Switching customer service system is a data project as much as a tooling project. Several years of tickets, customer records, attachments and internal notes have to go somewhere, and most of it is personal data. Here is what GDPR requires when you move customer data between two vendors, adapted from Supportifier's guide to switching helpdesk under GDPR.
Who is responsible during the switch?
You remain the data controller throughout, and both the old and the new vendor are processors. Moving the data changes nothing about that. According to the Swedish Authority for Privacy Protection (IMY), a processor must, when the agreement ends, either delete or return the personal data and delete existing copies, unless legislation requires that they be kept. You decide which.
In practice that means three things:
- Sign a data processing agreement with the new vendor before the first record moves.
- Read the agreement with the old vendor to see what it says about export, deletion and deadlines.
- Appoint one person who owns the switch and decides what moves, because the vendors cannot make those decisions for you.
What should move, and what should not?
What is still needed for a clear purpose moves. What is not needed is deleted in the old environment, not moved to the new one. The storage limitation principle means personal data may only be kept as long as it is needed for the purpose, and a switch is the moment most companies discover their deletion routine was missing.
| Data | Moves? |
|---|---|
| Open and recently closed tickets | Yes |
| Tickets older than your retention period | No, deleted |
| Customer records | Yes, for active customers |
| Knowledge base and help articles | Yes |
| Attachments | Only those belonging to tickets that move |
| Internal notes about customers | Reviewed first |
| Call recordings and chat logs | Per the rule you set for them |
| Deletion requests already carried out | Must not reappear |
The last row is the one that most often goes wrong: a migrated backup can resurrect data a customer already asked you to delete.
The switch is the best moment to clean up
Decide what moves, delete what is no longer needed instead of migrating it, and make the old vendor delete or return everything when the contract ends. Then check where the data ends up with the new vendor. For how Supportifier handles storage and processing, see the Supportifier security and data protection page.
Top comments (0)