PIPELINEGuide
Review management and data protection: what GDPR requires
As soon as review management processes personal data, clear obligations apply. What those are specifically, what's almost always missing in practice, and what actually suffices.
Once review management processes personal data, you need a legal basis, purpose limitation, defined retention periods, notification of the data subjects, and a data processing agreement with every service provider involved. In practice, the same three points are almost always missing: the retention period, the notice at the point of collection, and clarification of whether the provider uses the data for its own training.
01 — Data Protection
What GDPR requires
As soon as personal data is processed — and that happens faster than expected, for instance as soon as someone enters a name or phone number — the usual obligations apply: name the legal basis, define the purpose, maintain data minimization, define retention periods, inform data subjects.
In practical terms, this means for review management: a data processing agreement with every service provider involved, checking where data is processed, a documented retention period, and a clear section in the privacy policy. Three things are almost always missing in practice: the defined retention period, the notice at the point where data is collected, and clarification of whether the provider uses the data for its own training.
A data protection impact assessment is only required when there's likely high risk — not for most projects of this type. The review itself should still be documented so that if questions arise, it's clear why it was omitted.
02 — Contract
What needs to be clarified in writing
- Ownership of data and access. They belong to the client. If a provider won't clearly confirm this, that's the most important information from the conversation.
- Handover upon termination. In what format, within what timeframe, at what cost.
- No minimum term without consideration. Lock-in is justifiable if something is delivered in return — otherwise not.
- What a later change costs. The total cost isn't determined by the project price, but by the hourly rate in year three.
- Documentation as a deliverable. Not as a promise, but as a line item in the proposal.
03 — Risks
What can go wrong
- The system answers incorrectly. Containable by having it work exclusively from verified content and escalate when uncertain rather than guess. This is a configuration decision, not a property of the technology.
- The effort is underestimated. Most common reason: unclear starting situation. An honest assessment of the current state before the proposal prevents this more reliably than any buffer.
- No one maintains it. The biggest risk of all — and the most easily avoidable.
- Data protection gaps. Almost always arise from missing deletion deadlines and unclear responsibility, rarely from the technology itself.
- Vendor lock-in. Avoidable if access credentials, data, and documentation contractually remain with the client.
04 — Questions
Frequently asked questions
What if a customer deletes the review later?
That's decided exclusively by the person who left the review — you can ask, but you can't force it. A professional, public response is often more effective than attempting to achieve deletion.
How many reviews do we need?
More important than the number is regularity. A business with 40 reviews, five of them from recent months, appears livelier than one with 200 that are all three years old.
What to do about an unjustified review?
Respond professionally and, if there's a policy violation, report it. Don't: justify, argue, or publicly disclose details of the case — the latter can become tricky under data protection law.
How is that different from a simple review link in the signature?
A link alone is rarely clicked because no one is actively reminded. The automatic prompt at the right time makes the actual difference in response rate.
Is it allowed to actively ask for reviews?
Yes, as long as you ask all customers equally and offer no consideration in return. What's not allowed is selectively asking only satisfied customers or compensating for reviews. The workflow we build asks everyone.
What does a bad review really cost us?
Less than its absence. A business with no negative reviews at all appears implausible to many people; what matters is the professional response to it, not its absence.
Does this also work for multiple locations at once?
Yes, each location gets its own workflow and its own profile. The evaluation can still be consolidated in one place so you can compare locations.
05 — Next
Related pages
- Review management — Overview
- Review management — Duration
- Review management — Implementation
- Review management — Provider comparison
- Review management — Funding
- Review Management — Practical Examples
- Review management — Do it yourself
- Review management — Measuring success
- Google Business Profile
- Local SEO
- Customer support automation
- All guides
Review management by region
Next step
We'll look at your starting position.
Tell us what's eating up time today. That becomes an assessment with effort and benefit — and only then an offer.