GDPR, the General Data Protection Regulation, is the EU's privacy framework. It applies to any organization handling personal data of EU residents, regardless of where the organization is based. Penalties can reach 4% of global revenue.
For a CX-AI vendor, the relevant obligations are: lawful basis for processing (contract or consent), data-subject rights (access, deletion, portability), retention limits, breach notification (72 hours), and a documented data processing agreement (DPA) with the customer.
The cross-border transfer rules are the most operationally relevant piece. Sending EU customer data to the US requires either Standard Contractual Clauses (SCCs) or a data residency option that keeps the data in the EU. A vendor without EU data residency cannot honestly claim full GDPR compliance for European customers.
Vorel supports EU + UK data residency by default for any customer flagged as serving EU data subjects. DPA under standard SCC terms is auto-attached.