Data protection compliance for communication providers handling customer records, CDRs and automated systems.
Quick answer: UK GDPR applies to telecom providers and resellers handling customer data. This guide covers how long to keep call detail records, choosing a lawful basis, processor agreements and responding to subject access requests.
What You Learn
- ✓ UK GDPR obligations
- ✓ Data processing requirements
- ✓ Rights management
- ✓ ICO enforcement
Who It's For
- • Data protection officers
- • Business owners
- • Compliance teams
- • Anyone processing UK personal data
Telecom providers process extensive personal data: customer details, call records, location data, billing information. UK GDPR applies fully. If you use AI for fraud detection or service decisions, Article 22 requires human oversight. ICO can fine up to £17.5 million or 4% of global turnover.
Personal Data in Telecoms
Communication providers handle several categories of personal data:
| Data Type | Examples | Sensitivity |
|---|---|---|
| Customer Data | Name, address, payment details | Standard |
| Traffic Data | Call records, timestamps, numbers called | Higher (reveals behaviour) |
| Location Data | Cell tower data, IP addresses | High (reveals movements) |
| Content Data | Voicemails, messages | Very High |
| Billing Data | Usage patterns, spend history | Standard |
Key GDPR Principles for Telecoms
Lawful Basis
Document why you process each data category:
- Contract: Processing customer details, billing, service delivery
- Legal obligation: Law enforcement requests, Ofcom compliance
- Legitimate interest: Fraud detection, network security
- Consent: Marketing, optional services, location features
Data Minimisation
Only collect what's necessary. Telecom-specific considerations:
- CDRs: Retain necessary fields, not full recordings
- Customer verification: Minimal ID data for KYC
- Location: Only if needed for service or with consent
Storage Limitation
Define retention periods for each data type:
| Data Type | Typical Retention | Legal Basis |
|---|---|---|
| CDRs (billing) | 12-24 months | Contract + disputes |
| CDRs (law enforcement) | 12 months | Data Retention Regulations |
| Customer contracts | 6 years post-termination | Limitation Act |
| Marketing consent | Until withdrawn + 6 months | Evidence of consent |
Article 22: Automated Decision-Making
If you use AI or automated systems to make decisions affecting customers, UK GDPR Article 22 applies:
What Triggers Article 22?
- Automated credit scoring for service approval
- AI fraud detection that blocks accounts
- Automated service suspension for non-payment
- Risk scoring that affects pricing or access
Requirements
- Human oversight: Human review for significant decisions
- Right to explanation: Explain decision logic to customers
- Right to contest: Mechanism to challenge automated decisions
- DPIA: Data Protection Impact Assessment required
Heimdell Tech Ai Approach: Our Telecompliance AI implements Human-in-the-Loop (HITL) triggers. When the system detects a high-risk decision (service suspension, fraud block), it pauses and generates a Decision Justification Brief for human approval.
Data Subject Rights
Customers have rights over their personal data. Telecom-specific responses:
| Right | Response Required | Telecom Considerations |
|---|---|---|
| Access (SAR) | 30 days | Provide CDRs, account history |
| Rectification | Without undue delay | Update contact/billing details |
| Erasure | Without undue delay | May conflict with retention obligations |
| Portability | 30 days | Export account data in standard format |
| Objection | Without undue delay | Marketing opt-outs, fraud processing |
Exemptions
You can refuse some requests where legal obligations apply:
- CDRs retained for law enforcement purposes
- Data needed for ongoing legal disputes
- Records required by Ofcom regulations
Data Processor Agreements
If you use third parties (cloud platforms, billing systems), ensure Data Processing Agreements cover:
- Processing only on documented instructions
- Appropriate security measures
- Subprocessor approval and flow-down
- Assistance with data subject requests
- Return or deletion at contract end
- Audit rights
Related Guides
GDPR-Compliant AI Automation
Telecompliance AI includes Article 22 compliance by design, with Human-in-the-Loop triggers and Glass Box explainability for all automated decisions.
Book a DemoNeed help with this?
Book a free 15-minute compliance audit call and we'll tell you exactly where you're exposed.
Book Your Free Audit →Does UK GDPR apply to telecom providers?
Yes, UK GDPR applies fully to telecom providers. You process substantial personal data including customer details, call records (CDRs), location data, and billing information. You must document lawful basis, implement data minimisation, define retention periods, ensure security, and respond to data subject rights requests.
What is Article 22 and how does it affect telecom AI systems?
UK GDPR Article 22 applies when you use AI or automated systems to make decisions affecting customers (fraud detection, credit scoring, service restrictions). It requires human oversight for significant decisions, the right to explanation, mechanisms to contest decisions, and Data Protection Impact Assessments.
How long should telecoms retain call detail records (CDRs)?
CDRs for billing purposes should be retained 12-24 months (until bill paid plus dispute resolution). CDRs for law enforcement purposes follow Data Retention Regulations (typically 12 months). Customer contracts should be retained 6 years post-termination under the Limitation Act.