The Information Commissioner’s Office (ICO) ‘never said’ that charities were exempt from all or most of the data privacy and protection rules that govern sales and marketing, however many people in the charity sector thought they had an exemption. Plus there were never any enforcement cases or fines of charities, so there was no evidence that the ICO did care about charities’ rule-breaking. 

Then, from 2015 and 2016, in the wake of the death of Bristol poppy seller, Olive Cook, charities’ fundraising techniques came under a lot of scrutiny and criticism. Inevitably, the ICO became involved and its investigations culminated in fining the following big-name charities in 2017 – see more. 

The International Fund for Animal Welfare, Cancer Support UK, Cancer Research UK, Guide Dogs for the Blind, Macmillan, the British Legion, NSPCC, Great Ormond Street, WWF, Battersea Dogs & Cats Home and Oxfam. 

This was a ‘shot across the bows’ of the whole charity sector, specifically highlighting the charities’ undeclared, hidden sharing of supporters’ data and income profiling (wealth screening). The total amount of the fines levied – £138,000 – wasn’t that great, but the reputational damage of what should be some of the most trusted organisations in the country was considerable. And the knock-on impact on charities’ fundraising business models contributed to millions of lost revenue for their causes.  

Incidentally, the ICO’s focus on charities’ marketing practises has diminished, but it’s not gone away as evidenced by this recent fine of a charity sending SMS appeals without consent. 

So what? 

That was and is a very challenging experience for charities, but most of us don’t work in the third sector. So, why the brief history lesson? Because commercial B2B sales and marketing may be about to go through a similar experience.

B2B’s wake up call 

Again, the ICO has ‘definitely’ never said that B2B sales and marketing isn’t covered by the data protection rules, though some aspects of the regulations are less stringent for business communications. However, a lot of B2B players certainly act like they’re excluded from the compliance considerations of their informed and professional B2C peers.  

Why? Well, partly because the ICO never fines organisations for B2B marketing failings. Or at least not until now. 

We all aspire to do the best for our prospects and customers, treat them with respect and in accordance with the law. But, inevitably, when these questions seem to be rather nuanced and not simply black and white, rational organisations will apply a risk assessment to guide their degree and prioritisation of compliance with regulations. So, if you operate B2B and the regulator seems to ignore your sector and business area then it’s reasonable to think that the level of regulatory risk you are exposed to is a lot less than in B2C.

All change 

A fine imposed by the ICO in late December suggests that things have changed. This case, described here, not only created considerable disruption to the operations of Northern Gas & Power, a business energy brokerage company based in Gateshead, it’s resulted in negative publicity, reputational damage and a £75,000 fine.

Northern Gas & Power largely sells its brokerage service to businesses through outbound calling to businesses from its two contact centres in Gateshead and Leeds. Northern operates – or operated – at scale, with over 4 million calls attempts made in the year from May. However, irrespective of volume there are a couple of clear lessons we can all draw from Northern Gas & Power’s experience.

  1. Northern failed to screen its calling data against the Telephone Preference Service (TPS) or the TPS’s little-known business number equivalent to the Corporate Telephone Preference Service (CTPS). As you will probably know, the TPS is the national ‘opt out’ register which needs to be referenced before undertaking any ‘cold’ or unconsented sales and marketing calling. Most B2C organisations are very aware of the TPS, B2B firms often less so – and the CTPS is largely forgotten by nearly everybody.

That will need to change.

  1. When the GDPR arrived here (as the 2018 Data Protection Act in the UK) there was a lot of talk about the fuzzy lines between individuals and companies. You can email hello@contactcentrepanel.com and that’s a business address, but sullivan@contactcentrepanel.com is my personal data. Similarly, the Contact Centre Panel office number 0114 2096120 isn’t anyone’s personal data (though it could be registered with the CTPS and thus off-limits), but my mobile number is. And for many companies, personal email and mobile will be the only way of making contact.

All these aspects need to be thought through, understood and managed.

  1. Northern purchased prospect data, but did not undertake appropriate due diligence of its suppliers to ensure they were compliant and reputable. It failed to ensure robust, defensible contracts were in place with its suppliers and didn’t test or audit the data supplied.

Buying third party data is now one of the most potentially fraught and risky activities an organisation can undertake and needs to be handled with deliberation and care. 

  1. As the ICO’s enforcement notice makes clear, Northern’s operational management, internal controls and processes were poor. Added to which its contact management systems – and Northern’s team’s ability to manage them – was very deficient, directly leading to poor data management and ensuring suppression requests were actioned.

Northern Gas & Power has experienced considerable growth and apparent success, but without sound operational, data and technology underpinnings, continued success is increasingly difficult to sustain 

Whether you exclusively market to businesses or do so in combination with targeting consumers, the ICO’s latest move strongly suggests that B2B has lost any real or imagined status as a data protection compliance exception.

Contact Centre Panel boasts many years of collective experience in B2C and B2B customer targeting, acquisition and service, supplemented by a deep but pragmatic understanding of how to design and operate business models compliantly. Contact Centre Panel can offer clients

Lesson 3 – Who’s calling?

About a quarter of all ICO fines – and half of the phone-based enforcement cases – involve the incorrect use of Caller Line Identification (CLI) numbers. As you probably know, there are the numbers presented on the customer’s phone when you call them.

Again, it’s Ofcom that sets the rules and regulations about the use of CLIs, but it’s the ICO who are pushing fines and enforcement. Misusing CLIs is a red flag to the regulator.

Simply put, CLIs should clearly identify the recipient of the call, be dialable, consistent and not confuse or mislead the consumer. In addition, if the customer rings the CLI number back you need to be able to inform the customer who you are and why you were ringing them.

That probably sounds very straightforward and you may be very confident about your use of CLIs. But that might not always be the case even when you feel you are being reasonable and fair:

Sadly, the answers to these questions aren’t always clear, but you need to work out your approach and justification if you want to avoid damaging legal action and fines. Need a hand? Let us know.

What do Boris Johnson, Len McCluskey, Philip Schofield and Mike Ashley all have in common? The thing that links this peculiar group is that their organisations, parties, or companies have all been fined by the Information Commissioner’s Office (ICO) over the past few months for illegal marketing activities.

Even though none of these fines (which you can read about here) have had quite the amount of publicity you might think they deserve, they have all resulted in a degree of reputational damage, disruption to business plans and a chunk of unbudgeted costs. What do Boris Johnson, Len McCluskey, Philip Schofield and Mike Ashley all have in common? The thing that links this peculiar group is that their organisations, parties, or companies have all been fined by the Information Commissioner’s Office (ICO) over the past few months for illegal marketing activities. Even though none of these fines (which you can read about here) have had quite the amount of publicity you might think they deserve, they have all resulted in a degree of reputational damage, disruption to business plans and a chunk of unbudgeted costs.
Boris, Len, Philip and Mike are unlikely to form any one person’s ‘top 4 favourite people’ list, but each has their fans and supporters who might be surprised to see them involved in breaking the law in terms of how they market to consumers. Contact centres are squarely in the ICO’s line of fire and you should focus on making very sure that your brand or operation doesn’t find itself in the same position as Boris, Len, Philip and Mike.

We’ve been carrying out some analysis to help you do just that. Helpfully, in 2021 (to date) the ICO has imposed twice as many fines than it did in the whole of last year; part of a steady increase in the ICO’s enforcement action. (Incidentally, hardly any of these fines are imposed under the 2018 Data Protection Act – which is how the government turned the GDPR into UK Law – but are infringements of the far older and less well-known PECR rules. However, that’s another story)

Lesson 1 – Voice still rules (when it comes to breaking the rules)

[/vc_column_text][vc_column_text]We live in a multi-channel world, but when it comes to rule-breaking the phone is still the leading communication channel. Very few contact centres have phone calls as at least part of their channel mix, but those which make outbound calls need to be especially conscious of the rules.[/vc_column_text][image_with_animation image_url=”17959″ alignment=”center” animation=”Fade In” border_radius=”none” box_shadow=”none” max_width=”100%” margin_top=”25″ margin_bottom=”50″][vc_column_text]The rules include those governed by Ofcom which contain, but aren’t limited to, the use of predictive diallers. An area that we will be covering in a future article.

However, most enforcement is carried out by the ICO and invariably when companies are fined for their live calling its because they haven’t screened outbound calling lists against the Telephone Preference Service (TPS) register.

“Well, that’s obvious.” You might say “People have been doing for that for over 20 years. Only crooks and scammers wouldn’t TPS screen!”. That’s partly true, but it’s not just the scammers who have been fined.

Sometimes, firms think they have a prior relationship or permission that means they don’t need to screen against the TPS. In some cases, having an existing relationship does trump the need to TPS screen, but not always and the criteria aren’t always black and white.

Need some help navigating the ‘TPS or not?’ question? Give us a call

In other cases, firms have been reassured that the external calling data they have been provided has already been TPS screened by the data provider, when in fact it hasn’t. The ICO has repeatedly made clear that it expects brands and data purchasers to undertake the checks and due diligence needed to ensure that data is compliant and legal. “Don’t expect; inspect!”

Contact Centre Panel can help with this unenviable challenge, too. See Lesson 2, below.

Lesson 2 – 3rd Party Data? A first party problem

[/vc_column_text][vc_column_text]The incorrect or inappropriate use of third-party data – which is typically bought or rented to allow firms to access new potential customers – is a very common feature of the ICO’s enforcement cases, specifically mentioned in nearly half of them.

The whole area of the law and regulations around the identification and management of consumers’ personal data is complex and potentially fraught – especially when the data is provided by a third party.

As previously mentioned, as far as the ICO is concerned the compliance onus is on the data purchaser. Users of third-party data must undertake thorough due diligence of data providers to ensure they have a sound legal basis to use the data for marketing purposes, as well as having robust, enforceable contracts in place. This cannot be a ‘one and done’ or tick box exercise and should start with a thorough audit of the legal and compliance standing of the data provider.

Fortunately, Contact Centre Panel can help. We have undertaken a lengthy and detailed rolling audit of the legal and compliance status of over 50 data providers. As a result, Contact Centre Panel has identified a small group of providers – which offer data for use in a variety of channels – who we feel are well-placed to potentially offer legal and compliant assistance to contact centres and brands.

Lesson 3 – Who’s calling?

[/vc_column_text][vc_column_text]About a quarter of all ICO fines – and half of the phone-based enforcement cases – involve the incorrect use of Caller Line Identification (CLI) numbers. As you probably know, there are the numbers presented on the customer’s phone when you call them.

Again, it’s Ofcom that sets the rules and regulations about the use of CLIs, but it’s the ICO who are pushing fines and enforcement. Misusing CLIs is a red flag to the regulator.

Simply put, CLIs should clearly identify the recipient of the call, be dialable, consistent and not confuse or mislead the consumer. In addition, if the customer rings the CLI number back you need to be able to inform the customer who you are and why you were ringing them.

That probably sounds very straightforward and you may we be very confident about your use of CLIs. But that might not always be the case even when you feel you are being reasonable and fair:

Sadly, the answers to these questions aren’t always clear, but you need to work out your approach and justification if you want to avoid damaging legal action and fines. Need a hand? Let us know.

At Contact Centre Panel, we have heard that question being asked with increasing frequency over the past few months, by clients using customer management outsourced service providers (OSPs), which deliver contact centre services. All business operating models have been tested and altered since the start of the Covid–19 epidemic. Customer management and contact centre frameworks and approaches are no exception and the question of whether to consolidate or diversify suppliers is frequently addressed. 

The argument for rationalisation – it’s obvious, isn’t it?

If an organisation is utilising more than one OSP to deliver or support its customer management efforts, then that alone might provide an obvious and compelling argument for consolidating this provision. 

1. Leverage scale and cost consolidation

As any procurement professional will tell you, consolidating work currently divided across a number of suppliers offers an immediate opportunity for cost savings. These can be both: 

2. Enable partnerships

If an organisation wants true partnerships with its OSP suppliers, it will find it easier if there is just one. Partnerships are always underpinned by relationships and cultural alignment and – if the client chooses carefully – these can be best identified and achieved in an exclusive supplier. In any event, using one customer management supplier will make it easier for clients to enter into an ‘outcome based’ or ‘vested outsourcing’ relationship. When a supplier has intimate knowledge of its client, its processes and customer base it can establish the confidence to contract on the basis of outcomes and outputs, not costs and inputs.  

3. Consistency and the elusive ‘Single Pane of Glass’

Most customer experience and customer management professionals regard consistency of experience as a fundamental building block and measure of customer management effectiveness. Consistency is, of course, much easier to achieve when one supplier handles all of your customers’ interactions.  

All organisations seek the elusive ‘single pane of glass’ – the ability to anticipate, observe and understand customer contact needs and experiences. To do so is typically reliant on the development of a sophisticated, integrated but flexible ‘tech stack’ of contact channels, tools and data repositories and flows. Unless an organisation has its optimal tech stack already built, ready to deploy and encompassing all customer channels and interaction modes, the challenge will be made just harder if it uses multiple customer management OSPs. 

4. Exploit internal change

The legacy use of multiple customer management providers is typically an indirect function of two features of clients’ business: 

  1. Internal divisions and silos within the client organisation which demand or tend towards requiring separate providers for separate sets of activities or segments of the total customer overall base. With separate business units or cost centres, it is natural for decision making about the use of customer management OSPs to be localised to the business unit level. 
  2. Technology or proposition differences which historically made it impractical or impossible for one supplier to meet all the client customer management needs.  

Organisational, product and proposition or technology change may make these historical decisions redundant or outmoded. The rate of business change has rocketed since the start of 2020 – correctly exploited by the business owners of customer management and customer experience, these changes can help underpin the business case for supplier rationalisation. 

The argument for diversity

So, the rationale for rationalising customer management OSPs and consolidating service provision might appear to be clear and overwhelming. However, this is not always the case. 

1. Flexibility and business continuity

In the broadest sense, Covid has underlined the need for all businesses – and all their critical functions – to be resilient in the face of challenges and interruptions. As a result of recent experiences, often – but not exclusively – to do with the relative ability of OSPs to deliver rapid, effective and secure home working, a number of Contact Centre Panel clients are actively seeking to expand their portfolio of OSPs in order to provide greater resilience and flexibility. This is a recognisable trend, especially amongst larger clients using global networks of OSPs and customer management providers. 

2. Innovation and Competition

One of the reasons to outsource customer management is to leverage and benefit from both deep functional expertise (the OSPs should be the experts) and a dedication to interacting with customers. Along with this expertise and the insight that a ‘fresh pair of eyes’ brings to any situation, newly outsourcing an activity or contracting with a new supplier can create innovation. Contact Centre Panel will always encourage clients and OSP suppliers to explore new and innovative solutions, not just outsource or change supplier for the same old approaches and techniques. Ongoing, sustained creativity and innovation is hard to achieve, but is more likely in an environment of supplier diversity and competition. 

In addition, managed competition between OSPs can allow real-world benchmarking of costs, resourcing, performance metrics and customer outcomes. 

3. Horses for courses

There are over 140 outsourced customer management providers in Contact Centre Panel’s network. They cover the widest possible variety of locations, scales and areas of specialism – from generalists to centres with very narrow, specific areas of expertise. For some organisations, the performance, experience and expertise of a niche provider will always place them ahead of a generalist OSP, which can turn its hand to any customer experience activity across a client’s whole customer base. The challenge of managing multiple providers, avoiding customer experience friction and disconnects, is unavoidable, but for many clients, it’s a price worth paying. 

Conclusion: which way to go?

Each client’s motivation for using OSPs to provide customer management services will vary. Their business and customer experience goals, history, internal structures and culture will all have a part to play. In times of challenge and change all these factors are subject to review and alteration – and that includes whether to adopt a consolidated or diversified OSP supplier approach. 

Contact Centre Panel gives clients the opportunity to review their existing OSP contracts, determine if they are best fit and secure the right approach for the on-going success of the brands customer interaction management. 

When it comes to Data Adequacy, it’s been a slow process for the UK to gain full agreement from all the EU institutions and although we cannot be 100% sure, it’s now looking almost certain that the EU will deem the UK’s data protection regime ‘adequate’. This will then allow data transfers to continue between the UK and EU as it does at present. For further detail from ICO click here.

The lawyers’ lament

An ‘adequacy’ decision is one of the most important rulings needed to ensure uninterrupted trade in data and services for the UK with the EU, post-Brexit. Without this decision, thousands of individual contractual arrangements would have to be created to cover companies needing to transfer personal data between the UK and EU and vice versa. As we’ve explained before, aside from all the business process disruption that would be caused if the UK’s data protection regime was to be ruled inadequate, there would be a massive, direct legal cost – as covered in our previous article. The New Economics Forum estimated in a recent report that the legal work necessary without an adequacy decision would have cost British businesses between £1bn and £1.6bn. Listen carefully and you can hear the quiet sobbing of contract lawyers missing out on all that work. Tragic!

Transatlantic troubles

So, the adequacy decision is great news, but here’s something else to worry about.

The Privacy Shield was an arrangement designed to provide a mechanism for personal data to compliantly flow between companies in the US and the EU. However, the framework collapsed last summer after being ruled invalid by the European Court of Justice in the Schrems II case – for details click here

You might not directly deal in the personal data of individuals in the US, but it would be a rarity for an organisation not to use any US based technology or solutions that make use of data centres in the US. If so, then you need to address this challenge. Remember, the legal definitions of data processing are extremely broad, so having static data in storage in the US or even being visible on an ad hoc basis to a support engineer working on a case both count as ‘processing’.

There are many organisations that still haven’t managed to create alternative arrangements to transfer personal data across the Atlantic. The EU is working on a replacement for the Privacy Shield, but there is no guarantee this can be agreed any time soon. The data protection regulators, like the Information Commissioner’s Office in the UK, aren’t rushing to penalise companies still transferring data under pre-existing arrangements. But those legacy arrangements aren’t compliant and your business partners, clients and risk management colleagues are all likely to start looking for businesses to put a solution in place.

More work for you and the lawyers!

To create a solution you will probably be reliant on using Standard Contractual Clauses (SCCs) as the basis for transferring data legally. SCC’s are a type of agreed and boilerplated legal solution that provides an outline framework to ensure that both parties are handling data compliantly, onto which the specific business and process details are added. Unfortunately, the SCCs are in the process of being amended and updated – for further information click here.

There are draft new versions you can make use of, but you might find that your commercial law firm will soon need to change them again if the final version is different. So, more cost and more uncertainty, but good news for those work-deprived contract lawyers.

So, at the last minute and just in time for Christmas, the EU and UK agreed a post-transition Brexit trade deal. If you read our article published just a few days before Boris and Ursula settled their fish-based disputes, then you would hope that the deal included the vital EU ‘adequacy’ ruling on UK personal data protection rules. Unfortunately, this was not the case.

The parties have agreed a 4-to-6-month extension to the current arrangements, so personal data can continue to flow between the UK and the EU, but that looks like the final extension.

What does ‘Processing Personal Data’ really mean?

It is a broad definition. ‘Personal data’ is essentially anything that can be used to identify a real, living person and ‘Processing’ covers just about any activity that involves that data. It is not just for the use of communications e.g. making calls, sending emails and messaging on social channels, but analyse, segmentation and even simple data back-up on storage can count as processing.

Implications of a no adequacy ruling

If the EU does not give the UK an ‘adequacy ruling’ then, as stated by the government, the implications for data handling are that UK data being passed to Europe will be covered by existing laws, but if EU data is sent to the UK, it could contravene data privacy regulations. For pan-European operations, this will pose serious new risks.

If the UK’s rules are not considered adequate by the EU, then a raft of new contractual arrangements using Standard Contractual Clauses (SCCs) will be required. According to a report from the New Economics Foundation and UCL European Institute ‘The Cost of Inadequacy’, “the aggregate cost to UK firms would likely be between £1 billion and £1.6 billion”. Most of which would be the cost of commercial legal work to implement the necessary SCCs.

Are you feeling lucky?

So, should you start to worry about this now and give your lawyers a call?

You may well imagine that as the UK uses the EU-wide General Data Protection Regulation (GDPR) as the basis for its data protection rules and the 2018 Data Protection Act, then the European Commission would have no alternative than to grant the UK an ‘adequacy’ ruling. But that is not the case. A large number of data privacy professionals and data right groups argue that the UK does not reflect EU standards in its collection and processing of personal data, especially in the areas of national security and data sharing with other friendly states, so shouldn’t be granted ‘adequacy’. It is worth noting that the European Commission has so far ruled only a small number of countries’ personal data protection to be adequate (Andorra, Argentina, Canada, Faroe Islands, Guernsey, Israel, Isle of Man, Japan, Jersey, New Zealand, Switzerland and Uruguay).

Do not forget the Privacy Shield

In the meantime, if you have clients in the USA or use technology solutions with data centres in the US, there is something else you need to pay attention to. Since 2016 an arrangement agreed between the US government and the EU called the ‘Privacy Shield’ provided a framework for US and EU companies to compliantly transfer personal data across the Atlantic. Last summer the Privacy Shield collapsed when the European Court of Justice ruled it invalid over concerns that US corporations are subject to making personal data available to US Government agencies.
This may seem like old news, but many organisations are only just waking up to the implications of it. For most companies, there is a solution that will allow appropriate personal data transfers to continue, but unfortunately, once again that is likely to be reliant on Standard Contractual Clauses, lawyers and considerable expense.

What to do?

To manage your risks there are two key pieces of advice we can give to all businesses who use private data in any way, whether for outbound sales, customer service or sales order processing:

As a last consideration, check all your IT service providers. Do you really know where your call recordings and network data backups are stored? Identifying where your data is held is essential. If hosted in the cloud then find out where the data servers are located and if your technology provider is unable to provide this information, then your business could be at risk and alternatives should be considered.

If you are unsure how to assess your risks and responsibilities now the UK has left the EU, get in touch. We can advise you about the risks you need to consider and potential ways to mitigate them.

As we head towards the end of December 2020, it is looking increasingly likely that Britain will leave the EU without a deal, or with an “Australia type deal” as described in some parts of the press. Although GDPR has been passed into UK law in the Data Protection Act 2018, leaving the EU without a deal will have some significant implications for how the rules around data privacy will apply in the UK in 2021.

The UK Government’s current stance is that ‘The EU is conducting a data adequacy assessment of the UK. If the EU grants positive adequacy decisions by 1 January 2021, it would mean that personal data can flow freely from the EU/EEA to the UK, as it does now, without any action by organisations.’

However, if we leave without a deal and the EU hasn’t given us an “adequacy ruling” then, as stated by the government, the implications for data handling are that UK data being passed to Europe will be covered by existing laws, but if EU data is sent to the UK, it could contravene data privacy regulations. For pan-European operations, this might pose serious new risks.

What is the UK’s data privacy situation as we leave the EU?

If the UK’s rules aren’t considered adequate by the EU, then a raft of new contractual arrangements using Standard Contractual Clauses (SCCs) will be required. This is according to a report from the New Economics Foundation and UCL European Institute ‘The Cost of Inadequacy’. The report estimates “The aggregate cost to UK firms would likely be between £1 billion and £1.6 billion.”, most of which would be the cost of commercial legal work to implement the necessary SCCs.

Add to this, the arrangement between the US and EU called the ‘Privacy Shield’ which was struck down by the EU over concerns that US corporations are subject to making data available to US Government agencies, which the EU considers a data risk. This creates additional implications for data sharing wider than the EU and UK in the western hemisphere.

How can you prepare to be Data Privacy compliant?

The EU has released some draft Standard Contractual Clauses which data controllers and processors can use to remain compliant in 2021 and beyond. Already, several commercial law firms are preparing advice which data owners can use to assess their position with respect to data from the UK, EU and other countries including the US. This may come at a price, so here is a very summary of the impacts that we expect to see:

If you have UK data which you store and process in the UK, your operations are not likely to be affected in the short term, as long as they are already compliant.

If you have UK data which is stored or processed in the EU, you are also not likely to be significantly affected in the short term. The EU’s rules should be enough to protect you against the most likely risks.

If you have EU data which you store and/or process in the UK, you should review your risks and the new SSCs may be needed to assure your compliance. This will apply if you use many nearshore outsourced customer service or data processing teams.

If you are a global operation with data from different regions which is transferred across borders, your situation may be complex and will need looking at carefully.

What is best practise in tomorrow’s data handling world?

To manage your risks there are two key pieces of advice we can give to all businesses who use private data in any way, whether for outbound sales, customer service or sales order processing:

  1. Minimise the amount of data you store per contact. The less data you store, the less likely it is to get you in trouble. Avoid storing risky data such as payment details unless absolutely necessary to your business model.
  2. Minimise the places you hold data. If your data is stored and processed in only one location, the amount of regulation is minimised. Also, the lower number of transfers your data has to undergo, the lower the risk of breaches of privacy, or indeed of your business inadvertently falling foul of the regulations in one region or another.

As a last consideration, check all your IT service providers. Do you really know where your call recordings and network data backups are stored? Identifying where your data is held is essential. If hosted in the cloud then find out where the data servers are located and if your technology provider is unable to provide this information, then your business could be at risk and alternatives should be considered.

If you’re unsure how to assess your risks and prepare for your future once the UK leaves the EU, get in touch. We can advise you about the risks you need to consider and potential ways to mitigate them.

India’s regulations governing outsourcers have recently been relaxed, making it much easier for contact centre agents to work from home and lowering the barriers to entry for businesses wanting to offer outsourced services from India. What does this mean for businesses using outsourced labour to meet customer service demand?

The slimmed-down regulations, announced earlier this month, mean that Indian outsourcers do not now need to register their premises, whereas previously every office used by an outsourcer was required to go through a registration process. There is also no longer any need to give static IP addresses for all operatives and the previously required bank guarantee per seat has been abolished.

This means that outsources in India can now create wide VPNs enabling voice and data to be shared throughout the country and across other countries too.

On the positive side, the new regulations mean that Indian outsources will be able to react to the global shift towards homeworking and counter the move by businesses to move their operations back onshore, nearshore or inhouse, which could potentially have a devastating effect on India’s huge outsourcing sector.

What do you need to know?

Amazingly for any UK reader, the new regulations span just eight pages. You can read the entire document as published by the Ministry of Communications, Government of India, 5th November 2020, in a few minutes here.

Although there are requirements to make call data, secure system access logs and other details available on request, there is no obligation to submit these regularly or register them in advance. The emphasis in the new regulations is on correction rather than prevention of issues.

Is your business outsourcing to India?

These new regulations may make it easier for poorly managed or even unscrupulous operators to work more easily in India. However, it is important to consider that they also make working from home practical for an industry that needs to adapt to a rapid global shift in the way contact centres work.

If you are using Indian outsourced service providers, ensure that their own operating parameters reflect what you need. Seek assurances that data is handled securely and that their systems are safe. Many established outsourcers will already have implemented good data handling and security infrastructures. Make sure that your customer data is safeguarded.

In short, there is no need to stop using reputable outsourced contact centres or remote business process handling. There is, however, an increased pressure to obtain the assurance that your customers’ data is, and will continue to be, handled securely and safely.

Want to assess your potential risk?

If you are unsure how to assess your risks with offshoring parts of your operations, we can help? We have a team of experts who can advise and assess your operation and if required, a network of fully vetted reputable outsource contact centres and technology providers who can provide alternative options to ensure your operations are safe and secure.