The GDPR right of access and right to erasure, explained

Two rights that matter most for call centers

The General Data Protection Regulation (GDPR) went into effect on May 25, 2018 and introduced several individual rights that organizations must honor on request. For call centers, two of those rights are the most operationally significant: the right of access under Article 15 and the right to erasure under Article 17.

Understanding exactly what each right requires helps you configure your GDPR compliance workflow correctly and respond to requests without over- or under-delivering.

The right of access (Article 15)

The right of access gives any EU resident — called a data subject — the right to get access to their personal data and learn how that data is being processed. When a data subject sends a request, the data controller (the organization that collected the data) must respond with:

• An overview of the categories of data being processed (Article 15(1)(b))
• A copy of the actual data itself (Article 15(3))
• The purposes for which the data is being processed (Article 15(1)(a))
• Details on who the data is shared with (Article 15(1)(c))
• Information about how the data was acquired (Article 15(1)(g))

For a VICIdial system, that means the Lead record itself, every call log entry, disposition history, and any Call recording files associated with that individual.

The right to erasure (Article 17)

Article 17 gives a data subject the right to request deletion of their personal data. One of the valid grounds is that the controller's legitimate interest is overridden by the individual's fundamental rights — which is a broad, subjective standard. The practical implication: when a customer asks you to delete their data, the bar for refusal is high.

Unlike simply removing a phone number from a DNC list, a GDPR erasure request requires wiping call logs, lead fields, and recordings — everything that can be traced back to the person.

How Article 15 and 17 differ in practice

flowchart TD
  A[Data Subject Request] --> B{Type?}
  B --> C[Access - Article 15]
  B --> D[Erasure - Article 17]
  C --> E[Provide copy of all data]
  C --> F[Explain processing purposes]
  D --> G[Delete personal data]
  D --> H[Delete call recordings]
  E --> I[Controller obligation fulfilled]
  F --> I
  G --> J[Erasure obligation fulfilled]
  H --> J

An access request is a disclosure obligation — you hand over data. An erasure request is a destruction obligation — you remove it permanently. Both can arrive from the same person at the same time, so your workflow should handle each independently.

What VICIdial provides to meet these obligations

VICIdial has a built-in GDPR compliance layer controlled by two settings. At the system level, Admin -> System Settings includes Enable GDPR-compliant Data Download Deletion. Set it to 1 to enable downloads, or 2 to enable both downloads and deletion including recordings.

When enabled, the Modify Lead page shows two GDPR options at the bottom: one to download a ZIP of all lead data, logs, and recordings (satisfying an access request), and one to review and permanently purge the record (satisfying an erasure request). For the full walkthrough of how to use these settings, see how to export or purge a lead's data for a GDPR request.

For a broader view of how GDPR fits into your overall compliance posture, read the VICIdial compliance overview.

If you want to review how VICIfast's managed hosting handles GDPR configuration on your behalf, see pricing.