Industries · BPO and professional services
You handle other people's customers. Show you handle them carefully.
A BPO answering calls for a lender, a payroll firm running salaries for 200 companies, or a CA firm filing returns all hold personal data that belongs to someone else's customers or staff. Agents see screens full of names, account numbers and addresses all day. Clients expect you to follow their rules, and the DPDP Act expects them to check that you do.
What you hold
The personal data in a typical week
The register every duty starts from. In TrustOS each category is linked to the systems that hold it, the purposes it serves and an owner.
Data register · BPO and professional services6 categories
- Client customers' contact and account details
- Call recordings and chat transcripts
- Payroll, PAN and bank details of client employees
- Tax and financial records of individual clients
- Agent and employee records
- Screenshots and documents in shared drives
Pressure points
Where the DPDP Act bites in bpo and professional services
Each client sets different rules
One client wants call recordings kept for 90 days, another for a year, a third wants none stored outside its own system. Your teams need to follow the right rule per process.
Agent access and screen data
Agents can see far more than they need. Clients will ask about access control, clean desk rules and monitoring, and a breach caused by an agent is still a breach.
Telling the client about an incident fast
Your client has to inform the Board and affected people without delay. That only works if you tell the client first, quickly and with the facts.
Data of people outside India
The Act has a limited exemption for processing personal data of people outside India under a contract with a foreign party. International work may fall within it, while domestic clients will not.
How TrustOS helps
The modules that matter most here
Set retention for recordings, transcripts and files per client process, and track deletion at the end of each period.
Record an incident, notify the affected client with the facts, and keep the timeline that their own notice will rely on.
Answer each client's due diligence once, and keep the responses and agreed terms against that client.
Give a client auditor an evidence pack for their process, without showing records from other clients.
What it looks like in TrustOS · sample data
An example scenario
Illustrative example: a misdirected payroll file
Suppose a payroll firm emails one client's salary register to the wrong client. In this hypothetical, the team opens an incident in TrustOS, records what was sent and to whom, confirms deletion by the recipient, and sends the affected client a timeline and summary the same day so that it can decide on its own notices.
Rules that sit alongside the Act
- Data protection and confidentiality terms in client contracts
- Sector rules your clients pass on, such as RBI outsourcing guidelines
- Professional rules for chartered accountants and other regulated professions
- Foreign laws such as the EU GDPR or UK GDPR, for international clients
TrustOS helps you keep these obligations in the same record. Your counsel decides how they apply to you.
Questions
From bpo and professional services teams
Does the DPDP Act apply to our offshore work?
The Act exempts some processing of personal data of people outside India under a contract with a foreign party, though some duties, such as security safeguards, may still apply. Domestic clients are fully in scope. Check each contract with counsel.
Our clients use their own tools. What would we track in TrustOS?
Your own data, your agents' access, retention per process, incidents and the evidence clients ask for. You do not need to copy client data into TrustOS.
Can a small CA firm use this?
Yes, with a lighter setup. A firm with a few partners can start with an inventory, a retention plan for client files and a simple incident process.
For bpo and professional services teams
See TrustOS run on bpo and professional services data
Bring the systems that hold your client customers' contact and account details, and the requests your team handles today. We will show the work moving through TrustOS, from the first request to the evidence.
Or get a rollout proposal in two minutes- Step 1A 30 minute demo on Google MeetWith someone who knows the Act and the product.
- Step 2Your systems and purposesWe walk one product's personal data through TrustOS.
- Step 3A first phase you can planModules, owners and effort, written down for you to keep.