Sourcing AI training data through BPOs: client consent, multi-client queues and offshore rules

This page is general information, not legal advice. Confirm requirements with counsel for your jurisdiction and use case.

Who owns the data a BPO holds

The client usually owns it, and the BPO's master services agreement (MSA), statements of work and data processing addendum (DPA) decide whether any reuse is possible. A BPO running a telecom carrier's care queue in Genesys Cloud, NICE CXone or Five9, or an insurer's claims intake in the client's own Salesforce or Guidewire instance, is acting on the client's instructions. Recordings, transcripts, CRM notes and dispositions are client records even when they sit on BPO-managed storage.

Privacy law reinforces the contract. Under the CCPA regulations, a service provider may use personal information for limited internal purposes such as improving its own services, but not to perform services for another business, including building or modifying consumer profiles for use in serving another business [1]. Licensing a client's transcripts to an AI lab is a disclosure to a third party, not an internal service improvement, so treat it as requiring the client's decision. Philippine law draws a similar line: under the Data Privacy Act, a personal information processor is the party to whom a controller outsources processing, and outsourcing agreements under its implementing rules keep the controller accountable; verify current text with the National Privacy Commission [10].

Two practical consequences follow. First, approach the BPO as a route to the client, not as the licensor of client data. Second, ask early whether the MSA even lets the BPO raise the request; some agreements bar the vendor from discussing client data with third parties at all. Our guide to authorization for client data held by service providers covers the chain of approvals in more detail.

What BPOs may own outright

BPOs often own the operational knowledge they produced, and that material can be a cleaner first license than client records. Candidates include:

• QA rubrics and calibration sets written by the BPO's quality team, such as scoring forms for empathy, policy adherence and resolution, with anonymized scored examples.
• SOPs, process maps and agent training curricula the BPO wrote for its own methodology, as distinct from client knowledge-base articles it was given.
• Aggregated workforce metrics: average handle time, after-call work, occupancy, shrinkage and first-contact resolution, rolled up across clients so no client is identifiable.
• Internal workflow logs from the BPO's own tools, such as WFM schedules or ticket routing in its own systems.

Ownership here is still a hypothesis to test, not a default. A rubric built for one client's program may be a contractual deliverable that the client owns, and SOPs often embed client policy text. Ask the BPO to show the clause that assigns intellectual property in work product, and screen every document for client names, product codes and policy language before treating it as BPO-owned.

Multi-client queues and mixed exports

A single export from a shared queue can contain several clients' data, so you need every affected client's approval or a clean split before licensing. Blended queues are common for overflow, after-hours coverage and small programs, and a recording platform export may carry a campaign ID or skill group rather than a client ID. If the BPO cannot partition by client from fields such as client_id, program_code, campaign_id or DNIS, the export cannot be licensed client by client.

Watch for leakage across the split. Shared knowledge bases, agent notes copied between programs and screen recordings that show several CRM tabs can carry one client's content into another client's slice. For agent-trajectory data, each action log needs the same client tag as the conversation it belongs to; our guide to packaging linked records from multiple business systems explains how to keep those joins intact.

Consent evidence for recordings and voice

Call recordings need consent evidence that covers the end customer, not only the BPO's own agents. An employee recording acknowledgment does not answer the other party's rights. California requires the consent of all parties to record a confidential communication [4]; see also Cal. Penal Code 632.7 regarding cellular and cordless calls, and the standard "this call may be recorded for quality and training purposes" disclosure was written for the client's own quality program, not for licensing to a model developer.

Voice adds a biometric layer. Texas treats a voiceprint as a biometric identifier and requires notice and consent before capture for a commercial purpose [5], so speaker-embedding or voice-cloning uses deserve separate review from text transcription. Regulators also watch the promises behind the data: the FTC has warned that breaking commitments not to use customer data for training, or quietly loosening terms to allow it, can be unfair or deceptive [2][3]. Ask the client to show the notice text that was live when each recording was made. Our page on consent and notice records lists the evidence to request.

Sector rules that travel with the client

The client's industry rules follow its data into the BPO, so a healthcare or financial program carries those restrictions with it. A BPO handling a payer's member services is typically a HIPAA business associate, and protected health information can generally be released for model training only with patient authorization, after de-identification under 45 CFR 164.514 (Safe Harbor or Expert Determination), or as a limited data set for permitted purposes under a data use agreement [7], and only as far as the business associate agreement allows. Financial programs carry GLBA reuse and redisclosure limits: a party receiving nonpublic personal information from a financial institution is restricted in what it may further disclose, and data received to perform a service under an exception may generally be used only for that service [6].

These rules shape which programs are worth pursuing. A retail returns queue or a SaaS technical support desk is usually a simpler start than a collections, card dispute or prior-authorization program. If you do want regulated workflows, see our pages on bank complaint records and Reg E and Reg Z dispute investigation records.

Offshore delivery centers and cross-border rules

Offshore sites add the host country's privacy law and transfer rules on top of the client's US obligations, so check each country before a license is drafted. In the Philippines, the Data Privacy Act of 2012 (Republic Act 10173) and its implementing rules govern processors and outsourcing agreements. India, Colombia, South Africa and EU nearshore sites each bring their own regime, and EU-origin data raises GDPR questions about legal basis and whether a trained model is anonymous, which the EDPB addressed in Opinion 28/2024 [8].

Three questions settle most offshore issues. Where was the data collected and whose customers are in it? Where is it stored now, on the client's US tenant or a local server? Will any copy move across a border for delivery? Data that lives in a US client's cloud tenant and is only accessed from Manila differs from data a site exported to local storage. For the Philippines specifically, see whether you can license data from Philippines BPO operations.

A BPO data request and approval checklist

Use a structured request so the BPO can route it to the right client owner and the right legal reviewer.

Illustrative example: invented to show structure; it does not describe an available dataset.

Common failure modes this table is designed to catch: a queue export with no client field, a disclosure script updated mid-period, PCI data captured before a pause-and-resume control was deployed, and SOPs that turn out to be client deliverables.

Structuring the deal across BPO and client

Most workable deals have the client as licensor of its records and the BPO as the operator that extracts, partitions and de-identifies them. The BPO is often paid for that work as services, separately from what the client receives for the data. If the BPO also licenses its own rubrics and SOPs, document those as a separate grant so the two rights chains do not blur.

Expect the client to want scope limits on uses, on model types and on whether its brand name appears in metadata. Market practice suggests demand exists: vendors already advertise consumer-to-business call recordings by vertical with PII removed, though those claims are self-reported [9]. For the broader playbook on direct partnerships, see sourcing data directly from operating companies, and for the data shape of conversation-plus-action records, see policy-following service agent data. More industry guides sit in our industry-specific operational data hub.

How SourceX approaches BPO-held data

SourceX sources operational datasets, including support and sales histories and back-office workflow records, from US companies on request, and every release is approved by the supplying company. For BPO-held data, that means the rights review covers ownership and consents before anything is agreed, and personal details such as names, emails, phones and account numbers are removed or replaced before delivery, with the method recorded and a sample checked; no de-identification method is perfect. Buyers can describe the data they need on the SourceX buyers page; a request does not guarantee a match. Related pages: BPO and contact-center buyers, contact-center call recordings, workflow task histories and whether call centers and BPOs can sell data to AI companies.

Request BPO data for AI training

SourceX looks for US businesses that hold the data you describe, assesses data and licensing permissions, and agrees pricing and allowed uses in a license before anything is delivered. Nothing is contracted until a supplier agrees. Start a request on the SourceX buyers page.