Compliance and Data Security Flashcards
6 cards from real Call Center Solutions practice questions. Tap to flip, then mark Knew It or Still Learning — missed cards come back until you master them.
Read the first 6 Compliance and Data Security flashcards as text
What does TCPA stand for and what does it regulate?
Answer: Telephone Consumer Protection Act — restricts autodialed calls, prerecorded messages, and fax marketing to consumers
The TCPA (1991) restricts unsolicited autodialed calls, robocalls, and text messages to US consumers and requires prior express written consent for marketing calls to mobile phones.
What is the FTC's 'Do Not Call Registry' and what does it require of call centers?
Answer: A federal list of US phone numbers where telemarketers are prohibited from making unsolicited sales calls
The National Do Not Call Registry allows US consumers to register their numbers to block unsolicited telemarketing calls; call centers must scrub their call lists against this registry every 31 days.
What does HIPAA require of call centers that handle healthcare information?
Answer: Strict protection of patients' Protected Health Information (PHI) through access controls, encryption, and audit trails
HIPAA (Health Insurance Portability and Accountability Act) requires call centers handling PHI to implement physical, technical, and administrative safeguards to protect patient data privacy.
What is 'call recording consent' and why is it required in many US states?
Answer: Legal requirement in some US states for all parties on a call to be informed and consent before the call is recorded
Under 'two-party consent' (or 'all-party consent') laws in states like California (CIPA), all parties must be notified and consent to call recording — hence the standard disclaimer at the start of calls.
What does GDPR compliance require for US call centers that handle data of EU residents?
Answer: Protection of EU residents' personal data with rights including access, deletion, and explicit consent for data processing
Even US-based call centers must comply with GDPR when handling personal data of EU residents, including providing lawful basis for processing, honoring data subject rights, and reporting breaches within 72 hours.
What is a 'data breach' notification requirement under US state laws for call centers?
Answer: The obligation to inform affected individuals and state authorities when customer personal data is improperly accessed or exposed
All 50 US states have data breach notification laws requiring organizations to notify affected individuals (and in some states, regulators) within a specified timeframe when their personal information is compromised.