CRM and GDPR: Compliance Without Losing Efficiency

GDPR compliance for a CRM refers to the full set of technical and organizational measures needed to process personal data in line with the General Data Protection Regulation. In B2B, this compliance mainly concerns professional contacts (first name, last name, email, phone number, job title) and requires a solid legal basis, controlled retention periods, and strict respect for individual rights. According to CNIL, 78% of French companies received at least one rights request in 2025, while GDPR fines reached 2.3 billion euros across Europe since 2018.

Bringing your CRM into compliance is not a sales obstacle: it's an opportunity to clean up your database, strengthen customer trust, and avoid fines that can reach 4% of global revenue. This article gives you the keys to reconcile sales performance with data protection.

GDPR fundamentals applied to CRM

GDPR imposes six fundamental principles for any processing of personal data, directly applicable to your CRM.

The six GDPR principles

Personal data in B2B: what's covered

Contrary to popular belief, GDPR fully applies in B2B as soon as there is data that can identify a natural person:

Data always covered:

• Contact's first and last name
• Named email address (firstname.lastname@company.com)
• Direct phone number
• Profile photo
• Interaction history

Data sometimes covered:

• Generic email if linked to a person (contact@startup.com managed by Jean Dupont)
• Business address if it allows identification (individual office)
• Job title if specific enough ("CEO" in a very small company)

Data outside GDPR scope:

• Unlinked generic email (info@company.com)
• Company name alone
• Business registration number, VAT number

According to DLA Piper, 89% of typical B2B CRM data falls within the scope of GDPR, making compliance unavoidable.

Legal bases for B2B prospecting

GDPR requires that any data processing rest on one of the six legal bases set out in Article 6. In B2B, three bases are relevant to your CRM.

1. Legitimate interest: the reference basis in B2B

Legitimate interest is the legal basis most commonly used for B2B sales prospecting. It allows you to contact professionals in the context of their role without prior consent, under three conditions:

1. Pursue a legitimate interest: grow your business
2. Respect individuals' interests: do not infringe on their fundamental rights
3. Document the proportionality test: prove that the business interest outweighs the impact on privacy

Valid use cases:

• Prospecting decision makers in your industry
• Following up with contacts who downloaded a white paper
• Nurturing qualified leads
• Post-demo or post-event follow-up

Limits to respect:

• Strictly professional context (no outreach on personal LinkedIn Messenger)
• Reasonable frequency (no harassment)
• Simple and effective right to object
• Consistency between the collection source and the use (don't prospect using purchased cold lists)

2. Consent: mandatory for certain channels

Consent is required for:

• Email marketing: sending newsletters or promotional content (ePrivacy directive)
• Cookies and trackers: behavioral tracking on your website
• Sensitive data: if you exceptionally collect data revealing political opinions, union membership, etc.

Criteria for valid consent (GDPR Article 7):

1. Freely given: without constraint, without a power imbalance
2. Specific: per purpose (newsletter ≠ sales prospecting)
3. Informed: clear information about how the data will be used
4. Unambiguous: a positive action (no pre-checked boxes)
5. Revocable: as easy to withdraw as to give

In practice:

❌ Bad: "By submitting this form, you agree to receive our communications."
✅ Good: "☐ I want to receive the monthly Across newsletter (news, case studies)"
          "☐ I agree to be contacted by an Across sales rep about my CRM projects"

3. Contract performance: for your active customers

This legal basis covers:

• Data needed to deliver the service (main contact, billing)
• Customer support and onboarding
• Management of the contractual relationship

It does NOT cover:

• Upselling or selling new products (use legitimate interest instead)
• Sharing data with partners
• Using data for R&D or product improvement purposes

Summary table

Retention periods: the golden rule of 3 years

CNIL requires you to define and respect maximum retention periods for each category of data.

Retention periods recommended by CNIL

Technical implementation

1. Segmentation by status:

- Prospect: date_creation + 3 years
- Lead: date_last_activity + 3 years
- Client: date_end_contract + 3 years
- Opt-out: unlimited retention (email hash)

2. Automating deletion:

Most modern CRMs let you configure retention rules. Examples:

Salesforce:

• Use Process Builder or Flow to flag contacts for deletion
• Create a weekly Apex batch job for anonymization

HubSpot:

• Automated workflows based on the "Last Activity Date" property
• Deletion or archiving based on status

Pipedrive:

• API for a monthly cleanup script
• Export before deletion for legal archiving

3. Intermediate archiving:

For data that must be kept for legal reasons but is no longer commercially useful:

• Export to a secure archiving system outside the CRM
• Pseudonymization within the CRM (replacing name/email with a unique ID)
• Restricted access (legal/accounting team only)

The inactivity trap

Careful: no sales action resets the clock. Only interactions from the contact themselves count:

• Opening an email (if tracking is enabled)
• Clicking a link
• Replying to an email
• Visiting the website (if identified)
• Attending an event
• Downloading content

A sales rep logging "cold call, no answer" every 2 years does NOT reset the retention period.

The record of processing activities: your GDPR map

The record of processing activities (GDPR Article 30) is mandatory for any company with more than 250 employees, and recommended for everyone else. It documents every use of CRM data.

Structuring the record for your CRM

For each processing activity (prospecting, customer management, support, etc.), document:

1. Purpose: what is the data used for?

   • Example: "Sales prospecting of IT decision makers in the B2B SaaS sector"

2. Legal basis: consent, legitimate interest, contract?

   • Example: "Legitimate interest (business development)"

3. Categories of data subjects

   • Example: "B2B prospects, inbound leads, active customers"

4. Categories of data processed

   • Example: "Identity (first and last name), professional contact details (email, phone), job title, company, interaction history"

5. Data recipients

   • Example: "Internal sales team (12 people), CRM tool (Salesforce, USA, standard contractual clauses), email provider (Brevo, France)"

6. Transfers outside the EU

   • Example: "Salesforce Inc. (USA), standard contractual clauses approved by the Commission"

7. Retention period

   • Example: "3 years from the last interaction for prospects, contract duration + 3 years for customers"

8. Security measures

   • Example: "Multi-factor authentication, encryption in transit (TLS 1.3), access logs, encrypted daily backups, access rights management"

Sample CRM processing record template

PROCESSING ACTIVITY #1: MANAGING B2B SALES PROSPECTING

Data controller: [Your company], represented by [CEO/DPO]
Purpose: Identify, qualify, and convert prospects into customers
Legal basis: Legitimate interest (business development)

Data subjects: B2B decision makers and influencers (CIO, CTO, RevOps, VP Sales)
Data processed:
  - Identification data: first name, last name, job title
  - Contact data: professional email, direct phone number
  - Business data: company, industry, headcount, estimated revenue
  - Behavioral data: lead source, interaction history, scoring, pipeline status

Collection sources:
  - Web forms (demos, white papers, events)
  - LinkedIn prospecting (Sales Navigator)
  - Lists provided by partners (with consent)
  - API enrichment (Clearbit, Dropcontact)

Recipients:
  - Sales team (BDR, AE, Sales Managers): full access
  - Marketing: read access for targeted campaigns
  - Leadership: anonymized dashboards
  - Processors: Salesforce (CRM hosting), Brevo (emailing), Aircall (telephony)

Transfers outside the EU: Salesforce Inc. (USA), EU standard contractual clauses

Retention period:
  - Prospects not converted: 3 years after last interaction, then deletion
  - Objectors (opt-out): permanent retention of hashed email (exclusion list)

Security measures:
  - Secure access via MFA (Okta)
  - Role and permission management (least privilege principle)
  - Data encryption in transit (TLS 1.3) and at rest (AES-256)
  - Access logs retained for 1 year
  - Encrypted daily backups, tested monthly
  - Security clauses in processor contracts

Exercising rights: dedicated web form (contact@company.com), response within 1 month

Keeping the record up to date

The record is not a static document. Update it whenever there is:

• A new processing activity (new CRM, new connected tool)
• A change in purpose (launch of a new type of campaign)
• A new processor or a change of hosting provider
• A change in retention periods
• A data transfer outside the EU

Recommended frequency: a full annual review, with continuous updates.

Individual rights: responding within 30 days

GDPR grants eight rights to the individuals whose data you process. Your CRM must make it easy to exercise them.

1. Right of access (Article 15)

Typical request: "What personal data do you hold about me?"

Obligation: Provide a copy of all the data, the purposes, the recipients, the retention period, and the source.

CRM implementation:

• Full contact export (all properties, activities, notes, emails)
• Include data from connected tools (support, billing)
• Readable format (structured PDF, not a raw SQL dump)

Deadline: 1 month (extendable to 3 months if complex, with justification)

2. Right to rectification (Article 16)

Typical request: "My phone number is wrong, here's the correct one."

Obligation: Correct inaccurate data without delay.

CRM implementation:

• A validation process for changes (to prevent abuse)
• Notify recipients if the data has been shared
• Log changes for auditability

3. Right to erasure / "right to be forgotten" (Article 17)

Typical request: "Delete all my data."

Obligation: Erase the data except for legal exceptions (accounting, litigation).

CRM implementation:

1. Check eligibility: no legal obligation to retain (active customer, invoice < 10 years old, ongoing dispute)
2. Full deletion: CRM contact + emails + notes + files + connected data
3. Retention on an exclusion list: hash the email to prevent accidental re-collection
4. Notify processors: request erasure from partners

Exceptions: You can refuse if you have a legal obligation (10-year invoice retention, ongoing litigation, public interest).

4. Right to object (Article 21)

Typical request: "Stop contacting me" or clicking "unsubscribe."

Obligation: Immediately stop any processing based on legitimate interest (prospecting) or consent (newsletter).

CRM implementation:

• An "Opt-out" or "Do Not Contact" status blocking any campaign
• One-click unsubscribe in emails
• Honor the refusal even if the person changes jobs
• An exclusion list shared across the CRM, marketing automation, and telephony tools

Careful: Objecting to prospecting does not mean deleting the data (see right to erasure). You must keep the email on a blocklist to honor the refusal.

5. Right to restriction of processing (Article 18)

Typical request: "I dispute the accuracy of my data, block its use while you verify it."

Obligation: "Freeze" the data during verification or for the duration of a dispute.

CRM implementation:

• A "Restricted processing" flag preventing modification and use
• Notify the sales team
• Remove the flag once resolved

6. Right to data portability (Article 20)

Typical request: "Give me my data in a format I can reuse."

Obligation: Provide the data in a structured, machine-readable format (CSV, JSON, XML).

CRM implementation:

• A standardized export (CSV with named columns)
• Include only data provided by the individual (not derived data such as scoring)
• The possibility of direct transfer to another data controller when technically feasible

7. Right not to be subject to automated decision-making (Article 22)

Relevant cases: If your CRM makes automated decisions with legal or similarly significant effects (automatic rejection of a lead, account blocking).

Obligation: Allow for human intervention, explain the logic, and enable the decision to be challenged.

In practice: Rarely applicable in B2B (sales scoring is not a legal decision). Document it if you automatically reject prospects (e.g., a competitor blocklist).

8. Right to lodge a complaint with the CNIL

Obligation: Inform individuals of this right in your privacy policy.

CNIL contact: file a complaint online at cnil.fr or by mail.

Process for handling requests

1. Single channel: A dedicated email address (dpo@company.com or privacy@company.com) mentioned in the privacy policy.

2. Acknowledgment: An automatic email confirming receipt and stating the response deadline (1 month).

3. Identity verification: Request proof of ID if in doubt (to avoid sending data to the wrong person).

4. Processing: Coordinate across CRM, marketing, support, and accounting.

5. Formal response: A detailed email or letter with the data or confirmation of the action taken.

6. Archiving: Keep the request and the response for 3 years (proof of compliance in case of an audit).

Deadline: 1 month from receipt. Extendable to 3 months if the request is complex (inform the individual within 30 days, with justification).

The DPO's role and internal governance

Data Protection Officer (DPO)

Mandatory if:

• You are a public authority
• Your core activities require regular and systematic large-scale monitoring
• You process sensitive data at large scale (rare in B2B)

Recommended for: Any company processing > 50,000 contacts or running an international CRM.

DPO's responsibilities:

• Advise the company on its GDPR obligations
• Monitor compliance (internal audits)
• Act as the point of contact with the supervisory authority and data subjects
• Maintain the record of processing activities

Internal vs. external DPO:

• Internal: Better knowledge of processes, availability, controlled cost (if the skills exist in-house)
• External: Independence, legal expertise, shared cost (law firms, GDPR consultants)

Important: The DPO must not have a conflict of interest (avoid appointing the sales or marketing director).

GDPR governance for your CRM: roles and responsibilities

Training and awareness

80% of GDPR breaches are caused by human error (Gartner, 2024). Training your teams is essential:

Sales training program:

1. GDPR basics (2 hours): principles, individual rights, fines
2. CRM best practices (1 hour): avoid overcollecting, respect retention periods, manage opt-outs
3. Handling requests (30 minutes): internal process, deadlines, escalation
4. Validation quiz

Frequency: Initial training at hiring, an annual refresher, and an update whenever regulations change.

Resources: Quick-reference sheets, an internal FAQ, and a dedicated Slack channel for questions.

Processors and data transfers

Mandatory contract clauses

Any vendor processing data on your behalf (CRM host, email tool, data enrichment provider) is a processor under GDPR. The contract must include (Article 28):

1. Purpose and duration of the processing
2. Nature of the data and categories of data subjects
3. Processor obligations:
   • Process data only on documented instructions
   • Ensure confidentiality (team training)
   • Appropriate security measures
   • Assistance in exercising individual rights
   • Breach notification within 48 hours
   • Deletion or return of data at the end of the contract
4. Audits: the right to verify the processor's compliance
5. Sub-processing: prior written authorization

In practice: SaaS CRMs (Salesforce, HubSpot, Pipedrive) provide a standard Data Processing Agreement (DPA). Check that it contains these clauses before signing.

Transfers outside the European Union

If your CRM or a connected tool hosts data outside the EU, you need a legal transfer mechanism in place:

1. Standard Contractual Clauses (SCCs):

• A standardized model approved by the European Commission
• Commits the recipient to complying with GDPR
• Used by most US-based SaaS providers since Privacy Shield was invalidated

2. Certification (e.g., Privacy Shield 2.0, if adopted):

• Privacy Shield is currently invalid (Schrems II ruling, 2020)
• SCCs plus an assessment of local laws are the standard approach

3. Derogations (rare):

• Explicit consent from the individual for the transfer
• Necessity for the performance of a contract

High-risk countries:

• USA: surveillance laws (FISA 702, Executive Order 12333) require an impact assessment
• China, Russia: legislation incompatible with GDPR

Best practices:

• Favor EU-based hosting whenever possible
• Require a DPA with SCCs for any transfer outside the EU
• Document the risk assessment (Transfer Impact Assessment)
• Inform data subjects of the transfer and the safeguards in place

Inventory of typical CRM processors

Fines and non-compliance risks

GDPR fine amounts

GDPR provides for administrative fines of up to:

• Tier 1: 10 million euros or 2% of annual global revenue (minor violations)
• Tier 2: 20 million euros or 4% of annual global revenue (serious violations)

Whichever amount is higher applies.

Examples of CRM-related fines

Criteria for assessing the fine (Article 83):

• Severity and duration of the violation
• Whether it was intentional or negligent
• Measures taken to mitigate the damage
• Categories of data involved (sensitive data is an aggravating factor)
• Number of individuals affected
• Cooperation with the supervisory authority
• Prior violations

Other risks

Beyond fines from CNIL:

• Reputation: Public disclosure of fines, press coverage, social media
• Customer loss: 73% of European consumers refuse to buy from a non-compliant company (DLA Piper study, 2024)
• Post-fine compliance costs: audits, CRM overhaul, training, legal counsel
• Class actions: GDPR opened the door to class actions (still uncommon in France)

CRM GDPR compliance checklist

Phase 1: Audit and mapping (weeks 1 to 2)

• Full inventory of CRM data: which contact properties do you collect?
• Mapping the sources: web forms, prospecting, purchased lists, API enrichment, partners
• Identifying the purposes: prospecting, customer management, support, analytics, upselling
• Listing the recipients: internal teams, processors, partners
• List of processors: CRM, email, telephony, enrichment, analytics
• Identifying transfers outside the EU: which tools host data, and where?

Phase 2: Legal bases and record (weeks 3 to 4)

• Define the legal basis for each purpose (legitimate interest, consent, contract)
• Document the proportionality test for legitimate interest
• Create the record of processing activities with the 8 required elements
• Write or update the privacy policy (accessible from the website and forms)
• Legal notices on forms: who collects the data, why, on what basis, for how long, and what rights apply

Phase 3: Retention periods and cleanup (weeks 5 to 6)

• Define retention periods by status (prospect, lead, customer, former customer)
• Configure automatic retention rules in the CRM
• Audit the existing database: how many contacts are outdated (> 3 years)?
• Initial cleanup: delete or archive contacts past the legal retention period
• Exclusion list for opt-outs: permanently retain hashed emails

Phase 4: Individual rights (weeks 7 to 8)

• Rights request process: dedicated email, response deadline, escalation
• Identity verification procedure for sensitive requests
• Response templates for each right (access, rectification, erasure, objection)
• One-click "Unsubscribe" button in emails (compliant with CAN-SPAM and ePrivacy)
• Train the support team on handling requests

Phase 5: Security and governance (weeks 9 to 10)

• Strong authentication (MFA) to access the CRM
• Role and permission management: least privilege principle
• Data encryption in transit (TLS 1.3) and at rest
• Access and action logs (who viewed or modified which data, and when)
• Encrypted backups, tested regularly
• Data breach response procedure (notify the supervisory authority within 72 hours if there is a risk)
• Processor contracts with GDPR clauses (DPA) for every tool
• Transfers outside the EU: SCCs in place, Transfer Impact Assessment documented

Phase 6: Awareness and oversight (weeks 11 to 12)

• Appoint a DPO (internal or external) or a GDPR point person
• Train teams in sales, marketing, and support (initial training plus annual refreshers)
• Internal documentation: quick-reference sheets, FAQ, processes
• Annual review of the record and of practices
• Regular compliance audits (internal or external)

Conclusion: compliance equals competitive advantage

GDPR compliance for your CRM is not just a legal constraint: it's a lever for differentiation and sales performance.

Benefits of a compliant CRM:

• Customer trust: 67% of B2B decision makers check GDPR compliance before signing (Gartner study, 2025)
• A qualified database: regular cleanup improves conversion rates (+18% according to our diagnostics)
• Sales efficiency: fewer useless contacts means more time on real prospects
• Resilience: zero risk of fines or business suspension
• Agility: clear processes make it easy to quickly onboard new tools

At Across, we systematically include a B2B CRM audit for GDPR in our Revenue Health Score diagnostics. Across 47 diagnostics conducted in 2024-2025, 73% of companies had at least one critical risk:

• 41%: no defined retention periods
• 38%: transfers outside the EU without valid SCCs
• 29%: no process for handling rights requests
• 24%: an inappropriate legal basis (consent wrongly used for prospecting)

Our approach: Discover our methodology for bringing your CRM into compliance in 12 weeks, with technical and legal support, team training, and a 6-month follow-up audit.

Need a GDPR compliance diagnostic for your CRM? Let's talk for 30 minutes to identify your risk areas and define a pragmatic action plan.

Also worth reading:

• B2B CRM strategy: the complete guide
• CRM data quality: the hidden cost of mediocrity
• CRM governance: who really owns your data?