UK GDPR and Your CRM: What to Build In Before You Buy
A CRM that supports UK GDPR needs five things in practice: a clear record of why each piece of personal data is held, retention rules that the system can enforce, a reliable way to find everything held about one person, marketing permissions recorded against the contact, and access limited to the people who need it. No CRM makes you compliant on its own. Compliance depends on how you configure and use it. Vivato builds bespoke and semi-bespoke CRM systems for UK organisations, and this guide explains what to specify, what to test and how the main CRM options compare.
This article is general information, not legal advice. Check your own obligations with your data protection officer, solicitor or the Information Commissioner's Office (ICO).
Why does UK GDPR matter when choosing a CRM?
A CRM is usually the largest store of personal data in a business: names, emails, phone numbers, notes, call history and sometimes sensitive context. That makes it the first place a subject access request, a complaint or a data breach will touch.
The ICO is clear that the organisation using a system remains responsible for compliance, including when it uses third-party products and processors. Buying a well-known CRM does not transfer that responsibility. What the product can do is make good practice easier or harder.
What does data protection by design mean for a CRM?
Data protection by design means considering data protection from the planning stage of a system and throughout its life, not adding it afterwards. The ICO's guidance sets out several practical measures that map directly onto CRM requirements:
- Collect only the personal data needed for each specific purpose.
- Keep an up-to-date map of the personal data you hold and use.
- Delete data you no longer need, using a retention schedule.
- Restrict access to staff who need it, and remove access promptly when people change roles or leave.
- Make privacy information easy to find, and give people ways to exercise their rights.
For a buyer, this turns into a requirements list. Our guide to CRM requirements gathering covers how to capture needs properly. Data protection belongs in that same exercise, not in a separate legal review at the end.
Which CRM features support UK GDPR?
The table below shows what to ask of any CRM, whether it is an off-the-shelf product, a configured platform or a custom build.
| Requirement | What to look for | Question to ask |
|---|---|---|
| Lawful basis and purpose | A field or log recording why a contact's data is held | Can we report on the basis for each contact group? |
| Retention | Rules to flag, archive, anonymise or delete records after a set period | Can the system apply retention automatically, including to notes and attachments? |
| Finding and exporting data | Search across contacts, activities, files and linked records | Can we produce everything held about one person within a working day? |
| Marketing permissions | Consent or opt-out status stored per contact, with date and source | Does the record show when and how permission was given? |
| Access control | Role-based permissions and an audit trail | Who can see, export or delete data, and is it logged? |
| Deletion and correction | Ability to erase or correct a person across the whole system | Does deletion reach linked tools, exports and backups? |
How should a CRM handle data retention?
UK GDPR sets no fixed retention periods. The ICO says organisations decide based on their purposes, and that data should not be kept indefinitely "just in case". Relevant factors include ongoing relationships, legal or tax requirements and possible legal claims.
The ICO also says that moving data offline is not deletion, and that deleting from a live system should cover backups. Pseudonymised data usually still counts as identifiable.
In CRM terms, that means deciding in advance:
- How long you keep contacts who never became customers.
- How long you keep lapsed customers and their activity history.
- What happens to free-text notes, emails and attachments, which are often forgotten.
- How deletion reaches backups, exports and connected systems.
Many off-the-shelf CRMs offer manual deletion and some offer automated rules, but the depth varies by plan and product. A bespoke or semi-bespoke build lets you define retention per record type and have the system enforce it. That is useful where you hold different categories of data with different justifications.
How does a CRM support subject access requests?
A subject access request (SAR) is a person's right to see the personal data you hold about them. The ICO's guidance says you must respond without undue delay and at the latest within one month of receipt. You can extend by up to two further months where a request is complex or the person has made several requests, and you must explain why within the first month. Volume alone does not make a request complex.
The Data (Use and Access) Act 2025 clarified the search effort expected. Section 78 provides that a person is only entitled to the information the controller can provide based on a reasonable and proportionate search. That helps, but you still need to be able to search properly.
The practical test for a CRM is whether you can answer: where does this person appear? Data scattered across contact records, free-text notes, email sync, spreadsheets exported by sales staff and connected tools is the usual cause of slow SAR responses. Consolidating that data is part of the case for a single source of truth, which we explore in our article on CRM and ERP integration and data ownership.
What do the marketing rules mean for CRM data?
Marketing permissions sit under the Privacy and Electronic Communications Regulations (PECR) as well as UK GDPR. The ICO's guidance says that marketing emails and texts to individuals generally need specific consent, and that sole traders and some partnerships count as individuals. Companies, limited liability partnerships and government bodies are treated as corporate subscribers, who can be emailed without individual consent. The ICO also recommends keeping a do-not-contact list and screening against it.
There is a narrow soft opt-in for your own existing customers who bought, or discussed buying, a similar product or service. It requires a clear opt-out when details are collected and in every message. It does not cover prospects or bought-in lists.
The ICO notes that its PECR guidance is under review because of the Data (Use and Access) Act, so check the current version before finalising your rules.
For the CRM, the point is simple. Store the permission status, the date and the source against each contact, and make sure an opt-out in one place stops marketing everywhere else, including any connected email tool.
Bespoke, semi-bespoke or off-the-shelf: which fits data protection best?
There is no universal answer. The right option depends on how complex your data and processes are.
| Option | Where it helps | Where it can struggle |
|---|---|---|
| Configured off-the-shelf CRM | Quick to start, built-in security and common features, vendor maintains the platform | Retention, deletion and data location options are set by the vendor and plan, and add-ons can add processors to manage |
| Semi-bespoke CRM | A proven core with rules, fields and workflows shaped to your obligations | Needs clear requirements up front and ongoing ownership |
| Bespoke CRM | Retention, permissions and audit trails built to your exact processes | Higher upfront cost and responsibility for ongoing maintenance |
| Simpler tools or spreadsheets | Low cost for very small datasets | Weak access control, version sprawl and slow SAR responses |
A configured off-the-shelf product is often the right answer for straightforward needs. Vivato recommends a custom or semi-bespoke approach when data protection requirements are unusual, for example where different record types need different retention rules, or where a CRM must connect to several internal systems. Our comparison of custom CRM versus HubSpot and Salesforce looks at this trade-off in more depth, and our UK buyer guide to bespoke CRM development cost explains what drives price.
How do you carry data protection through a CRM migration?
Migration is the moment when old, unneeded data is most easily moved by mistake. Moving everything is simple, but it carries every historic retention problem into the new system.
Before migrating, decide what should be deleted or anonymised rather than moved, and check that permission records come across intact. Our CRM data migration checklist shows how to prove that migrated data is complete and accurate, and the same checks should confirm that retention and consent fields survived the move.
What should you do first?
- List the personal data your teams currently hold and where it lives.
- Agree retention periods for each category with whoever owns data protection.
- Write the requirements above into your CRM specification.
- Test a mock subject access request and a mock deletion during any trial or pilot.
- Confirm who is responsible for reviewing permissions and access after launch.
Frequently asked questions
Does a UK-hosted CRM guarantee UK GDPR compliance?
No. Hosting location is one consideration among many. Compliance depends on your lawful basis, retention, security, transparency and how you handle people's rights. The ICO says the controller stays responsible even when using processors or third-party products.
Do we need a data protection impact assessment for a new CRM?
A DPIA is required where processing is likely to be high risk, and the ICO says doing one regardless is good practice. Your data protection officer or adviser should decide whether yours is needed.
Can we keep old customer records indefinitely?
Not as a default. The ICO says data should be kept only while a stated purpose applies, with retention reviewed regularly. Indefinite retention is allowed only in limited cases such as archiving in the public interest, research or statistics, with safeguards.
Conclusion
A CRM supports UK GDPR when retention, access, permissions and search are designed in from the start. Off-the-shelf, semi-bespoke and bespoke options can all work, and the right choice depends on how unusual your data and processes are. If you would like a second opinion on what your CRM should enforce, Vivato is happy to talk it through with no obligation. You can get in touch with our team.
