PIPELINEGuide
CRM integration and data protection: what GDPR requires
Once personal data is processed in CRM integration, clear obligations apply. What these are specifically, what is almost always missing in practice, and what actually suffices.
Once personal data is processed in CRM integration, you need a legal basis, purpose limitation, defined retention periods, notification of data subjects, and a data processing agreement with every service provider involved. In practice, the same three points are almost always missing: the retention period, the notice at the point of collection, and clarification of whether the provider uses the data for its own training.
01 — Data Protection
What GDPR requires
As soon as personal data is processed — and that happens faster than expected, for instance as soon as someone enters a name or phone number — the usual obligations apply: name the legal basis, define the purpose, maintain data minimization, define retention periods, inform data subjects.
In practical terms, this means for CRM integration: a data processing agreement with every service provider involved, checking where processing takes place, a documented retention period, and an understandable section in the privacy policy. Three things are almost always missing in practice: the defined retention period, the notice at the point where the data is collected, and clarification of whether the provider uses the data for its own training.
A data protection impact assessment is only required when there's likely high risk — not for most projects of this type. The review itself should still be documented so that if questions arise, it's clear why it was omitted.
02 — Contract
What needs to be clarified in writing
- Ownership of data and access. They belong to the client. If a provider won't clearly confirm this, that's the most important information from the conversation.
- Handover upon termination. In what format, within what timeframe, at what cost.
- No minimum term without consideration. Lock-in is justifiable if something is delivered in return — otherwise not.
- What a later change costs. The total cost isn't determined by the project price, but by the hourly rate in year three.
- Documentation as a deliverable. Not as a promise, but as a line item in the proposal.
03 — Risks
What can go wrong
- The system answers incorrectly. Containable by having it work exclusively from verified content and escalate when uncertain rather than guess. This is a configuration decision, not a property of the technology.
- The effort is underestimated. Most common reason: unclear starting situation. An honest assessment of the current state before the proposal prevents this more reliably than any buffer.
- No one maintains it. The biggest risk of all — and the most easily avoidable.
- Data protection gaps. Almost always arise from missing deletion deadlines and unclear responsibility, rarely from the technology itself.
- Vendor lock-in. Avoidable if access credentials, data, and documentation contractually remain with the client.
04 — Questions
Frequently asked questions
What does the training look like in practice?
Using your real data, not sample datasets. The team practices the workflows it needs daily and receives a brief written summary afterward as a reference.
Can we simply import existing Excel lists?
Yes, that's the standard when starting. Before import, duplicates and inconsistent spellings are cleaned up, otherwise the new system just inherits the old mess.
Is this GDPR-compliant?
With a European provider, data processing agreement, deletion concept, and documented legal basis, yes. A CRM without a deletion concept is an open issue under data protection law — that needs to be set up as well.
Which CRM is the right one?
The one your people actually use. For small businesses, a lean system that gets filled automatically is almost always better than a powerful one that stays empty. We recommend based on workflow and team size, not feature list.
How do we ensure it gets maintained?
By making as little maintenance necessary as possible. Everything that can be created automatically is created automatically. What remains manual work is reduced to what is actually needed in daily operations.
What if different departments use different systems?
Then one of them is designated as the central source, the others feed into it automatically. Maintaining two equal systems in parallel leads, experience shows, to exactly the contradictions that a CRM is supposed to resolve.
What happens to our old data?
It will be transferred, cleaned, and consolidated. Duplicates are the norm — usually the same company exists three or four times in different spellings.
05 — Next
Related pages
- CRM integration — Overview
- CRM integration — Duration
- CRM integration — team and acceptance
- CRM integration — Cost-effectiveness
- CRM integration — Costs
- CRM integration — Risks
- CRM integration — Small businesses
- CRM integration — Checklist
- Process automation
- Lead qualification
- Custom software
- All guides
CRM integration by region
Next step
Let's talk briefly about whether this makes sense for you.
A twenty-minute conversation is usually enough to clarify whether a project makes sense. If not, we'll say so — that's cheaper for both sides than an offer nobody needs.