Lesson 10 of 107 minutes
Fixing it so it does not happen again: a compliance calendar, vendor contracts, and the records to keep
Everything in this course comes down to three habits: check the things that drift on a schedule, make vendors carry their share in writing, and keep the records that turn a claim into a dispute. This last lesson turns the nine before it into a calendar, a contract checklist, and a records list.
The compliance calendar
| When | What | Lesson |
|---|---|---|
| Before every outbound campaign | Scrub against the National Do Not Call Registry with a list no more than 31 days old; check consent records exist for every number; confirm calling hours by state. | 4 |
| Daily or in real time | Process STOP and do-not-call requests into your internal list. The FCC’s rules allow ten business days; do it the same day. | 4 |
| Monthly | Review auto-renewal and cancellation flows; check that marketing claims still have substantiation; read new reviews and your replies. | 3 |
| Quarterly | Audit a sample of consent records end to end; review contractor relationships against the control tests; check time records for non-exempt staff. | 6 |
| Annually | Re-read insurance exclusions with your broker; run a website accessibility check; update the privacy policy against what the site actually does; review every vendor contract; review record retention. | 1, 5 |
| When anything changes | New product claim, new marketing channel, new state, new vendor, new data collected: check the relevant lesson before launch, not after the letter. | All |
Vendor contracts
Every vendor who touches customers, data or marketing on your behalf should sign a contract that contains the following. These are the clauses from Lesson 2 applied to the problem in Lesson 8.
- Compliance warranty. The vendor warrants it will comply with the specific laws that apply to the work (the TCPA and state telemarketing laws for callers; CAN-SPAM for email; privacy and security standards for data).
- Method restrictions. What the vendor may and may not do: no purchased lists without your approval, no prerecorded voice without your written consent records, no calls outside stated hours.
- Records. The vendor keeps consent, scrub and call records for at least four years and gives you copies on request, and on termination.
- Audit right. You can inspect the vendor's records and processes on notice.
- Indemnity. The vendor covers claims caused by its breach, including defense costs, with insurance behind it.
- Termination. You can end the contract on a compliance failure without penalty.
A vendor that will not sign these is telling you how it operates.
Records to keep
| Record | Keep for | Why |
|---|---|---|
| Consent records per number, with disclosure text and method | At least four years after the last message | The only defense that ends a TCPA claim outright; matches the federal limitations period. |
| Call and text logs, scrub logs, opt-out logs | At least four years | Prove dates, counts and compliance; needed for any dispute. |
| Contracts, signed, with every version | The contract’s life plus your state’s contract limitations period | Which draft was agreed decides most contract disputes. |
| Terms of service and privacy policy versions, with dates and acceptance records | As long as any customer who accepted them could claim | Prove what the customer saw and agreed to. |
| Payroll and time records | At least three years under the FLSA; longer under many state laws | Missing records are construed against the employer. |
| Insurance policies and notices | Permanently | Claims arrive years after the policy period. |
| Settlement agreements and releases | Permanently | Your answer if the same claim resurfaces. |
Turn off automatic deletion on every system that holds these. The default retention on most dialers, texting platforms and email services is shorter than any of the periods above.
The habit
None of this needs a compliance department. It needs one person who owns the calendar, a shared folder with the records in it, and the discipline to check the lesson before launching the thing rather than after opening the letter. The final checklist puts the whole course on one page.
What you should now know
- Compliance drifts. Put the checks on a calendar: per campaign, daily, monthly, quarterly, annually, and whenever something changes.
- Vendor contracts need a compliance warranty, method restrictions, record-keeping, an audit right, an indemnity and a termination right.
- Keep consent and call records at least four years, payroll records at least three, contracts for their life plus the limitations period, and settlements permanently.
- Turn off automatic deletion everywhere these records live.
Questions from this lesson
We are five people. Is a compliance calendar realistic?
The calendar above is a dozen recurring reminders and a shared folder. The cost of running it is small next to one letter.
Our vendor says its own records are confidential.
Records about your campaigns are your defense. Write access to them into the contract. A vendor that refuses is a risk you are choosing.
Can we just delete old data to reduce exposure?
Deleting records you are required to keep, or deleting after a claim is foreseeable, creates exposure rather than reducing it. Set a retention policy, apply it consistently, and suspend it the moment a letter arrives.
Who should own this?
One named person, with the owner checking quarterly. Shared ownership is no ownership.