CRM & sales

GDPR-compliant CRM for small businesses: storing leads legally

What makes a CRM setup GDPR-compliant: data location, the processing agreement, US transfers, and practical retention rules for the leads you store.

October 21, 20266 min read

No CRM is GDPR-compliant on its own. The GDPR applies to you, the business that decides why and how lead data is used. The CRM vendor processes that data on your behalf. A compliant setup therefore has two halves: a vendor that gives you the right contract and clear answers on where data is stored, and a configuration on your side that collects only what you need, records why you hold it, deletes it on schedule and lets you answer people's requests. Pick the vendor with the first half in mind, then spend most of your effort on the second.

Who is responsible for what

Under the GDPR, your business is the controller: you decide the purpose of storing a lead and what happens to it. The CRM company is a processor: it stores and processes the data on your instructions.

Article 28 says a controller may only use processors that provide sufficient guarantees, and that the relationship must be governed by a binding contract. That contract is usually called a data processing agreement (DPA). Every serious CRM vendor publishes one. Your job is to make sure it exists, that it applies to your account, and that it covers what the law requires.

What the DPA has to cover

Article 28(3) lists what the contract must require of the processor. In plain terms, the vendor must:

process data only on your documented instructions, including for transfers outside the EU
make sure its staff are bound by confidentiality
apply appropriate security measures
follow agreed conditions before using sub-processors
help you respond to people exercising their rights
help you with security, breach notification and impact assessments
delete or return the data when the contract ends, at your choice
give you the information needed to show compliance, and allow audits

If a vendor can't show you a DPA covering these points, choose another vendor.

Comparing CRMs by data location

Where the data sits matters because transfers outside the European Economic Area need a legal mechanism. Here is what two widely used CRMs say publicly, as of October 2026.

	HubSpot	Pipedrive
EU hosting available	Yes, an EU data centre	Yes, AWS regions in Frankfurt and Dublin
How the region is chosen	New paid customers are assigned by IP location at sign-up; free-only accounts are assigned to the US	New EU sign-ups are generally placed in EU data centres
Moving later	Existing paid customers can migrate in account settings at no charge	Contact support to confirm where your company's data is hosted
Where to check	Account Defaults, Data Hosting	Ask support

Two details catch small businesses out:

A free HubSpot account is hosted in the US, according to HubSpot's own data-centre page. If EU hosting matters to you, start on a paid plan or plan a migration.
Pipedrive's placement is based partly on IP mapping, so an account created while travelling or behind a VPN can land in another region. Confirm with support rather than assuming.

EU hosting doesn't mean that no data ever leaves the EU. Support teams, sub-processors and integrations can sit elsewhere. Read the vendor's sub-processor list and note any processing outside the EEA.

If your CRM is hosted in the US

US hosting is not illegal under the GDPR. Transfers to US companies can rely on the EU-US Data Privacy Framework, which the European Commission recognised as adequate on 10 July 2023, for companies that participate in it. Otherwise they rely on standard contractual clauses in the DPA.

The framework has been challenged. On 3 September 2025, the EU General Court dismissed the Latombe challenge and upheld the adequacy decision. An appeal to the Court of Justice was filed on 31 October 2025, so the question isn't fully settled. Lawyers advise keeping a fallback: check that your vendor's DPA also includes standard contractual clauses, so your transfers remain covered if the framework falls.

A simple decision rule

You handle ordinary B2B or consumer leads: an EU-hosted region is the simplest choice, and a US-hosted tool with a proper DPA and transfer mechanism is still workable.
You handle sensitive data (health, children, finances) or your clients demand EU-only hosting in their contracts: choose EU hosting, review sub-processors closely, and get legal advice.

Set-up rules for storing leads legally

The vendor is the easy part. Most GDPR problems in a CRM come from how it's configured and used.

Collect less

Article 5 requires data to be "adequate, relevant and limited to what is necessary" for the purpose. A quote form needs a name, a way to reply and a description of the job. Date of birth, home address for a B2B enquiry, or a free-text "anything else about you" field add risk without adding sales.

Record why you hold each lead

Add two fields to every contact:

Source: the form, ad, event or referral the lead came from.
Legal basis and date: for example, "pre-contract request, form, 2026-10-14" or "marketing consent, checkbox, 2026-10-14".

A person who asks for a quote can be contacted about that quote. Sending them your newsletter is a different purpose, and usually needs its own consent under national e-marketing rules. Keep the two separate in the CRM, for example with a marketing consent field that defaults to "no".

Set retention periods and automate them

Article 5 also says personal data must be kept "for no longer than is necessary" for the purposes it was collected for. The GDPR doesn't give a number of months. You set it, document your reasoning, and apply it.

A practical starting point for a small business:

Contact type	Example retention rule	What happens after
Lead that never replied	6 to 12 months after the last contact	Delete or anonymise
Lead that received a quote and declined	12 to 24 months after the quote	Delete or anonymise
Customer	As long as the relationship lasts, plus your legal accounting and tax period	Keep invoices as required; delete marketing data
Person who objected to marketing	Keep a minimal suppression record	Never market to them again

These periods are examples, not legal advice. Your sector and country may set specific rules, especially for invoices and contracts. What regulators look for is a defined period, a reason for it, and evidence that you apply it.

Most CRMs can run this automatically: a workflow that flags contacts with no activity for a set period, then deletes them or strips personal fields after a review. Set it up once and check it quarterly.

Handle objections and deletions properly

Under Article 21, a person can object to direct marketing at any time, and once they do, their data can no longer be used for that purpose. In the CRM:

add an "objected to marketing" status that removes the contact from every email and text list
keep the minimum needed (an email address in a suppression list) so they aren't re-imported from a later list
when someone asks for deletion, check every place their data sits: CRM, email tool, spreadsheets, shared inboxes

Write a short internal procedure for access and deletion requests, and name the person who handles them.

Keep a record of processing

The EDPB's guide for small businesses explains that records of processing should describe each activity: its purpose, the categories of data, recipients, any transfers outside the EEA, the storage period where possible, and the general security measures. Organisations with fewer than 250 employees are exempt only for purely occasional processing. A CRM full of leads is not occasional, so document it. One page per activity is enough.

Limit access

Give each user the access they need. Sales staff rarely need to export the full database. Turn on two-factor authentication, remove former employees on their last day, and review integrations that can read your contacts.

A pre-launch checklist

The vendor's DPA is accepted for your account and covers the Article 28 points.
You know your hosting region and have confirmed it in the account or with support.
You've read the sub-processor list and noted any non-EEA processing.
For US hosting, you've identified the transfer mechanism (Data Privacy Framework participation and standard contractual clauses).
Forms collect only necessary fields, with marketing consent separate and unticked.
Every contact has a source and a legal basis.
Retention rules are written down and automated.
There's a suppression list and a procedure for access and deletion requests.
Your record of processing includes the CRM.

How PNE fits in

Our sales automation and CRM service builds the pipeline, the forms and the automated follow-up, and for European clients we configure the parts above: hosting region, consent fields, retention workflows and suppression lists. We're not a law firm, so for sensitive data or unusual cases we work alongside your legal adviser. The goal is a CRM your team actually uses, and one you can explain to a regulator.