Agree roles from the actual processing
Data protection roles depend on who determines the purpose and means of processing, not only the title used in a proposal. Identify the customer information involved, the campaign purpose, instructions and participating systems. Where Britixo processes personal data on your behalf, appropriate written processing terms must be agreed.
The operational brief should identify allowed uses, categories of data, access permissions and the people authorised to instruct changes. A marketing campaign also needs its relevant PECR controls; a UK GDPR lawful basis alone does not displace separate calling restrictions.
Limit collection and access to the task
Choose fields because they help handle the call or complete the next action. Avoid collecting extensive sensitive information in a general intake when the proper next step is a specialist callback. Additional sensitive-data requirements, international transfers and third-party services need assessment for the actual arrangement.
Agents should use approved accounts and systems with permissions appropriate to the role. Agree how access starts, changes and ends. Customer data should not be copied into personal inboxes or unapproved tools simply because a system connection is inconvenient.
Plan requests, incidents and the end of service
Nominate owners for access requests, correction, objections and potential incidents. Agents need to recognise a request and route it promptly; they should not make unauthorised disclosure or legal decisions on behalf of the responsible team. Retention and deletion should follow a defined purpose and applicable obligations.
For an illustrative intake campaign, the team might keep only the approved enquiry fields in a restricted workspace and send a rights request to your nominated owner. That arrangement still needs documented instructions, notices and an exit plan for records and access. No particular certification, hosting location or universal retention period is claimed by this guide.
Further guidance: ICO: controller and processor contracts · Britixo privacy policy. Campaign requirements should be assessed for the actual service. Reviewed 4 November 2026.