Situations · Data protection
After an outsourcing contract ends, customer records persist in the vendor’s systems, QA exports and agent working folders, and deletion certificates cannot be verified. A verifiable alternative is keeping all transferred files under the sender’s permission, so termination revokes access and produces a dated log of every read, which can be shown to a regulator.
Support, claims handling, collections, back-office processing: all of it runs on your customers’ actual information. Names, addresses, account numbers, transaction histories, sometimes health or financial detail.
It flows daily, by design, for years. A six-year BPO relationship is not a data transfer. It is a permanent join between two companies’ systems.
This is the part that makes deletion certificates hollow, and it is worth spelling out because it is rarely malicious.
Records get exported for quality assurance, because someone has to sample calls against the data. They get copied into training sets, because new agents need realistic material. They land in working folders on agent desktops, because a spreadsheet is faster than the system for one task. They sit in ticketing tools, in email attachments between team leads, and in the vendor’s own backups on a multi-year retention schedule.
Every one of those copies was created by someone doing their job properly. None of them appear on the map when the contract ends.
Then the engagement ends, or a supervisory authority makes an enquiry, and the question arrives in its plainest form: what happened to that data?
The honest answer for most companies is a shrug wearing a certificate. You hold a signed confirmation of deletion from a vendor who cannot see inside their own backups, and you have no ability to test it. Under most privacy regimes you remain accountable for that data regardless.
The gap between what you can attest and what you can demonstrate is the entire problem.
When transferred files stay under your permission, ending the engagement is an action you take rather than one you request.
You revoke, and what you hold afterwards is not a certificate. It is a log: access withdrawn on this date and at this time, followed by every attempt to open anything since. If there were attempts in the three months afterwards, you know. If there were none, that is evidence too.
That is a materially different artefact to put in front of a regulator, because it describes what happened rather than what was agreed.
A scenario worth planning for: your BPO gets bought. The entity that signed your data processing agreement no longer exists in the same form, and its systems are being merged into an acquirer you never assessed.
Access that you control does not care about their corporate structure. You end it on your side, and it ends.
Everything you ever sent stays under your permission. The engagement ends, you revoke, and you hold the record: access withdrawn on this date, and here is every attempt to open anything since. That is an answer for a regulator that is not a promise.
access ended
Data protection. Start where the problem actually is.