Does your website use third-party services? Get GDPR compliant in minutes.
Try FlowConsent8x8 is a US-based cloud communications platform providing VoIP phone systems, video conferencing, team messaging, and contact centre solutions. For European businesses, GDPR compliance centres on call recording notifications, data residency selection, and the DPA with 8x8. EU data residency is available and recommended for EU-based deployments. Call metadata, recordings, and contact data are the primary personal data categories processed.
8x8 is a US-based cloud communications company providing unified communications as a service (UCaaS) including VoIP business phone systems, video conferencing, team chat, contact centre solutions (CCaaS), and APIs for voice, video, and messaging. It serves businesses ranging from SMBs to large enterprises and is particularly strong in contact centre deployments combining voice, digital channels, and AI-powered analytics.
8x8 processes call metadata (caller ID, duration, timestamps), call recordings if enabled, voicemail recordings, contact directory information, video meeting recordings and transcripts, chat message content, and user account information. In contact centre deployments, customer interaction history, CRM-integrated data, and AI-generated conversation analytics add further personal data categories.
Call recording is one of the most GDPR-sensitive features. Under GDPR and national telecommunications laws, all parties must be informed that a call is being recorded before the recording commences. Simply having a recorded call is processing of personal data requiring a lawful basis. Options include consent (for outbound sales calls), contract performance (for contractual dispute records), and legitimate interest (for quality assurance with appropriate notice). Recordings must be secured, access-restricted, and deleted when no longer needed.
8x8 offers EU data residency for customers who select it. For standard deployments without EU residency, call metadata and recordings may be stored on US infrastructure requiring SCCs. Sign the 8x8 GDPR Data Processing Addendum and request EU data residency if your organisation processes significant volumes of EU personal data in communications.
Sign the 8x8 DPA and select EU data residency. Implement call recording notification announcements before recording commences. Define retention periods for call recordings and configure auto-deletion. Restrict access to recordings to authorised personnel only. Include 8x8 in your privacy policy describing communications data processing. For contact centre deployments, document the processing in your RoPA.
Websites using 8x8 must obtain user consent under GDPR regulations.
DPIA considerations
A DPIA should be considered for large-scale contact centre deployments processing call recordings, particularly where recordings may capture sensitive personal information. Call recording in contact centres constitutes systematic monitoring of individuals.
Sample consent text
This call may be recorded for quality and training purposes. Recordings are stored in accordance with our privacy policy. You may object to recording at any time during this call.
Third-party domains contacted
8x8.com8x8.vcapi.8x8.comCookies placed
| Name | Type | Duration | Purpose |
|---|---|---|---|
| 8x8_session | session | Session | 8x8 sets functional session cookies for web-based communications interface — call metadata stored server-side |
8x8 uses cookies for user preferences — inform visitors with a consent banner.
Get started free8x8 provides a GDPR Data Processing Addendum and supports EU data residency for customers who request it. Compliance depends on configuring EU data residency, signing the DPA, and implementing proper call recording notifications.
Consent (from callers) for outbound sales calls. Legitimate interest with clear notice for inbound contact centre quality assurance. Contract performance for calls where recording is contractually agreed. Always notify callers at the start of a recorded call.
Contact 8x8 sales or support to request EU data residency for your account. This ensures call metadata and recordings are stored on EU infrastructure. EU residency availability may vary by product tier.
For accounts without EU data residency, yes — SCCs are required. With EU data residency configured, data stays within the EU and SCCs are not needed for the primary data flows. Sign the 8x8 DPA regardless of residency choice.
Define retention based on your purpose: quality assurance recordings typically 30-90 days, contractual dispute records potentially longer. Configure automatic deletion in 8x8 settings. Longer retention requires documented justification in your RoPA.
A DPIA is recommended for large-scale contact centre deployments with call recording, particularly where calls may capture sensitive personal information or special category data. Standard business phone system use without recording typically does not require a DPIA.
For access requests: use 8x8 admin portal to search and export call records. For erasure requests: delete specific recordings via admin portal. For transcripts and AI analytics: use the 8x8 data management tools to locate and delete data. Document all requests and actions taken.
Yes. AI-generated transcripts of calls create additional personal data. Transcripts may capture sensitive information spoken on calls. Apply the same consent and retention rules as recordings. Do not use transcripts for purposes beyond the original recording purpose without a new lawful basis.