CRM and the GDPR: what to know when you store customer data

It means collecting only the data the purpose needs (Article 5(1)(c)) and keeping it only as long as needed (point (e)). In a CRM that means not adding a custom field for things nobody uses (a birthday, an ID card number), and reviewing long-inactive contacts now and then.

If you rely on consent, you must be able to demonstrate that the person consented (Article 7(1)), and withdrawing must be as easy as giving it (Article 7(3)). So for a newsletter it is worth keeping what someone accepted, when and in what wording, and every mail should carry an unsubscribe link.

A person may object to direct marketing at any time, and their data may then no longer be used for it (Article 21(2) and (3)). The guide on email marketing lists the practical minimum.

• Email marketing under the GDPR: the practical minimum
• Double opt-in
• How do I send a GDPR-compliant newsletter?

A person has the right to learn what data you hold about them and get a copy (Article 15), to ask for correction (Article 16), in certain cases erasure (Article 17), and to receive the data they provided in a machine-readable form (Article 20). You must answer without undue delay and at the latest within one month, which can be extended by two further months where justified (Article 12(3)).

Erasure is not always total: what a legal obligation requires you to keep, an issued invoice for example, stays. The hard part is that in a CRM one person can appear in many places: on the contact, in a shop order, in an appointment, in a webhook that was sent. Erasure has to reach those copies too.

• How do I export or erase a customer's data under the GDPR?
• GDPR

The regulation asks for appropriate technical and organisational measures to secure the data (Article 32). In a small company's CRM that means three things: everyone signs in with their own account, and nobody shares a password; a colleague sees only what their work needs; and signing in has a second factor, an authenticator app for example.

When someone leaves, their access should end on their last day, and their open work should move to a colleague, so no customer is left without an owner.

• How do I let a colleague see only their own customers?

Yes. A cloud CRM provider handles your customers' data on your behalf, so it is a processor, and the GDPR requires a written agreement with it that sets out, for example, that it may process the data only on your instructions (Article 28). Also check where the data is stored, and whether you can take it out if you switch.

If a breach (a lost laptop, say, or a customer list mailed to the wrong address) poses a risk to the people concerned, it must be reported to the supervisory authority without undue delay and, where feasible, within 72 hours (Article 33(1)), and where the risk is high the people concerned must be told too (Article 34). It is worth knowing in advance who decides this in your company.

• Everything held about a customer can be exported in one click, and erasure reaches the copies too: shop orders, webhooks, appointments.
• Forms can switch on double opt-in: consent is recorded at the click, with the wording shown, the time and the IP address.
• Roles and record-level visibility: a colleague can be limited to their own customers.
• Two-step sign-in with an authenticator app, and an audit log of what was done.
• A leaving colleague's access ends after their last working day, and their open work can be handed over.
• The GDPR tools are part of the free plan. The agreement names where the data is hosted, and there is a self-hosted plan too.

These are tools: the legal basis, the retention periods and the privacy notice are yours to decide, preferably with a data protection adviser.