CRM and GDPR: what a small company has to get right
A CRM is mostly personal data. The practical points for a small company: legal basis, how long to keep records, consent, rights requests and security. General information, not legal advice.
This is general information, not legal advice. Soldlyne gives no legal advice. Your obligations depend on your activity and your customers; for anything that matters, ask your data protection officer or a lawyer.
A CRM holds names, work addresses, phone numbers, notes about people and the history of your conversations. Nearly all of it is personal data, including when the person works for a company. So the GDPR applies, whatever your size. The good news is that a small company’s obligations come down to a few habits.
The French regulator, the CNIL, has published a reference framework for customer and prospect files (the référentiel gestion commerciale). It’s a guide to compliance rather than a law, and it’s the clearest thing to read on this. Below, we use its figures.
Know why you hold each piece of data
Every use needs a legal basis under article 6 of the GDPR. For a CRM, three come up most often:
- A contract, or steps taken at the person’s request before one: handling a customer’s order, sending a quote they asked for.
- Legitimate interest: keeping track of your commercial relationships, within reason.
- Consent: where it’s needed, such as a form asking to receive your newsletter. The CNIL says it requires a positive and specific act, for instance a dedicated box that isn’t ticked in advance.
Writing this down in one short document, along with what you hold and who can see it, is most of what a small company’s register of processing looks like.
Don’t keep it forever
The GDPR says data must be kept no longer than necessary for its purpose (article 5). The CNIL’s framework turns that into figures:
| Who | How long |
|---|---|
| A customer, used for prospecting | The relationship, then three years from its end (for example from a purchase, the end of a warranty or contract, or the customer’s last contact) |
| A prospect who never bought | Three years from collection, or from the prospect’s last contact |
A contact has to come from the prospect: asking for documentation or clicking a link in an email counts, while simply opening an email shouldn’t. After three years you may ask whether they still want to hear from you; with no clear yes, delete the data or archive it where you have a duty to keep it.
Accounting records are another matter, with their own rules, and the framework says to archive those separately.
The habit: every six months, list the people with no contact for three years, and deal with them. A “last contact” column in your CRM makes this a ten-minute job.
Record consent when you collect it
When someone ticks a box on your form, keep the date, the form and the page. Without it you can’t show they agreed. If they didn’t tick it, don’t mark them as opted in, and a later form without the box shouldn’t undo an earlier yes or invent one.
Soldlyne’s lead capture works this way: a person who ticked the box gets the date and the form and page it came from, and nobody is marked as opted in without it.
Be ready for rights requests
Anyone can ask to see their data, correct it, erase it, or object to its use (articles 15 to 21). You have one month to answer, as a rule. For a small company, that means:
- knowing who handles the request (one named person);
- being able to find everything about one person, which a timeline per contact makes easy;
- being able to delete or anonymise a record;
- not contacting them again when they’ve objected, on any channel, which takes a list of who said no.
Write notes as if the person will read them
They may. A right of access covers free-text notes, so “difficult, seems to be going through a divorce” has no place in a CRM. Stick to what you need for the sale.
Who else touches the data
Your host, your database provider, your mail provider and your CRM vendor, if there is one, process data for you. Under the GDPR they’re processors, and you need a contract with each; most publish a standard data processing agreement. Check where they’re established too: a server in Frankfurt run by an American company still raises the question of transfers outside the EU.
Keep it locked
You don’t need a security department. You do need:
- an account per person, removed the day they leave;
- no shared passwords, and a strong one or single sign-on;
- only the access each person needs, and walls between companies if you run several;
- backups, and encrypted storage for anything like email access tokens.
What an assistant changes
If you connect your CRM to Claude or ChatGPT, the data it reads goes through that provider, under your contract with them. Check their terms the same way, and think twice before connecting a personal account to a company’s customer records.
Where Soldlyne stops
A tool can make these habits easier, but it can’t make you compliant. Soldlyne keeps provenance and timelines, records consent, walls off companies from each other and never creates contacts from your inbox. Deciding your legal bases, your retention and how you answer requests stays with you. And since Soldlyne keeps no do-not-contact list of its own today, an objection is something you have to act on yourself.