A well-known and much-discussed theme of recent years is clearly ‘compliance’, particularly the General Data Protection Regulation (GDPR). What happens when your customer contact is outsourced to a third party? Why is the outsourcing organisation still responsible for complying with the GDPR?
Compliance?
The English verb ‘to comply’ means ‘to meet’ or ‘to adhere to’. For organisations, the term ‘compliance’ is used regarding the adherence to laws and regulations. It thus involves adhering to or complying with standards. In recent years, the government and regulators have imposed more and more rules on corporations. As a result, compliance plays an increasingly significant role.
It is important for an organisation to demonstrate compliance. It is easy to claim that you work compliantly, but where and how is this documented? Non-compliance, failing to meet legal requirements, carries hefty penalties. Compliance with laws and regulations is often strictly monitored. Regulators can, for example, impose significant fines or revoke certain permits. Additionally, compliance is crucial for a company to avoid reputational damage and scandals.
The GDPR in Customer Contact
Since May 2018, the GDPR has been in effect. The GDPR is a European privacy regulation for companies processing the personal data of European citizens. It primarily concerns protecting the personal information of European citizens and regulating the dissemination of personal data outside the European Union.
The GDPR is thus also a major part of customer contact. The aim of this legislation is to reduce annoyance and protect the interests of European citizens. Privacy rights of your customers have been strengthened and expanded with the GDPR. Customers have more opportunities to stand up for themselves when it comes to processing their personal data. They have more control over their data and what your company does with it. For instance, your customer can request access to stored data or withdraw given consent.
You Cannot Outsource Responsibility
Organisations that handle customer contact themselves naturally have much more control than those outsourcing their customer contact to a contact centre. The latter is dependent on one or more third parties for legal compliance, whilst still being held responsible themselves. You cannot outsource responsibility for complying with the GDPR. “But I outsourced it to a specialist” is not a valid excuse in this case. Therefore, it is essential for organisations to have their instructions, training, and controls with external parties well-organised. A compliance programme should include outsourced customer contact. Outsourcing is fine but must be done with insight and control. This means that the company implements measures and procedures to ensure compliance with laws and regulations. Naturally, this changes the relationship between the client and the contact centre. The standards that apply within the company must also be imposed on the third party and properly monitored. In practice, such a compliance programme can indeed strengthen the cooperation between the client and the contact centre.
What Happens if the Contact Centre Fails to Comply with Laws and Regulations?
A regulator always approaches the outsourcing organisation, not the contact centre. In case of violations of laws and regulations, any fines are imposed on the outsourcing organisation. Imagine having a watertight outsourcing agreement that places compliance responsibilities on the third party, but you don’t concern yourself with its execution; unfortunately, that agreement offers no comfort in terms of fines.
Ensure a Clear Compliance Policy
High standards are now set for compliance training, as well as for overall compliance policy and the establishment of compliance with third parties. Therefore, it is firstly important to clearly understand what laws and regulations specifically apply to the contact centre. The next step is to adapt processes, develop training, and create reports. Writing a compliance plan is also part of this. Finally, an organisation must regularly and actively monitor whether its customer contact execution is compliant, also with the third party. High standards are now set for compliance training, as well as for overall compliance policy and the establishment of compliance with third parties. Therefore, it is firstly important to clearly understand what laws and regulations specifically apply to the contact centre. The next step is to adapt processes, develop training, and create reports. Writing a compliance plan is also part of this. Finally, an organisation must regularly and actively monitor whether its customer contact execution is compliant, also with the third party.
Training of Customer Service Staff
The staff in the contact centre are at the forefront when it comes to compliance with laws and regulations. They often have direct contact with the customer, which means their influence on compliance is significant. Therefore, all staff must know and respect the rules. They need to, for instance, recognise when a customer objects to commercial telephone approaches and act accordingly. However, this still often goes wrong. Another pitfall is handling personal data and data breaches. You surely wouldn’t want personal data leaking through your (internal or external) contact centre.
In short, train your customer contact staff in the right matters and regularly check their execution. Have you outsourced your customer contact to a third party? The responsibility still lies with your organisation. Therefore, it is important to set up a compliance programme to ensure your customers remain satisfied and the involved organisations are not caught unawares.
In our Academy, we create true customer service professionals, ensuring every conversation is handled with care. We train our staff intensively. This way, they learn how to handle different customers and systems. Of course, the right laws and regulations are also covered. Want to know more about our Academy? Download the brochure below.
