UK GDPR questions for help desk buyers

A support platform may hold names, contact details, orders, complaints and occasionally information customers send unexpectedly. That makes the buying decision a data-protection decision as well as a software decision. The questions below help a UK team prepare a supplier review; they are not legal advice and cannot decide what your organisation must do in a particular case.

The ICO's controller–processor contract guidance is the primary reference for the contractual questions. The ICO notes that this guidance is under review following the Data (Use and Access) Act, so check the current version when procuring. A help desk buyer is often a controller for its own customer-support data and the SaaS vendor often acts as a processor for that data, but roles depend on the actual processing. Do not assume the label in marketing copy settles it.

Map the support data first

List contact channels, customer fields, attachments, internal notes, order or CRM integrations, AI features and exported reports. Ask whether any special-category or otherwise sensitive information is likely to enter tickets. Decide what your team needs and remove fields collected only “just in case.” Identify who can view and change each type of case. This map gives the supplier concrete questions and helps you avoid agreeing to a broad processing description that does not match the workflow.

Check your own customer-facing privacy information and lawful-basis analysis with the responsible person or adviser. A supplier contract does not write these for you. If the help desk will process materially different or higher-risk data, consider whether additional assessment is needed before activation.

Review the processor agreement

Ask for the current data processing agreement and note its contracting entity. The ICO lists required topics for controller–processor contracts, including documented instructions, confidentiality, appropriate security, subprocessor use, assistance with individual rights, assistance with other compliance duties, end-of-contract handling and audit information. Check that the service description, data categories and duration match your use. Record any terms that rely on a separate policy or website and whether the provider can change them.

Ask how you are told about new subprocessors and how objections work. A public list is useful only if it is current and explains each service's purpose and location. Check the support, analytics, email, telephony and AI components you intend to enable; the base ticket product may not tell the whole story.

Trace international access and transfer questions

Where is core ticket data hosted? Where can vendor staff access it? Where are backups, subprocessors and AI processing? The ICO's international-transfer guidance explains when a restricted transfer arises and the available routes, including adequacy and safeguards. UK-only hosting is not a universal legal requirement, and EU hosting is not a blanket answer to every transfer or access question. The residency guide gives a buyer's tracing method.

Do not copy a foreign-transfer clause from another contract without checking who initiates the transfer and whether the actual destinations are covered. Escalate material uncertainty to your data-protection or legal adviser.

Test rights, retention and incident support

Find one sample customer across tickets, notes, attachments and linked systems. Can an authorised administrator search, export, correct, restrict or erase the relevant records when appropriate? How are hidden fields and backups handled? The ICO's storage-limitation guidance says the UK GDPR does not prescribe a single retention period; your organisation needs to justify one for its purposes. The retention-settings guide turns that into a product test.

Ask what the vendor will tell you about a personal-data incident, how quickly, through which contact and with what evidence. Make sure your team can investigate and respond under its own duties. Keep responsibility assigned internally; a vendor notification is an input, not the complete response.

Compare vendors on evidence

Zendesk's trust centre and Freshworks' privacy documentation are examples of material to request and evaluate. Plan-dependent controls, hosting choices and AI options must be checked on the edition you intend to purchase. Do not score a provider “compliant” because it has a privacy landing page. Record unanswered questions and the owner who will resolve them before signing.

Sources

• ICO: contracts and liabilities between controllers and processors
• ICO: international transfers
• ICO: storage limitation
• ICO: data security

This is editorial buyer guidance, not legal advice. Seek qualified advice for the organisation's particular processing and contractual obligations.