CRM software: UK GDPR consent and marketing automation

What to take away

What carries over to any small business CRM

The London detail in this guide is a worked example, not a boundary. If you run a small business anywhere in the UK, the same brief applies: name the pipeline stages you actually use, and record consent per contact before you sign anything.

The tests here are the ones a small business CRM has to pass at any size: per-contact consent records, send-time suppression and a documented export. The agency material shows how those tests look in practice, and the checklist is the part you reuse.

This site is about CRM software for small businesses, so start with the small business decision. The London startup and agency examples show one path through it: write a one-page brief, record consent per contact, suppress at send time, test on a live workflow, and agree export terms before you import.

If you run a shop, clinic, trade business or consultancy, use the consent, automation and migration sections as your main route. The London pricing and agency scenarios are extra detail when they match your size.

A small business CRM brief, written before any demo

Most small business CRM purchases fail at the brief, not the demo. A Shoreditch agency with six staff and forty retainer clients will be sold the same platform as a bank, then pay for seats nobody opens.

Write the brief first. One page. It should name the pipeline stages you actually use, the inboxes that must connect, and the person who owns data protection.

Start with the commercial facts. How many contacts exist today, how many will exist in twelve months, and who pays for the licences when headcount doubles.

Then the compliance facts. Which lawful basis covers your newsletter (consent or soft opt-in), which covers client project updates (contract or legitimate interests), and where consent is stored if someone withdraws it.

Client work adds pressure here. Clients in financial services and health expect your business to handle personal data properly, and procurement questionnaires now ask for your retention schedule.

If you are registering the company or updating filings, Companies House and HMRC set out the incorporation, tax registration and record-keeping duties. CRM data sits inside that same record-keeping duty.

Keep the brief testable. "Good reporting" is not a requirement. "Export a client's project history as CSV in under two minutes" is.

GDPR-compliant consent management for a small business CRM

Consent is a record, not a checkbox. Under UK GDPR you must show what a person agreed to, when, and how they gave it. A CRM that stores only an email address cannot do that.

For a small business, consent usually splits three ways. Marketing emails to prospects, service updates to clients, and any tracking you run on your own website.

Most controllers must pay the ICO data protection fee and appear on the ICO register unless an exemption applies. Check that before you rely on the CRM to hold personal data.

The ICO's Direct marketing guidance sets out how consent and soft opt-in interact for CRM-driven campaigns. Read it before you configure a single automation.

Withdrawal must be as easy as giving consent. A one-click unsubscribe that updates the contact record automatically, not a manual list you maintain in a spreadsheet.

Consent also expires in practice. A prospect who opted in three years ago and never engaged is a deliverability and compliance risk. Build a re-permission step into the automation.

Treat your buyer assumptions the same way: as versioned hypotheses with expiry, revisited when the data contradicts them.

Marketing automation rules under PECR and ICO guidance

PECR governs the electronic channels: email, SMS, and some calls. UK GDPR governs the personal data behind them. You need both, and your CRM touches both.

For email sequences, work through the ICO's Direct marketing guidance before you build the automation, whether it runs inside the CRM or in a connected tool such as Mailchimp.

Three practical rules for a small business.

Cookies and tracking pixels are a separate regime. PECR regulation 6 requires consent for storing or accessing information on a visitor's device, except for strictly necessary cookies. The ICO's Guidance on the use of storage and access technologies explains what must wait for consent, and a cookie banner must offer a real choice.

This matters if your CRM embeds website tracking. A form that drops a cookie before consent is a problem you inherit, not the visitor's.

Test the flow before launch: submit a form, withdraw consent, then check whether the automation still fires. It usually does.

Selecting CRM software for a small business team

Budget in a city is not the same as budget elsewhere. A two-person startup in Camden and a twenty-person agency in Farringdon face different seat costs and different expectations from clients.

Price per seat hides the hidden costs. Add onboarding, data migration, premium automation tiers, and the cost of the person who administers it.

Use criteria you can score. Examples of CRM software to test against this frame include HubSpot CRM, Zoho CRM, Pipedrive, Capsule CRM and Freshsales. Here is a shortlist frame that works for most small business teams:

Score each vendor out of five and weight consent and exit highest. Features change; contracts bind.

Before committing, spend a week testing one real workflow first with a live client project rather than demo data.

Ask each vendor for a data processing agreement and a sub-processor list. If they hesitate, that answers the question.

Onboarding, data migration and the client list

Migration is where small business CRM projects quietly fail. Your client list is not a spreadsheet of names; it is contracts, threads, invoices and years of context.

Clean before you import. Duplicate contacts, dead domains and role addresses will break automations later, and fixing them after go-live costs more.

Agree the fields first. Contact, company, consent status, consent source, owner, and last contact date. Anything else can wait for phase two.

Run the import into a sandbox, check a random sample of fifty records against the source, then import for real. Keep the source file archived.

Decide what you will not migrate. Old campaign lists without consent evidence should be left behind, not carried across as a liability.

Set an internal owner for data quality. One person, named in the brief, reviewing duplicates and consent gaps monthly.

Use a checklist before go-live:

That list overlaps with the wider PECR, accessibility, migration and exit checks worth running on any shortlisted platform.

A worked example: one London agency, one CRM decision

A ten-person digital agency in Clerkenwell, working with retail and hospitality clients, ran this process in six weeks.

Their problem was not lead volume. It was that three people held client relationships in personal inboxes, and nobody could prove where marketing consent came from.

They wrote a one-page brief. Pipeline: enquiry, proposal, retainer, paused. Channels: email and SMS. Compliance owner: the operations lead.

They compared CRM software against the brief, checking UK data storage, per-contact consent fields and send-time suppression. Two options failed the send-time suppression test without a paid tier; one passed and went to the live test.

They scored consent records and exit terms highest, then ran a live retainer project through the winner for a week. Two automations failed the withdrawal test and were rebuilt.

Migration covered 4,200 contacts. Roughly 900 were dropped because no consent evidence existed. The rest came across with source and timestamp intact.

Cost landed above the headline seat price once onboarding and the automation tier were added. The agency accepted that, because the alternative was a compliance gap it could not evidence to a client.

Six months on, the measurable change was simpler than expected. Every client question about data now has an answer in the CRM.

Common questions