Short answer
For every kind of personal data in your CRM, know your lawful basis (often a contract or your legitimate interest in business contact; consent for things like newsletters); tell people what you do with their data in a privacy notice; store only what you need and delete it when you no longer do; answer access, correction and erasure requests within one month; keep the data secure; and sign a data processing agreement with your CRM provider.
Not legal advice. This guide summarises the main GDPR principles for general information. For your specific situation, ask a data protection adviser or your national data protection authority.
1. Know why you have each piece of data
Article 6 of the GDPR lists the lawful bases for processing personal data. For a small business CRM, three come up most often:
- Contract – data you need to prepare a quote someone asked for, or to deliver a service to a client.
- Legitimate interests – for example keeping business contacts and following up on an enquiry, when it does not override the person’s own interests.
- Consent – for things the person must actively agree to, such as a marketing newsletter. Consent must be freely given and as easy to withdraw as to give, so keep a record of it.
Marketing emails to individuals are also governed by national rules based on the ePrivacy Directive, which often require consent; the details differ by country and between private people and businesses.
2. Tell people what you do
Articles 13 and 14 require you to inform people when you collect their data: who you are, why you use the data and on what basis, who receives it, how long you keep it and what their rights are. For most small businesses, a clear privacy notice on the website, linked from every form, does this.
3. Keep only what you need, for as long as you need it
- Collect what you use. If you never use a birthday or a home address, do not ask for it.
- Set retention periods. For example: enquiries that did not lead to work, 12 months after the last contact; client records, as long as accounting rules require.
- Clean up. Delete or anonymise old leads regularly – once a quarter is easy to remember.
- Write notes you would be comfortable showing the person. They have a right to see their data.
4. Answer rights requests
People can ask to see the data you hold about them (Article 15), to correct it (Article 16), to have it erased (Article 17), to restrict its use (Article 18), to receive it in a portable format (Article 20) and to object (Article 21). You must answer without undue delay and within one month, which can be extended in some cases. Being able to find everything about one person quickly is what makes this manageable.
5. Keep it safe
- Give every team member their own login, and remove access when someone leaves.
- Use strong passwords and two-step sign-in where available.
- Do not keep copies in spreadsheets or email attachments “just in case”.
- If personal data is lost or exposed, you may have to report it to your data protection authority within 72 hours (Article 33) – know who would handle that.
6. Your CRM provider is your processor
When a CRM provider stores your customers’ data for you, it acts as your processor. Article 28 requires a written data processing agreement, and you should know which sub-processors it uses and where the data is stored. If the data leaves the EU, check how the transfer is protected.
How GETCORVIDS helps
GETCORVIDS stores each business in its own workspace in Frankfurt, Germany, and every customer contract includes a data processing agreement with a published list of sub-processors. Built-in privacy tools keep a consent log, add a one-click unsubscribe, and let you find, export or erase everything held about one person. The website enquiry form logs the visitor’s consent.
Questions
Do I need consent to keep customers in my CRM?
Not always. For clients and people who asked you for a quote, the lawful basis is often the contract or your legitimate interest. Consent is needed for things like marketing newsletters to individuals.
How long can I keep old leads?
The GDPR does not set a fixed period: keep data only as long as you need it for the purpose. Many small businesses delete enquiries that did not lead to work after about 12 months.
What do I do if someone asks for their data to be deleted?
Check whether you must keep any of it (for example invoices for tax purposes), delete the rest, and confirm to the person within one month.
Sources
- Regulation (EU) 2016/679 (GDPR) – EUR-Lex
- Data protection guide for small business – European Data Protection Board
- Rules for business and organisations – European Commission
Thomas Krajecz builds GETCORVIDS at Digital Supportly. Questions about this guide? Write to hello@getcorvids.com – a person replies within one business day. Follow Thomas on LinkedIn.