{"id":38376,"date":"2026-11-07T08:00:00","date_gmt":"2026-11-07T07:00:00","guid":{"rendered":"https:\/\/pegamento.nl\/niet-gecategoriseerd\/which-security-requirements-are-important-when-replacing-a-contact-center-system\/"},"modified":"2026-11-07T08:00:40","modified_gmt":"2026-11-07T07:00:40","slug":"which-security-requirements-are-important-when-replacing-a-contact-center-system","status":"publish","type":"post","link":"https:\/\/pegamento.nl\/en\/contact-center\/which-security-requirements-are-important-when-replacing-a-contact-center-system\/","title":{"rendered":"Which security requirements are important when replacing a contact center system?"},"content":{"rendered":"<div id=\"bsf_rt_marker\"><\/div><p>When replacing a contact center system, the most important security requirements are: encryption of customer data (both in transit and at rest), strict access control with multi-factor authentication, compliance with the GDPR, and demonstrable certification of the supplier in the field of information security. These requirements are not optional: contact centers process sensitive personal data daily, and a system change temporarily increases the risk of data breaches or compliance violations. In this article, you will find a concrete answer for each sub-question, so that you can properly assess and safeguard the security of your new system.<\/p>\n<h2>Which security standards apply to contact center software?<\/h2>\n<p>The most relevant security standard for contact center software is ISO 27001, the international standard for information security. In addition, the GDPR (General Data Protection Regulation), NEN 7510 (for healthcare organizations), and possibly PCI DSS (if payment data is processed) apply. Which standards exactly apply depends on your sector and the type of data you process.<\/p>\n<p>ISO 27001 is the baseline standard you should expect from any serious contact center supplier. This certification demonstrates that the supplier has established a demonstrable information security management system, including risk analyses, incident management, and periodic audits. For organizations in the public sector or utilities, additional standards such as the Baseline Information Security Government (BIO) may be relevant.<\/p>\n<p>In addition to certifications, there are technical standards that the software itself must meet: TLS encryption for data transfer, secure API connections, and logging of all system activities. Check whether the supplier is transparent about which standards they comply with and whether they are willing to demonstrate this through documentation or audits.<\/p>\n<h2>How is customer data protected during a system migration?<\/h2>\n<p>During a system migration, customer data is protected by a combination of encryption, strict access rights, controlled data migration processes, and a clear fallback plan. The migration phase is a vulnerable moment: data is moved between systems, and without proper control measures, you increase the risk of unintended exposure or loss.<\/p>\n<p>Concrete measures that you must safeguard during a migration:<\/p>\n<ul>\n<li><strong>Encryption in transit and at rest:<\/strong> all data being transferred must be encrypted, both during transport and when temporarily stored.<\/li>\n<li><strong>Restricted access:<\/strong> only authorized employees and systems should have access to the migration environment.<\/li>\n<li><strong>Data minimization:<\/strong> only migrate the data that is truly necessary in the new system. You do not need to take old, redundant data with you.<\/li>\n<li><strong>Audit trail:<\/strong> keep track of who did what and when during the migration, so that you can reconstruct what happened in the event of an incident.<\/li>\n<li><strong>Test environment:<\/strong> perform the migration in a shielded test environment first before going live.<\/li>\n<\/ul>\n<p>Also ensure a clear fallback plan. If the migration goes wrong, you must be able to return to the old situation quickly without customer data being lost or left unprotected.<\/p>\n<h2>What are the GDPR obligations when changing contact center suppliers?<\/h2>\n<p>When changing contact center suppliers, you as the data controller are obliged to conclude a new data processing agreement, arrange the data transfer in a GDPR-compliant manner, and check whether the new supplier offers sufficient safeguards for the protection of personal data. Do not forget to correctly terminate the existing data processing agreement with the old supplier and make arrangements regarding the deletion of data.<\/p>\n<p>In concrete terms, this means that you go through the following steps during a supplier change:<\/p>\n<ol>\n<li>Conclude a new data processing agreement with the new supplier before data is transferred.<\/li>\n<li>Check whether the new supplier processes data outside the EU, and if so, whether there are appropriate safeguards (such as standard contractual clauses).<\/li>\n<li>Establish how long the old supplier retains data after termination and ensure that they demonstrably delete or return it thereafter.<\/li>\n<li>Update your processing register to include the new supplier.<\/li>\n<li>If necessary, perform a Data Protection Impact Assessment (DPIA), especially if the new system introduces new processing operations.<\/li>\n<\/ol>\n<p>The GDPR places the responsibility on you as an organization, not on the supplier. Ensure that you document this process so that you can demonstrate to a supervisory authority that the supplier change was conducted in a GDPR-compliant manner.<\/p>\n<h2>Which access and authentication requirements must a new system support?<\/h2>\n<p>A new contact center system must at least offer support for multi-factor authentication (MFA), role-based access control (RBAC), Single Sign-On (SSO), and detailed logging of user activities. These requirements are essential to prevent unauthorized access to customer data and to comply with the requirements of the GDPR and ISO 27001.<\/p>\n<p>Multi-factor authentication is now a basic requirement, not an extra. Employees who have access to customer data must be able to confirm their identity via a second factor, such as an authenticator app. This certainly applies to remote workers and employees logging in via external networks.<\/p>\n<p>Role-based access control ensures that employees can only see the data and functionalities they need for their work. A front-line support employee does not need access to reports on staff performance or historical customer files from other departments.<\/p>\n<p>Also check whether the system integrates with your existing identity management solution, such as Microsoft Entra ID (formerly Azure AD). SSO reduces the risk of weak passwords and makes it easier to revoke access when an employee leaves the organization.<\/p>\n<h2>How do you assess the security of a new contact center supplier?<\/h2>\n<p>You assess the security of a new contact center supplier by looking at their certifications, security policy, data storage location, availability of audit reports, and their track record with incidents. Always ask for concrete documentation and do not settle for general promises.<\/p>\n<p>A structured assessment follows these points:<\/p>\n<ul>\n<li><strong>Certifications:<\/strong> does the supplier have a valid ISO 27001 certificate? Ask about the certification scope and the most recent audit date.<\/li>\n<li><strong>Data location:<\/strong> where is data stored and processed? Preferably within the EU, unless there are appropriate GDPR safeguards for processing outside the EU.<\/li>\n<li><strong>Penetration testing:<\/strong> does the supplier regularly have independent security tests performed? Ask about the frequency and whether summaries are available.<\/li>\n<li><strong>Incident response:<\/strong> how quickly does the supplier report a data breach to you? The GDPR requires that you, as the data controller, report a data breach to the Data Protection Authority within 72 hours.<\/li>\n<li><strong>Sub-processors:<\/strong> which third parties has the supplier engaged, and are they also GDPR-compliant?<\/li>\n<\/ul>\n<p>If in doubt, contact references from similar organizations that already work with the supplier. Practical experiences often provide more insight than documentation alone.<\/p>\n<h2>What should be included in a data processing agreement with a contact center supplier?<\/h2>\n<p>A data processing agreement with a contact center supplier must at least include: the purpose and legal basis of the processing, the categories of personal data and data subjects, the security measures taken by the processor, agreements on sub-processors, retention periods, and the procedure for data breaches. This is not a formality: a missing or incomplete data processing agreement is a GDPR violation.<\/p>\n<p>Ensure the agreement also includes the following elements:<\/p>\n<ul>\n<li><strong>Right to instruct:<\/strong> the processor acts exclusively on your instruction and may not use data for its own purposes.<\/li>\n<li><strong>Duty of confidentiality:<\/strong> employees of the supplier who have access to customer data are bound by confidentiality.<\/li>\n<li><strong>Right to audit:<\/strong> you have the right to check compliance with the agreement, directly or via an independent auditor.<\/li>\n<li><strong>Data breach notification obligation:<\/strong> the supplier reports a security incident to you as soon as possible, so that you can meet the legal reporting period of 72 hours.<\/li>\n<li><strong>Deletion or return of data:<\/strong> after termination of the agreement, all personal data is demonstrably deleted or returned to you.<\/li>\n<\/ul>\n<p>Always have the data processing agreement reviewed by a lawyer with GDPR expertise before you sign. A standard agreement from the supplier is a good starting point, but always check whether it fully aligns with your situation and processing operations.<\/p>\n<h2>How Pegamento helps with a secure transition to a new contact center system<\/h2>\n<p>Replacing a contact center system is not just a technical project, but also a security and compliance issue. We guide organizations through the entire process: from the initial analysis of security requirements and GDPR obligations to the implementation, integration, and ongoing optimization of your new environment. Everything under one roof, without complex supplier management or fragmented responsibilities.<\/p>\n<p>What we&#8217;ll take care of for you:<\/p>\n<ul>\n<li>Assessment of the security requirements and compliance obligations that apply to your organization<\/li>\n<li>Selection and implementation of a <a href=\"pegamento.nl\/en\/contact-center-technology\/\">contact center system<\/a> that complies with ISO 27001, GDPR, and sector-specific standards<\/li>\n<li>Setup of access control, MFA, and SSO integrations that fit your IT environment<\/li>\n<li>Guidance in drafting and reviewing data processing agreements<\/li>\n<li>A controlled migration process where customer data is securely transferred to the new environment<\/li>\n<li>Integration with existing channels via <a href=\"pegamento.nl\/en\/omnichannel-business-telephony\/\">omnichannel communication<\/a>, so that security and accessibility go hand in hand<\/li>\n<\/ul>\n<p>We work with proven modules that we combine smartly based on your processes and objectives. No costly custom work, but a coherent solution with one point of contact for the total package. Want to know what a secure and controlled system change looks like for your organization? <a href=\"https:\/\/pegamento.nl\/en\/contact-us\/\">Contact us<\/a> for a no-obligation consultation.<\/p>\n<div class=\"wp-block-seoaic-faq-block\">\n    <h2 class=\"seoaic-faq-section-title\">Frequently Asked Questions<\/h2>\n            <div class=\"seoaic-faq-item\">\n            <h3 class=\"seoaic-question\">\n                How long does it take on average to securely migrate a contact center system?            <\/h3>\n            <p class=\"seoaic-answer\">\n                The lead time for a secure migration depends on the complexity of your current environment, the number of integrations, and the amount of data to be migrated. On average, organizations count on a lead time of three to six months, including the preparation phase, test environment, and go-live. Haste is the greatest enemy of a secure migration: plan sufficient time for testing security measures and performing a controlled transfer.            <\/p>\n        <\/div>\n                <div class=\"seoaic-faq-item\">\n            <h3 class=\"seoaic-question\">\n                What are the most common security mistakes when changing contact center suppliers?            <\/h3>\n            <p class=\"seoaic-answer\">\n                The most common mistakes are: concluding a data processing agreement too late, failing to demonstrably delete data with the old supplier, and skipping a DPIA while the new system introduces new processing operations. Also, MFA is regularly only set up afterwards instead of immediately at go-live. By proactively including these steps in your migration plan, you prevent compliance violations and security breaches.            <\/p>\n        <\/div>\n                <div class=\"seoaic-faq-item\">\n            <h3 class=\"seoaic-question\">\n                Do I need to inform customers or employees if I switch to a new contact center system?            <\/h3>\n            <p class=\"seoaic-answer\">\n                In most cases, you are not legally obliged to actively inform customers about a supplier change, provided that the processing of their data does not change substantively and your privacy statement is up to date. However, you must update your processing register and check whether the new processing is already covered by your existing privacy statement. For employees, you must inform them in a timely manner about new login procedures, MFA requirements, and any changes to their access rights.            <\/p>\n        <\/div>\n                <div class=\"seoaic-faq-item\">\n            <h3 class=\"seoaic-question\">\n                What should I do if the new contact center supplier stores data outside the EU?            <\/h3>\n            <p class=\"seoaic-answer\">\n                If the supplier processes or stores data outside the European Economic Area (EEA), you as the data controller are obliged to take appropriate GDPR safeguards. The most commonly used measure is the EU Standard Contractual Clauses (SCCs), which you sign together with the supplier. Additionally, check whether the country in question is recognized as adequate by the European Commission, and if necessary, perform a Transfer Impact Assessment (TIA) to map out the risks.            <\/p>\n        <\/div>\n                <div class=\"seoaic-faq-item\">\n            <h3 class=\"seoaic-question\">\n                How do I know if my organization needs to perform a DPIA when switching to a new contact center system?            <\/h3>\n            <p class=\"seoaic-answer\">\n                A Data Protection Impact Assessment (DPIA) is mandatory if the new system introduces a high privacy risk, for example through large-scale processing of sensitive personal data, systematic monitoring of employees or customers, or the use of new technologies such as AI-driven conversation analysis. The Data Protection Authority has published a list of processing operations for which a DPIA is always mandatory. When in doubt, it is wise to perform a brief pre-screening with a GDPR lawyer before deciding definitively whether a full DPIA is necessary.            <\/p>\n        <\/div>\n                <div class=\"seoaic-faq-item\">\n            <h3 class=\"seoaic-question\">\n                How do I arrange the revocation of access rights with the old supplier after the migration?            <\/h3>\n            <p class=\"seoaic-answer\">\n                Ensure that you establish in the termination agreements with the old supplier the date on which all access rights will be revoked and how this will be demonstrably confirmed. Request written confirmation that all personal data has been deleted or returned to you, and record this in your processing register. Do not forget internal accounts: employees who had access to the old system must be deregistered in a timely manner so that no dormant access rights remain.            <\/p>\n        <\/div>\n                <div class=\"seoaic-faq-item\">\n            <h3 class=\"seoaic-question\">\n                What questions should I ask a contact center supplier during the selection process to properly assess security?            <\/h3>\n            <p class=\"seoaic-answer\">\n                At the very least, ask the following questions: What ISO 27001 certification do you have, and what is the certification scope? Where is customer data stored and processed? How quickly do you report a security incident to us? Which sub-processors do you engage, and are they GDPR-compliant? And: can you provide a summary of your most recent penetration test? Suppliers who cannot provide concrete answers to these questions or refuse to share documentation are a risk signal.            <\/p>\n        <\/div>\n        <\/div>\n","protected":false},"excerpt":{"rendered":"<p>Security requirements for a contact center system change: encryption, GDPR obligations, and supplier assessment explained.<\/p>\n","protected":false},"author":2,"featured_media":38377,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[500],"tags":[],"class_list":["post-38376","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-contact-center"],"_links":{"self":[{"href":"https:\/\/pegamento.nl\/en\/wp-json\/wp\/v2\/posts\/38376","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/pegamento.nl\/en\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/pegamento.nl\/en\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/pegamento.nl\/en\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/pegamento.nl\/en\/wp-json\/wp\/v2\/comments?post=38376"}],"version-history":[{"count":1,"href":"https:\/\/pegamento.nl\/en\/wp-json\/wp\/v2\/posts\/38376\/revisions"}],"predecessor-version":[{"id":38378,"href":"https:\/\/pegamento.nl\/en\/wp-json\/wp\/v2\/posts\/38376\/revisions\/38378"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/pegamento.nl\/en\/wp-json\/wp\/v2\/media\/38377"}],"wp:attachment":[{"href":"https:\/\/pegamento.nl\/en\/wp-json\/wp\/v2\/media?parent=38376"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/pegamento.nl\/en\/wp-json\/wp\/v2\/categories?post=38376"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/pegamento.nl\/en\/wp-json\/wp\/v2\/tags?post=38376"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}