PDP Compliance for Contact Centers: A Checklist

Checklist 1: inventory and purpose

Write down which systems store conversations. Include the contact center platform, WhatsApp Business API, QA tools, the warehouse, and backups. For each system, name the data types, the purpose, and who can access it.

Purpose must be specific. “Customer service” is too wide if recordings are also used for training, fraud prevention, and marketing. Split purposes so one lawful basis is not stretched over every use.

Do not forget shadow copies. Incident exports, clips pasted into tickets, and transcripts dropped into internal email. If you cannot say where those copies live, you are not ready for an audit.

Checklist 2: lawful basis and notice

Decide the lawful basis for recording and chat. Contract performance, legal obligation, or consent cannot be mixed without explanation. An IVR that says “this call is recorded” does not automatically cover every later use.

Tell customers in a reasonable way before or at collection. The language should be clear on the channel they actually use. Voice scripts, WhatsApp templates, and the policy page must not contradict each other.

Raise controls for more sensitive data. Do not let agents ask for extra data “just in case”. Minimisation is an operating control, not a sentence in a privacy policy.

Checklist 3: data-subject rights on the agent floor

UU PDP grants rights of access, correction, and erasure within the limits of the law. The contact center needs a path for those requests, not only a legal-team email that the night shift never reads.

Train agents to tell a normal service request from a rights request. Provide an internal form, a deadline, and a system that can find conversations by identity rather than by guessing a daily folder.

Erasure does not mean hitting delete in one inbox. You must know which copies must be kept for another duty, such as financial-sector retention. Retention conflicts should be decided in writing, not in a supervisor chat.

Checklist 4: retention, security, vendors

Set a retention period by conversation type. Promotional chat does not need the same life as a dispute recording. A deletion schedule that never runs is the same as having no schedule.

Limit access by role. QA does not need to download thousands of recordings to a laptop. Transcription vendors and WhatsApp BSPs are processors. Contracts must cover instructions, security, and return of data.

Since 1 July 2025, Meta has charged WhatsApp templates per message, not per 24-hour conversation. That is a cost issue, but template logs are also a data issue. Do not treat campaign logs as outside the contact center just because marketing pressed send.

Incident notification has a statutory time limit. A tabletop exercise is more useful than a paragraph in a policy. Who decides, who writes, and where evidence is stored should be clear before an incident.

Checklist 5: AI, recording, and channels

An AI model that reads transcripts still processes personal data. Record whether the data stays in your environment, whether it is used to train a model, and whether a vendor can see conversation content. Without that record, a copilot becomes an uninventoried hole.

A bot-to-human handoff should carry the minimum data needed. Do not dump a full history into a public queue if the intent is only order status. Prompt and answer logs are data that must enter retention.

Telkom Group is integrating Meta Llama into WhatsApp customer interactions, and Telkomsel runs Veronika on WhatsApp, as reported by Marketing-Interactive on 21 September 2026. The industry direction is clear: AI will read conversations. Kepatuhan PDP contact center should lead the feature, not chase it.

ConverseAIght treats retention, audit trail, and access control as part of omnichannel operations, not a legal add-on. Voice and WhatsApp land in the same case, with retention rules that can be set by interaction type.

How to run the list in 90 days

Month one: inventory systems and shadow copies, plus a purpose map. Month two: lawful basis, notice scripts, and incomplete vendor contracts. Month three: a rights-request path, a deletion job that actually runs, and an incident drill.

Do not wait for a perfect platform. Start with the highest-volume channel and the most sensitive data. In many Indonesian operations, that is WhatsApp plus voice recordings of complaints.

Report compliance as a living control. Each quarter, test whether agents can still export conversations to personal email, and whether an access request can be fulfilled without drama. Those findings are worth more than a certificate that never touches the floor.