Rules and ethics
Part of Small business CRM rules and ethics: a review framework
Small business CRM data protection: handling a rights request
Small business CRM data protection in England: a route for each rights request, from access to objection, with retention rules and tests before release.
A person's request has to reach every place that holds their record, and in a CRM that is more places than the main database. Small business CRM data protection fails quietly at this point, when a request arrives in the wrong channel or a deletion misses a copy.
The UK sources behind this page were checked on 5 September 2026. They do not decide a lawful basis, controller role or international transfer for any organisation. A named UK data-protection lawyer or suitably qualified practitioner must review the actual processing, with PECR, security and sector experts where necessary.
What to take away
- Design a route for access, correction, objection, restriction, deletion and complaint handling before the first request arrives.
- Give each route an owner and a place to log the request, the decision and the date.
- An objection to direct marketing must reach every relevant channel without deleting the evidence needed to honour the suppression.
- Retention is set per purpose, so a request finds only what each purpose still needs.
- Test every route with synthetic records and controlled failures before releasing any CRM activity.
Six requests, six routes
Each request type needs its own route, because what the CRM must do differs. The Data Protection Act 2018 operates alongside the UK GDPR throughout the UK, and the UK GDPR articles below set out the rights themselves.
| Request | UK GDPR article | What the CRM must allow |
|---|---|---|
| Access | Article 15 | Finding what the CRM and its integrations hold about the person |
| Correction | Article 16 | Changing an inaccurate field wherever it is copied |
| Deletion | Article 17 | Erasing the record, or keeping a suppression entry where one is needed |
| Restriction | Article 18 | Holding the record without further use while a dispute is settled |
| Export | Article 20 | Providing the data in a structured, commonly used, machine-readable form, where the basis is consent or contract |
| Objection | Article 21 | Stopping the processing objected to, with direct marketing treated as an absolute right |
Run each request through the same steps
A shared inbox is where requests are lost, so give the route an owner and write it into the ledger row for the purpose. Whoever opens the inbox then knows who acts.
- Log the request, the channel it arrived by and the date received.
- Confirm who is asking, where there is reasonable doubt about identity.
- Decide which purposes and systems hold the person's data.
- Act, including the supplier's copy, and record the decision and the date.
- Reply within the time limit, which Article 12 of the UK GDPR sets at one month, with provision for extension where requests are complex or numerous.
The reply should be free of charge unless the request is manifestly unfounded or excessive. A person unhappy with the outcome can complain to the ICO, so the reply should say so. Record which post-DUAA guidance version supports each decision, because the 2025 Act amended rather than replaced existing law.
Objections and suppression
An objection to direct marketing should reach every relevant channel without deleting evidence needed to honour the suppression. The ICO says that when an individual objects to direct marketing, you can place their details onto a suppression list so that you continue to comply with the objection.
Marketing consent lasts until it is withdrawn. After withdrawal the record is suppressed rather than deleted if a suppression list is needed, so the retention rule for marketing contacts and the rule for the suppression entry are two separate lines.
Do not combine sales administration, support, fraud control, analytics and direct marketing into "customer management". A person who objects to one purpose has not necessarily ended the others, so the ledger needs one row per purpose.
Retention decides what a request finds
Set retention by purpose and record class, with a legal or sector basis where longer retention is required. The UK GDPR principle behind this is storage limitation: personal data is kept in identifiable form for no longer than the purpose needs.
Typical starting points, not rules, are 12 months after last contact for a sales enquiry, 24 months after the last ticket for support records, and 6 years after the contract ends for accounting records. Each figure needs confirmation from the qualified reviewer before it goes into a ledger row.
Place privacy information where the collection occurs and retain the version supplied, so the business can show what a person was told at the time. ICO right-to-be-informed guidance distinguishes information needed for direct collection from data obtained elsewhere.
Where a supplier holds a copy
A request that stops at the CRM screen has not been answered. Where a supplier processes the data, review end-of-contract handling so a deletion request reaches the supplier's copy as well.
For access or disclosures outside the UK, use the ICO's international transfers guidance to identify whether a restricted transfer exists and which current route applies. A UK hosting label does not answer remote-access or onward-transfer questions. Current UK routes include the International Data Transfer Agreement (IDTA) and the Addendum to the EU Standard Contractual Clauses.
Test the routes before release
Test each route with role-based test accounts and synthetic records before any live record is held. Verify access, correction, export, deletion, logging, backup and restore, and keep the results beside the ledger row they prove.
Use controlled failure cases: a request that arrives in the wrong channel, an objection after a campaign is queued, and a deletion that must keep a suppression entry. A route that only works for the easy case has not passed.
Before release, the evidence owner should reconcile every approved field and integration against the data-flow row. Stop on an unknown purpose, missing rights route, unapproved recipient, failed restore or unresolved transfer. Recheck current ICO guidance and legislation when the purpose, supplier, destination or legal framework changes.
Before you act
- Create a ledger row for each CRM purpose.
- Set a retention rule per purpose and confirm it with the reviewer.
- Design routes for access, correction, objection and deletion.
- Give each route an owner and a log.
- Check that a deletion request reaches the supplier's copy.
- Reconcile approved fields and integrations before release.
Common questions
Why does retention belong to a purpose and not to the CRM?
Each purpose has its own population, lawful basis and minimum fields, so each needs its own rule. Sales enquiries, support records, accounting records and marketing contacts are kept for different reasons, and a single CRM-wide period would fit none of them.
What happens to a contact who objects to direct marketing?
The objection should reach every relevant channel without deleting the evidence needed to honour the suppression. The record is suppressed rather than deleted if a suppression list is needed.
What must be checked before releasing a CRM activity?
The evidence owner should reconcile every approved field and integration against the data-flow row. Recheck current ICO guidance and legislation when purpose, supplier, destination or legal framework changes.
