GDPR

GDPR, the General Data Protection Regulation, is the European Union's privacy law. It governs how you collect, store, and use personal data about people in the EU, and a phone number, a name, and a call recording all count as personal data. It applies based on who you are calling rather than where you are based, so a call center anywhere in the world can fall under it the moment its Lead records contain people in the EU.

The core ideas are simple to state, even if the detail runs deep. You need a lawful reason to hold someone's data, usually their consent or a clear, documented business need. You should only collect what you actually use, and only keep it for as long as you genuinely need it. People have rights over their own data: they can ask what you hold on them, ask you to correct it, and ask you to delete it, and you have to be able to act on those requests.

What it touches in VICIdial

Mostly your lead data and your recordings. Set a sensible Recording retention policy so Call recording files are not kept indefinitely for no reason, since holding data longer than needed is itself a problem under the rules. Honor deletion and stop requests through your DNC (do not call) process, and be ready to remove a person's record entirely, not just suppress dialing to it. Recording a call with someone in the EU usually means telling them clearly, which lines up neatly with good Two-party consent habits.

Keep the two questions separate in your head. GDPR is about privacy and how you treat the data, not about whether you may dial, which is closer to the US idea of Express written consent. The UK runs its own near-identical version after leaving the EU, so calling into Britain raises the same duties under a different name. This is a practical summary, not legal advice; if you call into Europe at any scale, get a data-protection review before you grow.