GDPR

Processing requires a lawful basis identified before it begins. Consent and legitimate interests are the two usually relied on for outbound contact; legitimate interests requires a documented balancing assessment and cannot be assumed. The related principles do real work: collect only what is needed, use it only for the stated purpose, and keep it only as long as that purpose requires.

Individual rights have concrete engineering consequences. Access means being able to produce everything held about a person, including call recordings and transcripts. Erasure means deleting it across primary storage, backups, analytics and any third-party processor. Portability means exporting it in a machine-readable form. Systems that cannot locate all of one person’s data cannot satisfy these requests within the statutory deadline.

Voice-specific issues stack on top. A recording captures the voice of anyone who speaks, not only the person who consented. Biometric voiceprint processing for identification sits in the special-category regime and needs a stronger condition than ordinary personal data. Every speech, language and telephony vendor in the pipeline is a processor requiring a data processing agreement, and international transfers need their own safeguards.

This is general information about a broad regulation, not legal advice. Obligations depend on the specific processing, and any programme handling EU personal data at scale should be reviewed by qualified counsel or a data protection officer.