Laden...
Free tools
Guides
Laden...
Customer data in CRM is among the most sensitive inventory: it requires lawful processing, documented purpose limitation, consent permissions, and traceable access and change histories.
Roles and permission presets control who sees what.
The GDPR applies to personal data for every contact—leads, customers, partners. For CRM that means: each processing activity needs a lawful basis (e.g. contract, legitimate interest—always documented), purpose limitation, meaning you may process data for another purpose only where it is compatible with the original one or where consent or a legal provision covers it (Article 5 (1) (b) and Article 6 (4) GDPR). Data subjects have rights (access, erasure, rectification, portability) and you must govern retention, deletion cycles, and processors when using cloud services. Software does not replace legal advice—but it provides organisational and technical controls so your processes stay auditable.
Four building blocks appear again and again—structure them early:
Newsletters and tracking need solid evidence. Under Article 7 (1) GDPR you must be able to prove consent, and withdrawing it must be as easy as giving it (Article 7 (3)). Marketing emails additionally require prior express consent under § 7 (2) no. 2 UWG, and device tracking under § 25 (1) TDDDG.
Only collect fields such as date of birth or sensitive extras where the purpose genuinely requires them. Put lifecycles and deletion concepts in writing.
Once the purpose is fulfilled or consent is withdrawn, deletion and pseudonymisation must be ready, so no silent leftover data without a controller remains.
Status and access signals help evidencing internal controls to management, privacy roles, and inspectors.
Strong technical foundations plus integrated modules reduce ungoverned copy/paste leakage.
Tight permissions reduce off-platform spreadsheet sprawl carrying personal identifiers.
EU hosting posture and clearer data-flow transparency reduce unintended third-country transfer patterns.
CRM, delivery, timesheets, and invoices share consistent entities—fewer brittle handoffs across files.
Place CRM obligations next to contractual and finance records.
No. Tools provide rails; record-keeping of purposes, DPIAs where needed, vendor contracts for processors, and documented policies remain your responsibility. Involve a DPO or counsel for complex stacks.
Yes. Article 30 (1) GDPR obliges every controller to keep a record of processing activities. The exemption for companies with fewer than 250 employees only applies where processing poses no risk, is occasional and involves no special categories. A CRM runs continuously, so the exemption practically never applies. The CRM is typically a core entry there, with purposes, data categories, recipients and retention periods.
It depends on the lawful basis and the channel. Article 6 (1) GDPR allows contract, consent or legitimate interest after balancing. Marketing emails add § 7 (2) no. 2 UWG: nothing goes out without prior express consent, apart from the narrow existing-customer exception in § 7 (3) UWG. Define per pipeline stage what you rely on and how you prove it.
Erasure is staged: activities, quotes, and posted invoices may have longer statutory retention. cashwerk links operational and finance artefacts so policies do not silently contradict bookkeeping duties.
At minimum: a description of user roles, export rules for email tools, documented data imports from events or purchased lists, and evidence of the consent wording. You must demonstrate this to the data protection supervisory authority of your federal state (§ 40 (1) BDSG), because the accountability duty under Article 5 (2) GDPR rests with you. Extensive profiling can additionally trigger a data protection impact assessment under Article 35 GDPR.
Encryption is one of the measures Article 32 (1) GDPR names explicitly, and under Article 34 (3) (a) it can spare you from notifying data subjects after a breach if the data stays inaccessible to unauthorised parties. It does not replace clean permissioning. Anyone exporting mandatory fields as CSV to a private cloud drive defeats any encryption.
Use cashwerk’s integrated workspace to tie sales, delivery, and billing objects—foundational for purposeful processing documentation.
Open cashwerk CRM