A practical GDPR checklist for your CRM

Author: Ofer · Updated 30 Sep 2026 · 5 min read

This is a practical overview, not legal advice. For your specific situation, ask a data protection specialist.

10 steps

1. Know your legal basis for each contact — a contract, consent, or legitimate interest.
2. Record the source of every contact: website form, trade fair, referral, import.
3. Collect only what you need. A field nobody uses is a risk, not an asset.
4. Limit access. Give each user only the permissions they need.
5. Set a retention rule — for example, delete inactive leads after 24 months.
6. Keep marketing consent separate from customer data, and honour unsubscribes.
7. Sign a Data Processing Agreement with every provider or consultant who accesses your CRM.
8. Check international transfers when tools or people outside the EU access the data.
9. Prepare for requests. Know how to export or delete one person's data within the legal deadline.
10. Update your privacy policy so it matches what you actually do.

Why a CRM helps

When customer data lives in ten spreadsheets and five phones, you cannot answer "what do you hold about me?" A single CRM makes access, correction and deletion a few clicks instead of a week of searching.

Sources

• GDPR Article 6 — Lawfulness of processing
• GDPR Article 17 — Right to erasure
• GDPR Article 28 — Processor

Ofer, founder of GrowFlow. 20+ years in information systems and CRM, Salesforce Agentblazer Champion.