Small business CRM commercial contracts: five areas

What to take away

For small business CRM commercial contracts, five areas decide whether a contract is safe to sign: the parties and their data roles, documented instructions, sub-processors and transfers, security and incident terms, and price with exit mechanics.
A controller or processor label means nothing until you map it against the real data flow.
A certificate or security page proves little until it is matched to the exact service edition and period you are buying.
Test export, restoration and deletion with synthetic records before signature.
Score every area pass, fail, unknown or not applicable, and keep unknowns on hold.

Outcome	What it means before signature
Pass	Evidence exists and matches the service you are buying.
Fail	A term or practice contradicts your requirements. Renegotiate or walk away.
Unknown	You lack the document, screenshot or test result. Keep the contract on hold.
Not applicable	Record why, and who agreed.

1. Parties, service editions and factual data roles

Name every entity that will sign, host, support or access the service. List the edition, the buyer account and each document incorporated by reference. A proposal often describes a different package from the contract. For example, if assessing HubSpot, Salesforce, Zoho CRM or Pipedrive, identify the precise product, edition, add-ons and incorporated terms rather than assuming terms apply across every product.

Parties and data roles

Name every contracting entity and service edition
List buyer accounts and incorporated documents
Map who determines each processing purpose
Compare controller or processor labels with data flow
Record ICO guidance status under DUAA

Then map who determines each processing purpose and its means. The ICO's controller and processor contract guidance explains that the role follows the facts, not the label. The same page lists the Article 28 topics to expect. Record your answer for each purpose in the review file.

For a UK buyer, review the processing against the UK GDPR, the Data Protection Act 2018 and the Data (Use and Access) Act 2025 (DUAA), checking which provisions apply. Article 28 of the UK GDPR sets processor-contract requirements. Check whether the buyer, as controller, must pay the ICO data protection fee and appear on its register of fee payers; an exemption may apply.

For the field-level version of this mapping, read CRM data protection designed around real purposes.

2. Documented instructions and configuration evidence

Attach a schedule that states the subject matter, duration, nature, purpose, personal data types and data subject categories. Then link your instructions to configuration versions and authorised integrations, so no clause drifts from the live tenant.

Ask what the supplier may do on its own initiative, how conflicting instructions are resolved, and which artefact proves execution. A settings screenshot from your own tenant beats a promise in a policy document. Confidentiality and assistance duties belong in the same schedule.

3. Sub-processors and overseas transfer routes

List current sub-processors, their functions and their processing locations. Specify the notice period for change, your objection right and the remedy if you object. Support access and integrations matter as much as the main hosting region.

Sub-processors and transfers

List current sub-processors and functions
Record processing locations
Specify notice, objection and remedy for change
Inspect support access and integrations
Trace onward transfers beyond hosting region
Record actual transfer route and reassessment event

The ICO's international transfers hub explains the framework for restricted transfers. Identify the actual route for each country and onward access: this may rely on UK adequacy regulations or on safeguards such as the International Data Transfer Agreement (IDTA) or the International Data Transfer Addendum to the EU Commission Standard Contractual Clauses. Where you rely on those safeguards, complete and retain a Transfer Risk Assessment (TRA), using the ICO's TRA tool. Record the reassessment trigger. A generic addendum is not the analysis.

4. Security, incident notice and service evidence

Write measurable requirements instead of adjectives, covering identity, access, logging, backup, recovery and vulnerability handling. Define who decides whether an event counts as a personal data breach. Match any certificate to the service edition and the period you are buying.

The NCSC's cloud provider selection guidance separates assertions from stronger evidence. It also covers shared responsibility and contractual commitments. Treat it as a diligence framework, not proof that a supplier meets your risk appetite.

Example: a measurable incident notice term

The supplier must notify the buyer of a confirmed personal data breach within 24 hours, by email to a named contact, stating the categories and approximate number of data subjects affected.

Set that term alongside your own response steps. Decide who calls whom, and which replacement process runs if the service is unavailable. Under the UK GDPR, a controller must notify the ICO of a personal data breach without undue delay and, where feasible, within 72 hours of becoming aware of it, unless the breach is unlikely to result in a risk to people's rights and freedoms; a processor must notify its controller without undue delay. State who assesses reportability and owns each notification: the supplier's 24-hour contractual notice does not replace the controller's reporting deadline.

5. Price mechanics, renewal and a workable exit test

Record the quoted charge and charging unit, currency, VAT treatment, term, renewal process, notice method, support scope, change control and liability cap amount, including exclusions and allocation. Those commercial choices decide whether the bargain suits you. Data-protection wording cannot make that judgement. Compare the options in comparing small business CRM operating models.

A workable exit test looks like this. Before signature, put a deadline and pass criteria for each step into the contract, including supplier support and the remedy if a deadline is missed:

Agree a contractual deadline and completeness criteria, then export a full set of synthetic records, attachments, activity history, suppression lists and configuration.
Restore that export into a separate instance by the agreed deadline, then have a colleague use it for a week to confirm the records and key workflows remain usable.
Request deletion by the agreed deadline and obtain written confirmation covering backups and derived copies.
Rehearse a failed export against an agreed response deadline; record who responds, how quickly, and the remedy if the supplier misses it.

Common questions

Who decides whether the supplier is a controller or a processor?

The facts do. Compare each processing purpose with who chooses it and how it is carried out. Apply the UK GDPR's factual tests, read with the Data Protection Act 2018 and the Data (Use and Access) Act 2025 (DUAA), and check the ICO's current controller and processor guidance. A contract label alone does not settle the role.

What should I check about overseas access and transfers?

List sub-processors, functions and locations, then follow support access and onward transfers rather than only the hosting region. For each restricted transfer, identify the route, such as UK adequacy regulations or a safeguard under the IDTA or the International Data Transfer Addendum to the EU Commission Standard Contractual Clauses. Where safeguards are used, complete a TRA using the ICO's TRA tool and record the reassessment trigger.

How do I test exit before signing?

Run the four export, restore, deletion and failure steps above with synthetic data. Set a written deadline and acceptance criteria for each result: a complete export, a usable restored instance, written deletion confirmation and a documented response and remedy for a failed export. If you use a ninety-day decision window, keep it separate from those test deadlines.

Which UK guidance should I rely on?

Use the ICO for data-protection contract and transfer questions, and the NCSC for cloud security diligence. Neither endorses a named supplier, so the decision stays yours.