CRM and GDPR: legal bases, retention periods and access requests in daily sales
A CRM is where your business collects the most personal data: names, email addresses, phone numbers, call notes, sometimes birthdays and personal preferences. Privacy is therefore decided less by the choice of vendor than by how the data is handled every day. This article shows the five points that make a CRM GDPR-proof in daily sales, with German retention rules as the example.
1. A legal basis for every contact group
Every record needs a legal basis under Article 6 GDPR. In a CRM there are usually three:
- Contract or pre-contract steps (Art. 6(1)(b)): customers and prospects who asked for a quote.
- Legitimate interest (Art. 6(1)(f)): for example contacts at business customers you work with. Document the balancing test.
- Consent (Art. 6(1)(a)): for example for newsletters. Store when and how it was given.
2. Vendor, contract and access rights
Sign a data processing agreement under Article 28 GDPR with the CRM vendor. Check the storage location and sub-processors; for US vendors also check certification under the EU-US Data Privacy Framework or standard contractual clauses.
Permissions inside your team matter just as much: not every employee needs access to every contact, note and export. Roles and a rule on who may export data stop half the customer list walking out the door when a salesperson leaves.
3. Notes: factual and minimal
Free-text notes are the biggest risk in a CRM, because people have a right of access under Article 15 GDPR, and that includes notes. Write only what the business relationship needs, and write it so the customer could read it. Health details, assumptions about private life or derogatory remarks don't belong there.
4. A deletion policy with real periods
Data may only be kept as long as needed for its purpose, but commercial and tax law require long retention in some cases. In Germany, distinguish:
- Prospects who never ordered: delete after a defined period, for example after a year without contact.
- Business letters and quotes that led to a deal: six years under Section 257 HGB.
- Accounting vouchers such as invoices: eight years since 2025 (previously ten); books and annual accounts still ten years.
- Newsletter unsubscribers: keep only the address on a suppression list so it isn't contacted again.
5. Build access, deletion and marketing into the process
Access requests must generally be answered within one month (Article 12(3) GDPR). Decide who handles them and test once whether you can export everything about one person, including notes and emails, from the CRM.
In Germany, email marketing falls under Section 7 of the Unfair Competition Act (UWG): without consent you may only email existing customers under narrow conditions, such as for similar products and with an opt-out notice in every email. Cold marketing emails to prospects in the CRM are not allowed. We set up automated deletion rules, suppression lists and access-request exports as part of a CRM integration.
Frequently asked questions
- Can I add business cards from trade fairs to the CRM?
- Generally yes, based on legitimate interest for business contact. For marketing emails you still need consent unless the exception in Section 7(3) UWG applies.
- Is a US-based CRM allowed?
- Yes, with a data processing agreement and a valid transfer basis, such as the vendor's Data Privacy Framework certification. Many vendors also offer EU hosting.
- Does the CRM belong in our record of processing activities?
- Yes. Customer management and sales belong in the Article 30 GDPR record with purpose, data categories, recipients and deletion periods.
Sources
Tell us your CRM and how contacts get into it today. We set up deletion rules, suppression lists and permissions so privacy runs automatically.
Set up CRM privacy