BPO data privacy training: information security and data privacy awareness for every agent

Starts with a pause: picture your workstation as you left it, and what a stranger could learn from your screen, desk and phone. Three recent events follow, including a Reuters report from June 2025 of an outsourcing agent in India with photos of her work screen on her personal phone, and unusual activity on a platform used by a Qantas contact centre. You then meet GHI Contact Solutions, a multi-client BPO with its main site in Manila and a second site in Mumbai, and its three clients: a US retailer's refunds line, a UK bank's collections line and a US clinic group's patient billing. The module outlines the eleven modules, practice questions, final exam and certificate, and ends with a recap.

What you will be able to do

• Explain why everyday habits on a BPO floor protect customer data
• Recognise insider and caller-fraud risks from recent events
• Describe the three client accounts the course follows

Why it matters

Seeing how small slips on other floors became data losses shows why your own habits matter on every call, chat and ticket.

Practice: Practice: Why security and privacy matter on a BPO floor · 3 questions

Opens on the Manila floor of GHI Contact Solutions, where a refunds agent pastes a screenshot of a customer account into a team chat seen by forty people, while a colleague sends the team lead the case number only. You then learn that personal data is any information that can point to a real person, written or spoken, alone or combined, so a customer's voice and your case notes count. The module explains sensitive data needing extra care: health information, government ID numbers, and card and bank data, such as balances and hardship notes on the UK bank's collections line. It covers recordings, screen recordings, chat logs, screenshots and staff records, and why copies are where data most often escapes. It ends with a recap.

What you will be able to do

• Identify personal and sensitive data in calls, chats and tickets
• Explain why recordings, chat logs and screenshots are personal data
• Apply the rule of only what, only where, only why and only as long

Why it matters

Recognising personal data in every form helps you stop the screenshot or copy that would expose customers without anyone noticing.

Practice: Practice: Personal and sensitive data in your work · 3 questions

Starts on the Mumbai floor of GHI Contact Solutions, on the UK bank's collections line, where a caller phoning for her husband in hospital is told his overdue balance, while another agent runs the bank's identity check first. You then learn to verify first, every time, with open questions, giving no details until the check passes, and the most common mistake in identity checks. The module explains the levers of social engineering, urgency, authority and sympathy, by phone, text, e-mail or chat, with the habit of not clicking and reporting a suspicious message. It covers password reset calls from someone sounding senior, verifying the employee and calling back on a number you already hold. It ends with stop and check, and a recap.

What you will be able to do

• Apply the client's identity check before discussing any account
• Recognise urgency, authority and sympathy as social engineering levers
• Report a suspicious call or message even after refusing it

Why it matters

A firm identity check stops a believable story from turning into a disclosure your client must report.

Practice: Practice: Identity checks and social engineering · 3 questions

Opens with the June 2025 Reuters report of an agent with photos of her work screen on her personal phone, and a phone face up beside a keyboard while card numbers appear on screen. You then learn the clean desk and clean screen rules: papers and media put away and screens locked every time you stand up. The module explains why GHI Contact Solutions keeps personal phones off the production floor, and pens and paper off card lines. It covers shoulder surfing, badging in yourself, keeping customer details out of chats, conversations and social media posts, and secure printing that waits until you badge in. It shows how client auditors check these habits by walking the floor, and how repeated findings can put a contract at risk. It ends with a recap.

What you will be able to do

• Apply clean desk and clean screen rules at every break
• Explain why personal phones stay off the production floor
• Use secure printing and keep customer details out of chats

Why it matters

Habits an auditor can see on a walk past protect your client's contract as well as the customers on your screen.

Practice: Practice: Clean desk, clean screen and personal phones · 3 questions

Starts on the Manila billing team of GHI Contact Solutions on a busy Monday, when two new agents work under the team lead's login and, a month later, nobody can tell the clinic group who opened a patient's record. You then learn the rule of one person, one account, never shared or borrowed, even for five minutes. The module explains strong sign-in: long, unique passwords kept secret, multi-factor authentication, and denying and reporting any sign-in prompt you did not start. It covers least access, requested and approved, reviewed regularly and removed when you move or leave, and what to do if a former colleague's account is still active. It shows how access reviews and records reflect your habits, and ends with a recap.

What you will be able to do

• Explain why every action is recorded against your own account
• Deny and report multi-factor prompts you did not start
• Describe how access is requested, reviewed and removed

Why it matters

Guarding your account means the system records only your own actions, so you are never blamed for someone else's.

Practice: Practice: Access, passwords and multi-factor sign-in · 3 questions

Opens on the Manila floor of GHI Contact Solutions, on the US retailer's refunds line, where the payment screen freezes and an agent writes the card number and security code on scrap paper, while a colleague asks the customer to hold. You then learn that card data goes into the payment screen only, and that the security code is never stored after authorisation, not even encrypted. The module walks through pause-and-resume recording step by step, including what happens when it is missed and the card number is in the recording. It covers other financial data, balances, payment plans and hardship notes, with short notes and least access, plus a consumer lender in New York under the US Safeguards Rule and an insurer in Sydney. It ends with a recap.

What you will be able to do

• Apply pause-and-resume recording on every card call
• Explain why the card security code is never stored
• Record only the financial details a payment plan needs

Why it matters

Keeping card numbers in the payment screen and nowhere else protects customers and the area clients check hardest.

Practice: Practice: Handling payment card and financial data · 3 questions

Starts on the Manila floor of GHI Contact Solutions, on the US clinic group's patient billing team, where an agent opens her neighbour's mother's full record out of curiosity and the system logs it. You then learn what protected health information is: information about health, care or payment for care that can identify a person, in any form, including insurance member numbers and diagnosis and procedure codes. The module explains the minimum necessary rule: look at, share and ask for only what the task needs, with every look at a record backed by a work reason. It covers patient calls, the client agreement that turns into the procedures on the billing line, and reporting problems at once so GHI can tell the clinic group in time. It ends with a recap.

What you will be able to do

• Identify protected health information on a patient billing line
• Apply the minimum necessary rule to every record you open
• Report a medical data problem to the client within the agreed time

Why it matters

Opening records only for a work reason keeps patient information safe and avoids logged access you cannot explain.

Practice: Practice: Handling medical data · 3 questions

Opens with a GHI Contact Solutions refunds agent working at the dining table, screen facing the room as a customer reads out a card number, while a colleague works behind a closed bedroom door with a headset and the screen facing the wall. You then learn what a private space at home needs: a closed door, no family in the room, a headset and no printing. The module covers approved devices only: the company laptop, the VPN connected before any client system, and multi-factor sign-in. It explains sharing one window in video calls, never copying reports to a USB drive, never using a found drive, keeping work data off personal phones, e-mail and apps, and reporting a lost device at once. It ends with a recap.

What you will be able to do

• Set up a private workspace that meets work-from-home rules
• Use only approved devices with the VPN connected
• Report a lost laptop or drive at once, even at night

Why it matters

Bringing the floor's controls home keeps customer data safe when nobody is walking past to check.

Practice: Practice: Working from home, USB and devices · 3 questions

Starts in chat support at GHI Contact Solutions, where an agent pastes an angry complaint, name and order number included, into a public chatbot on her phone, while a colleague uses the assistant GHI has approved. You then learn the AI tools found on a BPO floor and why text sent to public tools sits on external servers, with news reports of staff uploading internal code to ChatGPT. The module sets out four rules: use only approved tools, keep client and customer data out of public ones, check every output, and report errors. It covers transcription that pauses with card recordings, transcripts and summaries under the same rules as recordings, and an AI quality score on the UK bank's line in Mumbai. It ends with quick questions and a recap.

What you will be able to do

• Explain why customer data must stay out of unapproved AI tools
• Check every AI draft or summary before it is used
• Report wrong, unfair or unsafe AI outputs, even after fixing them

Why it matters

Using AI only as an approved helper lets you work faster without sending client data where nobody can get it back.

Practice: Practice: Using AI tools responsibly · 3 questions

Opens on the clinic group's billing team at GHI Contact Solutions, where an agent sends a patient's statement to the wrong e-mail address and mentions it only at the end of the shift, when the chance to recall it is gone. You then learn that your job is to report anything odd, from misdirected e-mails to records opened without a work reason, and that the security team decides whether it is an event, an incident or a breach. The module walks through reporting within minutes: stop, tell your team lead and security, describe it, keep the evidence and follow instructions. It covers the common mistake of fixing it quietly, and how deadlines up the chain, from the client to regulators and the card brands, start with you. It ends with a recap.

What you will be able to do

• Identify the events an agent should report at once
• Apply the reporting steps from stopping to keeping evidence
• Explain why an incident is never fixed quietly

Why it matters

Reporting in minutes can keep a slip small, and gives your client time to meet its own notification deadlines.

Practice: Practice: Incidents and breach reporting · 3 questions

Begins with a simple map of the three kinds of rules behind your work: laws set by governments, client contracts that bring in industry standards and security terms, and assurance through certificates and audit reports. You then see the laws, the Philippine and Indian privacy laws, the GDPR, HIPAA and the US Safeguards Rule, each reaching your work through the client. The module links standards to earlier habits, such as PCI DSS and pause-and-resume recording, and ISO standards for security and AI. It explains what client audits ask agents, how GHI's clients receive SOC 2 and SOC 1 reports, and how auditors sample access approvals, logs, training and incident records. It ends with a course recap and the final exam.

What you will be able to do

• Explain how privacy laws reach agents through client contracts
• Link PCI DSS and ISO standards to the habits taught in the course
• Describe the evidence auditors sample for a SOC report

Why it matters

Knowing that one set of habits satisfies every rulebook makes client audits and their questions easier to face.

Practice: Practice: The rules behind the practices · 3 questions