment. (ico.org.uk)
Put this question to the expert:
“Trace one customer call through every organisation that receives audio, text, metadata or a summary. What must the contractor understand and document before launch?”
A strong answer should cover:
- Controller and processor roles, purposes and lawful bases.
- Separate treatment of recording, transcription, quality monitoring and any model-training use.
- Subprocessors, locations, remote access and applicable international-transfer safeguards.
- Retention and deletion across recordings, transcripts, logs and backups.
- Handling of access requests, objections and complaints.
- Whether a data-protection impact assessment is required, with a recorded rationale.
- Additional scrutiny if callers disclose health information or other sensitive circumstances.
Evidence to request: A data-flow diagram, processing terms, subprocessor schedule, privacy wording, retention schedule and a demonstrated rights-request workflow.
Follow-up: “Which obligations remain with the contractor even if the agency runs the system?”
Expert quote: ____________________
Sources cited on this page
- ico.org.uk ↗ico.org.uk