Contact Center Pipeline May 2026 | Page 33

COMPLIANCE

As the public’ s awareness of personal data rights evolves, in-house contact center teams, business process outsourcing organizations( BPOs), and other providers are increasingly under a microscope. They must prove they have the means and expertise to ensure their policies are correctly managed.

As a result, compliance-related issues have moved to front-of-mind for companies and their customer support teams.

Adherence has shifted from a back-office obligation to a front-line concern, with 73 % of leaders convinced that the satisfaction of compliance standards improves the perception of their businesses, according to a 2023 compliance trends report by NorthRow, cited by Drata.

REGULATIONS THAT SHAPE CENTERS

Here are the key laws, regulations, and standards that commonly shape contact center agent conduct( also see FIGURE 1).

1. TCPA( the Telephone Consumer Protection Act), TSR( Telemarketing Sales Rule), and Do Not Call regulations that mandate U. S. outbound contact practices.

They require marketers to protect against intrusive telemarketing calls, SMS text messages, and faxes, set calling hours, and maintain and comply with do not call lists, enforced by the Federal Trade Commission.

( Note that some states have regulations, notably on calling hour windows, that are more restrictive than the federal regulations.)

2. CCPA( California Consumer Privacy Act), which defines privacy rights for state residents. CCPA requires that companies provide amenities such as an official privacy policy, functional opt-out links, and 45-day response times for consumer requests.

FIGURE 1

3. HIPAA( Health Insurance Portability and Accountability Act), which dictates how U. S. healthcare data and electronic patient records are handled, stored, and transmitted.

These mandates extend not just to healthcare organizations, but to every business partner that works with a healthcare organization.

4. PCI DSS( Payment Card Industry Data Security Standard), enacted by the PCI Security Standards Council. It protects customer financial transactions, providing mandates on how and when credit card information can be transmitted or exposed during contact center interactions.

5. GDPR( General Data Protection Regulation), which governs data access and portability, consent, rectification, and erasure rights for European Union( EU) member state consumers.

The GDPR applies to companies transacting in countries that belong to the EU. Any business that works with customers located there must also comply with these guidelines, since they gather data relative to them.

6. Other European countries that do not belong to the EU, such as Norway, Switzerland, and the U. K. have regulations that are similar or nearly identical to GDPR.

Those include:

• U. K. GDPR and Data Protection Act for the post-Brexit United Kingdom.

• EEA( European Economic Area) agreement for Norway, which coordinates with the EU.

• Federal Act on Data Protection( FADP) in Switzerland, which was recently revised to better align with the established EU standards.

MAY 2026 33

SOURCE: IFT