Protecting Customer Data in Customer Service: A GDPR Guide

Protecting customer data in customer service comes down to a few habits: give each agent only the data their job needs, hide what they don't need (such as full phone numbers), keep recordings and chats only as long as necessary, log who accessed what, handle deletion requests with a clear process, protect logins with two-factor authentication and keep each company's data separate. Under the GDPR, these habits map directly to principles such as data minimisation, storage limitation and security of processing. This guide describes good practice; it is not legal advice.

Why customer service needs extra care

Support and call center teams see a lot of personal data: names, phone numbers, email addresses, order histories, call recordings, chat transcripts and sometimes payment or ID details. That data flows through several channels at once, is seen by many people (including new hires and outsourced teams) and is easy to copy, screenshot or export.

The GDPR expects you to process only the data you need, keep it no longer than necessary, protect it with appropriate measures and be able to demonstrate this. In customer service, that means the practices below.

1. Role-based access and least privilege

Start with roles rather than individuals: agent, team lead, supervisor, administrator. Give each role the minimum it needs. An agent answering chats rarely needs to export the customer list, listen to other agents' calls or change settings. Hide the columns and fields a role doesn't use, and review access whenever responsibilities change or someone leaves.

2. Per-user permissions without role sprawl

Real teams have exceptions: a senior agent handles escalations, a trainee should see less. A new role for every exception quickly becomes unmanageable. A better pattern is to keep the role as the default and adjust individual permissions on top of it. Two safeguards matter: nobody should change their own permissions, and nobody should be able to grant a right they don't hold themselves.

3. Mask customer phone numbers

In many workflows, especially outbound calling, agents don't need to see the full number: the system can place the call from the customer record. Masking reduces the risk of numbers being copied, misused or taken along when someone leaves.

Masking only works if it happens on the server. If the number reaches the browser and is merely hidden on screen, anyone with developer tools can read it. Searching, filtering and sorting by number should be disabled for masked users too, otherwise the mask can be bypassed.

4. Define retention periods for call recordings

Tell callers that the call is recorded and why. Then decide how long recordings are needed for that purpose (quality review, dispute handling or a legal obligation) and delete them automatically when the period ends. The call's metadata can usually stay for reporting while the audio is removed. Listening should require a specific permission, and every access should be logged. Apply the same thinking to chat transcripts and attachments.

5. Keep audit logs

An audit log answers "who did what, and when?": logins and failed attempts, permission changes, exports, settings changes and access to sensitive records. Logs need protection too: passwords and keys should be masked, and only authorised people should read them. Review them regularly, not only after an incident.

6. Handle access and deletion requests

Under the GDPR, people can ask for a copy of their data (Article 15) and, in certain cases, for its erasure (Article 17). As a rule, you must respond within one month. To do that reliably:

• Know where customer data lives: CRM, tickets, chats, call recordings, email and spreadsheets.
• Verify the requester's identity before acting.
• Check whether a legal obligation, such as keeping invoices, requires you to retain some data.
• Prefer deleting or anonymising personal fields over deleting whole records, so reports stay accurate.
• Document how each request was handled.

7. Turn on two-factor authentication

Agent accounts are a common target for phishing and reused passwords. Two-factor authentication with an authenticator app (TOTP) means a stolen password alone is not enough. Provide backup codes, a clear process for lost phones and a way to see active sessions and sign out other devices.

8. Separate each company's data

If you serve several brands or clients, separation matters. When all customers share the same tables, isolation depends on every query filtering correctly. A separate database per company adds a structural boundary. If you buy software, ask the vendor how customer data is separated.

How VOLTR does it

VOLTR provides tools for these practices; compliance itself depends on your company's processes.

• Separate database per company: each company's users, roles and module data live in its own database.
• Roles and per-user permissions: permissions start with the role and can be granted or removed per person; privilege escalation is blocked. Columns can be hidden by role, and a hidden column never appears in server responses.
• Number masking: for masked roles or individual users, the phone number is removed from server responses and can't be used for filtering or sorting. A masked agent can't dial by typing a number; calls are placed from the record.
• Call recordings: listening needs its own permission and every access is logged. When the retention period ends, the file is deleted and the call record stays.
• Live chat: card numbers, Turkish ID numbers and IBANs can be masked before messages are stored, and a retention setting deletes old messages, attachments and form answers while keeping measures such as wait time.
• Audit log: logins, failed attempts, user, role and permission changes, settings changes and exports are logged, with secret fields masked.
• Two-factor authentication: optional TOTP with QR code and backup codes, plus a list of active devices you can sign out.

Frequently asked questions

Does the GDPR require masking phone numbers?

The GDPR doesn't prescribe specific tools. It requires data minimisation and appropriate security; masking is one practical way to give agents only what they need.

How long should we keep call recordings?

There is no single answer. It depends on why you record and on any sector-specific obligations. Define the period per purpose, document it and delete automatically.

Does a separate database per company make us compliant?

No. It is a strong technical safeguard, but compliance also depends on your legal bases, privacy notices, contracts and internal processes.

Should two-factor authentication be mandatory for agents?

It is widely recommended for any account with access to customer data. At a minimum, make it company policy for administrators and supervisors.

Want to see these controls in practice? Open a free VOLTR account: your company is set up with its own database from day one. Read the details on the Security page, or see how number masking and recording access work in Call Center and how chats are handled in Live Chat.