Compliance Resource
Vendor Due Diligence for AI Call Handling
When a supplier handles personal data on your behalf, responsibility for that data does not leave your business. These are the questions worth asking any AI call handling provider, including us.
Why this sits with you
Under the Personal Data Protection Act, an organisation remains responsible for personal data processed on its behalf by a supplier. A provider acting purely as a processor carries certain obligations of its own, particularly around protection and retention, but that does not transfer your responsibility to your customers.
Practically, this means asking specific questions and keeping the answers. Vague assurances are not evidence, and a supplier who cannot describe their data path in detail is telling you something useful.
Ask us these questions too. We would rather answer them at the evaluation stage than have them surface after go-live, and your advisers need concrete answers in order to reach their own view.
The questions
Ask for written answers rather than a conversation. Anything that only exists verbally will be difficult to rely on later.
| Area | Ask | Why it matters |
|---|---|---|
| Data captured | Exactly which fields are collected, and which can be switched off | Determines your exposure and what you must protect |
| Storage and location | Where recordings, transcripts and records are stored, and in which jurisdictions | Cross-border transfers carry their own requirements |
| Sub-processors | Which other providers are in the chain, and what each receives | Your data path is only as clear as its least visible link |
| Model training | Whether your call data is used to train or improve models, and how to decline | A purpose your callers were probably never told about |
| Access | Who at the supplier can listen to calls, under what controls and logging | Supplier-side access is part of your protection position |
| Retention and deletion | Default periods, whether they are configurable, and how deletion is evidenced | Makes your own retention schedule achievable or impossible |
| Breach notification | How quickly you are told, and through which channel | Your own notification duties depend on learning promptly |
| Exit | What is returned, in what format, what is deleted and when | The hardest thing to negotiate after you have committed |
Answers that should give you pause
None of these is automatically disqualifying, but each deserves a follow-up question.
Guaranteed compliance
No supplier can make your business compliant, because compliance depends on how you collect, use and govern data. A guarantee suggests the seller has not thought about it, or is hoping you have not.
Vague storage answers
A reference to secure cloud infrastructure is not an answer. Ask which providers, which regions, and how that is evidenced.
No sub-processor list
Voice services typically involve several providers. A supplier who cannot list them has not mapped their own data path.
Training rights buried in terms
Read the clause on use of your data for product improvement. If there is no way to decline, weigh that against what your callers were told.
Indefinite retention
Where retention is not configurable, your own schedule cannot be applied. Ask what the default is and whether it can be changed.
Unverifiable claims
Certifications, accreditations and residency claims should be capable of being evidenced. Ask for the document, not the logo.
What belongs in the contract
Your advisers will draft to your requirements, but these are the points that most often need to be explicit rather than assumed.
- The scope and purposes for which the supplier may process personal data
- A prohibition on use for other purposes without your written agreement
- Security obligations, and notification to you of any breach without undue delay
- The sub-processor list, and notice of changes to it
- Retention periods and your right to require deletion
- Assistance with access, correction and deletion requests from individuals
- Location of processing and any cross-border transfer arrangements
- What happens to your data at the end of the contract, and by when
Ask how the supplier handles calls it should not handle. A provider that will configure a flow to give clinical, legal or financial advice, handle a safeguarding matter, confirm allergens or manage a distressed caller is telling you how they think about risk. In our deployments those calls always reach a person, and we will not remove that boundary on request.
Frequently asked questions
Is a supplier a data intermediary?
It depends on whether they process personal data on your behalf and nothing more. The classification affects which obligations fall where, so have your advisers confirm it rather than assuming from a marketing page.
Do we need a separate data processing agreement?
Many organisations use one, and it is the natural home for the points listed above. Your advisers can tell you whether your standard terms already cover them.
How do we assess a small supplier?
By the specificity of their answers rather than the size of their compliance department. A small provider who can describe their data path precisely may be a better position than a large one who cannot.
Should data be stored in Singapore?
That is a decision for your business and your advisers. What matters first is knowing where data actually goes, so ask for the answer before deciding whether it is acceptable.
What if the supplier changes sub-processors?
Ask to be notified, and keep your own record current. A data path documented once and never revisited stops being accurate quite quickly.
Can we test the exit process?
Ask what an export looks like before you commit. A supplier who can show you the format is one you can leave, which is worth knowing at the start, not the end. See also migrating from an answering service.
Related reading
Other evaluation and compliance material is in the resources library.
Put these questions to us
Bring your due diligence list to the demo. We will answer in writing, including the parts where the honest answer is a limitation rather than a feature.