A CRM is one of the places where UK GDPR stops being abstract. It holds names, contact details, notes about conversations, purchase history and sometimes things people told you in confidence. Each of those records is personal data about an identifiable person, and the way you collect, use, store and delete it has to fit the rules.
CRM GDPR compliance is not a single setting that can be switched on. It is a set of decisions: why you hold each type of data, what people were told when you collected it, how long you keep it, who can see it and how you respond when someone asks what you hold. Those decisions are far easier to make at the start of a CRM project than to retrofit later.
This article gives general guidance on the main areas. It is not legal advice, and the right answer for your business depends on your own activities, customers and contracts. Speak to a qualified data protection adviser before relying on any of this for a decision that matters.
Start with a clear record of what the CRM holds
You cannot manage data protection risk in a system you have not described. A simple record of what the CRM holds, who it is about, why you hold it and where it came from is the foundation for everything else. It also supports the accountability principle, which expects you to be able to show how you comply.
What counts as personal data in a CRM
The obvious examples are names, email addresses, phone numbers and postal addresses. Less obvious ones include notes about a person, call recordings, purchase history and records of enquiries. A business email address that names an individual is personal data too, even when it is used for work.
Free-text notes and sensitive information
Notes are where problems often hide. A salesperson might write down a health detail, a family situation or a complaint that includes sensitive information. Some of that falls into special category data, which needs extra care. The practical approach is to keep the CRM to what the relationship needs, and to set clear guidance on what should never be written in notes.
Telling people what happens to their data
People should be told, in plain language, what the business does with their data. A privacy notice that explains what the CRM is used for, what it holds, how long it is kept and how to make a request is part of the same job. The notice has to match what actually happens in the system, so review it whenever the process changes.
CRM GDPR compliance starts with a lawful basis for each purpose
UK GDPR requires a lawful basis for every purpose you use personal data for. The six bases are consent, contract, legal obligation, vital interests, public task and legitimate interests. For most CRM work the relevant ones are contract, legitimate interests and consent. Decide the basis for each purpose before collecting the data, and reflect it in the privacy information you give people.
Contract and legal obligation
Where you need information to deliver what someone has asked for, or to take steps before entering a contract, the contract basis may apply. Some records, such as those needed for tax or accounting, may fall under a legal obligation. Be careful not to stretch the contract basis to cover marketing that goes beyond the service the person asked for.
Legitimate interests and the balancing test
Many businesses rely on legitimate interests to manage ongoing relationships with customers, though electronic marketing still has to meet the PECR rules covered below. That basis needs a documented assessment. The purpose must be legitimate, the processing must be necessary for it, and the individual's interests and reasonable expectations must not override it. The Information Commissioner's Office (ICO) publishes guidance on how to carry out that assessment, and it is worth using.
Consent and when it is the right tool
Consent has to be freely given, specific, informed and unambiguous, shown through a clear positive action. Pre-ticked boxes do not count. People must be able to withdraw consent as easily as they gave it, and the CRM has to respect that withdrawal. Consent suits some kinds of marketing, but it is a poor fit for records the business needs to run an ongoing service.
Marketing preferences and electronic marketing rules
Marketing has its own layer of rules. The Privacy and Electronic Communications Regulations, usually called PECR, govern electronic marketing such as email, text and some telephone marketing. They work alongside UK GDPR rather than replacing it, so a CRM campaign has to satisfy both.
Individuals and the soft opt-in
For individual subscribers, marketing email and text generally needs consent. There is a narrow exception, often called the soft opt-in, for people who have bought from you or been in negotiations with you. It applies only where their contact details were collected in that sale or negotiation, the marketing is about similar products or services, and they were given a simple way to opt out when their details were collected and in every message.
Business contacts and sole traders
The position differs for corporate subscribers, such as limited companies, compared with individuals. Sole traders are generally treated as individuals. Even where the consent rules differ, UK GDPR still applies to any personal data involved, and every marketing email must identify the sender and give a valid way to opt out. Take advice on the position for your own mailing lists.
Honouring opt-outs across the CRM
When someone unsubscribes, the CRM should record it, stop the relevant messages and keep a suppression record so the person is not added back by an import or a new form. Check that marketing lists, sequences and integrations all read the same preference field. A preference stored in one place and ignored in another is a common cause of complaints.
Retention: how long you keep customer records
UK GDPR says personal data should be kept no longer than necessary for the purpose. That sounds simple, but CRM records are often kept indefinitely because deleting feels risky. A retention policy turns the principle into practice, and it reduces the amount of data you have to protect and search through.
Set periods for each type of record
Agree a period for each category of record: active customers, lapsed customers, enquiries that never became work, marketing contacts who have not engaged, and any records you must keep for legal or accounting reasons. Write these down, and make sure the policy is reflected in the system rather than sitting in a document nobody opens.
Deleting, anonymising and reviewing
Some records can be deleted outright. Others may be better anonymised if you still need figures for reporting. Where you keep records for a legal reason, limit who can access them. Build a routine to review old records, and keep a note of when the last review took place.
Responding to subject access requests from the CRM
People have the right to ask what personal data you hold about them, and that includes what sits in the CRM. A subject access request can be made in writing or verbally and does not need to use a particular phrase. The CRM is often the largest source of information you will need to search.
Finding everything about a person
The practical challenge is finding every record. A contact may appear under more than one name or email address, and notes may sit on deals, tasks or tickets rather than on the contact record. Know where personal data lives before a request arrives, and search by consistent identifiers such as email address and phone number to find related records.
Timescales and checks before you reply
In general you must respond within one month of receiving the request, although that can be extended in some cases, such as complex requests. In most cases you cannot charge a fee for responding. Before releasing anything, check that the response does not reveal someone else's personal data, and that the request genuinely comes from the individual or from someone acting for them.
Keep a simple log
Record each request, the date it arrived, the deadline, what you searched and what you sent. A short log protects you if the request is questioned later, and it makes the next request quicker to handle.
CRM GDPR compliance: security, access and suppliers
Security is part of compliance. UK GDPR expects appropriate technical and organisational measures for personal data, and that applies to the CRM as much as to anything else you hold. The most common weak points are rarely clever attacks. They are shared logins, too many administrators and exports saved to laptops.
Access that matches the job
Give each user access to the records they need for their role and no more. Use individual accounts rather than shared logins, turn on multi-factor authentication where the platform offers it, and remove access promptly when someone leaves. Keep a short list of who holds administrator rights.
Exports and copies
Exporting the whole database to a spreadsheet is easy, and that is exactly why it is risky. Restrict who can export, and where an export is genuinely needed, store it somewhere controlled and delete it when the task is finished. A forgotten file on a personal device is a breach waiting to be discovered.
Terms with your CRM and other suppliers
If a supplier processes personal data on your behalf, UK GDPR expects a written contract that sets out what they may do with it. Check your provider's data processing terms and where the data is stored. If data is transferred outside the UK, the safeguards for that transfer also need to be understood before you rely on the service.
Reporting a personal data breach
If a personal data breach is likely to put people's rights and freedoms at risk, it must be reported to the ICO within 72 hours of becoming aware of it. Where the risk is high, the people affected may need to be told as well. Agree in advance who makes that judgement, and keep a record of what happened and what you did about it.
FAQ
Do we need consent to store customer details in a CRM?
Not always. Holding details to run an ongoing relationship or to carry out a contract may rely on the contract basis, and keeping in touch may rely on legitimate interests. Electronic marketing to individuals usually needs consent, subject to the soft opt-in exception. Work out the basis for each purpose, record it and take advice on your own situation.
How long can we keep CRM records?
UK GDPR does not set a fixed period. It says personal data should be kept no longer than necessary for the purpose, so each category of record needs a justified retention period. Some records may need to be kept longer for legal or accounting reasons. Write the periods down and apply them in the system.
What is a subject access request and how quickly must we respond?
A subject access request is a request from someone asking for a copy of the personal data you hold about them, together with supporting information about how it is used. In general you must respond within one month, although this can be extended in some cases. Check identity first and make sure the response does not disclose other people's data.
Can we email prospects about our services?
It depends on who they are and how you obtained their details. Marketing emails to individuals generally need consent, unless the soft opt-in applies to people who have bought from you or negotiated with you. Emails to company addresses follow different rules, but every marketing email must identify you and offer an easy way to opt out. Take advice on your own mailing lists.
Do we have to report a data breach?
Some breaches must be reported. If a breach is likely to put people's rights and freedoms at risk, it must be reported to the ICO within 72 hours of becoming aware of it. Where the risk is high, the people affected may also need to be told. Every breach should be recorded internally, including those that are not reported.
Is a CRM provider responsible for GDPR compliance?
Not entirely. Where a provider processes personal data for you, you need a written contract covering what they may do with it, and you remain responsible for how you use the system. Check the provider's data processing terms, security information and where data is stored. Someone who understands your obligations should review those terms.
Final thought
CRM GDPR compliance in the UK comes down to knowing what you hold, why you hold it, how long you keep it and who can see it. A CRM that answers those questions clearly is easier to run, easier to check and far less stressful when someone asks what you know about them.
Start with a record of your data, then check the lawful basis and marketing consent for each purpose. Set retention periods, test how you would find one person's data in a subject access request and review who has access. Get advice on the points that depend on your own business, such as your mailing lists and your supplier contracts.
Mirex Agency's CRM solutions service can configure fields, permissions, retention routines and preference tracking so they match the policies you agree with your adviser. We are not a law firm, so the legal decisions stay with you and your adviser.
