Operations
Part of Small business CRM operations: owned records, safe launch
Five CRM responsibilities for a small business, with decision authority attached
Five non-ranked CRM responsibilities for an England small business, with decision authority, evidence duties and independent specialist escalation.
Method: Relationship Brief translated operational responsibilities from the linked ICO, NCSC, W3C and GOV.UK records into five CRM roles.
Date: Sources were checked on 6 September 2026.
Scope: An England small business operating a customer-relationship service, with UK-wide privacy and electronic-marketing rules where applicable.
Exclusions: This review excludes staffing numbers, salaries, job status, sector-specific duties, product administration manuals and claims that a title is legally required.
Non-ranking: The entries follow a workflow, not an order of importance. There was no supplier funding, affiliate relationship, interview or hands-on system assessment.
What to take away
Five CRM responsibilities for a small business are roles, not five jobs. One person may carry several, but should not approve a risk merely because they performed the task.
- Service owner, named in the GOV.UK Service Manualapproves purpose, resources and launch, and can stop the service. Salesforce's System Administrator profile grants Modify All Data; HubSpot Super Admin controls billing and user permissions.
- Product owner, named in the Scrum Guidedefines workflow states and acceptance evidence, with HubSpot workflows and Zoho CRM Blueprint enforcing the rules.
- System administrator and security custodianmaps cloud duties rather than assuming the supplier secures everything. NCSC guidance lists 14 cloud security principles.
- Data protection officer or the controller's privacy leadreviews purpose, minimisation, transparency, retention and rights handling. ICO and PECR rules govern outreach: consent or soft opt-in, clear opt-out, accurate sender identity.
- Accessibility reviewer working to WCAG 2.2, plus the named account operator: examines critical tasks instead of inferring conformity from a badge.
For each critical activity, name the performer, approver, specialist, record recipient and stop authority.
1. Service owner (GOV.UK Service Manual): Salesforce and HubSpot admin profiles
This person approves purpose, populations, resources and launch conditions. They receive unresolved risks and can stop the service. Accountability is not handed to the supplier. Decision authority covers the purpose, the population in scope, spend, launch and the stop call.
In Salesforce, the System Administrator profile grants Modify All Data and View All Data permissions. The holder can change or export every record. In HubSpot, Super Admin controls billing, user permissions and account settings.
The GOV.UK Service Manual's service-team role description gives a government owner responsibility for operation and improvement. This is not a private-company mandate, but it supports giving one person service-wide authority while specialists keep their gates.
Evidence to retain: signed service scope, risk decisions, launch record, review dates and stop authority.
2. Product owner (Scrum Guide): HubSpot workflows and Zoho CRM Blueprint
The product owner is the role named in the Scrum Guide, accountable for the product backlog and the value it delivers. In a CRM, that stretches to states, acceptance evidence, exceptions and samples. Decision authority covers acceptance criteria, the sampling frame, and whether work is accepted or sent back.
The product owner investigates recurring defects instead of correcting records invisibly. Material risk acceptance stays with the service owner.
HubSpot workflows automate enrolment, branching and internal notifications. Zoho CRM Blueprint enforces transition rules and required fields. Salesforce Flow offers similar decision logic but needs an admin to set entry criteria.
GOV.UK's service-team guidance describes delivery, quality, security and accessibility skills across a government service lifecycle. For a private firm, it is a role-design prompt rather than a staffing rule.
Evidence to retain: workflow version, quality definitions, sampling frame, defect log and corrective-action owner.
3. System administrator and security custodian: Salesforce Shield and Dynamics 365
The administrator decides fields, permissions, integrations and releases. As security custodian, they keep privileged-access evidence and coordinate recovery. Decision authority covers configuration, access grants and release dates. The purpose for data use stays outside their remit.
Salesforce Shield adds Platform Encryption and Field Audit Trail, typically bundled in Enterprise or Unlimited editions. Microsoft's Dynamics 365 admin centre logs privileged role assignments and supports recovery testing.
The NCSC's cloud shared-responsibility guidance explains that customer and provider duties vary by cloud service. NCSC guidance also lists 14 cloud security principles. This role maps duties for the actual CRM rather than treating hosted software as supplier-secured.
Evidence to retain: access review, configuration history, supplier boundary map, test results and restoration proof.
4. Data protection officer or the controller's privacy lead: ICO, PECR and Mailchimp
A competent privacy lead reviews purpose, minimisation, transparency, retention and rights handling. They check processor arrangements too. Outreach needs PECR expertise. Decision authority covers whether a processing activity proceeds at all.
Do not assume every small firm must appoint a data protection officer.
Mailchimp and Zoho CRM list consent and GDPR tools. The privacy lead still owns the decision.
The ICO's accountability records framework calls for clear responsibility for keeping processing records aligned with actual activities. Its electronic-mail guidance provides the separate channel-specific review input. For CRM outreach, PECR requires consent or the soft opt-in, a clear opt-out in every message, and accurate sender identity. UK GDPR requires a lawful basis, transparency and records of processing.
Evidence to retain: scoped decision, source and notice versions, objection route, suppression proof and next recheck.
5. Named account operator and WCAG 2.2 accessibility reviewer: W3C WAI
The named operator accepts work, records outcomes, flags inaccuracies and escalates complaints. Acceptance, escalation and the signed record sit with them. A knowledgeable accessibility reviewer examines critical tasks rather than inferring conformity from a badge.
Salesforce Lightning and HubSpot both publish accessibility conformance reports; neither is a legal certificate. WCAG 2.2 sets the success criteria for the review.
W3C's web accessibility evaluation overview states that tools alone cannot determine accessibility and identifies the value of human expertise and user involvement. It supports a distinct evaluation responsibility, but it does not certify any CRM or decide the legal position in England.
Evidence to retain: accepted ownership, task outcome, training record, accessibility scope and findings. The remediation decision stays with the service owner.
Put the roles on one page
For each critical activity, name the performer, approver, specialist, record recipient and person able to stop work. The table below gives the default mapping for the five roles in this article.
| Role | Performer | Approver | Specialist | Record recipient | Stop authority |
|---|---|---|---|---|---|
| Service owner | Service owner | Service owner | None | Service owner | Service owner |
| Product owner | Product owner | Service owner | None | Product owner | Service owner |
| System administrator and security custodian | System administrator | Service owner | Security custodian | System administrator | Service owner |
| Data protection officer or privacy lead | Privacy lead | Privacy lead | Privacy lead | Privacy lead | Privacy lead |
| Named account operator and accessibility reviewer | Named account operator | Service owner | Accessibility reviewer | Named account operator | Service owner |
Record absence cover for every role. An English employment lawyer should review worker or contractor arrangements.
Example: a three-person England firm. Person A is service owner and product owner. Person B is system administrator and security custodian. Person C is privacy lead and named account operator. The accessibility reviewer is a contracted specialist. Service owner retains stop authority for launch and remediation. Privacy lead can stop processing. No one approves their own risk gate.
Before you act
- Name the performer, approver, specialist and record recipient for each critical activity.
- Record absence cover for every CRM role.
- Confirm ICO and PECR duties for CRM outreachconsent or soft opt-in, clear opt-out, accurate sender identity, lawful basis, transparency and records of processing.
- Map cloud shared responsibilities for your actual CRM.
- Have an English employment lawyer review worker or contractor arrangements.
- Retain evidence such as signed scope, access reviews and defect logs.
Common questions
Can one person hold more than one of these CRM roles?
Yes. Small business CRM roles are responsibilities, not five jobs. One person may carry several. They should not approve a risk merely because they performed the task. Combining jobs may be sensible, but combining away independent gates is not.
What evidence should the service owner retain?
A signed service scope, risk decisions, launch record, review dates and stop authority. The service owner approves purpose, populations, resources and launch conditions, and can stop the service.
Does the article say every small firm must appoint a data protection officer?
No. The data protection officer is the role named in UK GDPR, and not every small firm must appoint one. A competent privacy lead reviews purpose, minimisation, transparency, retention and rights handling. Outreach also needs PECR expertise. For CRM outreach, PECR requires consent or the soft opt-in, a clear opt-out in every message, and accurate sender identity.
UK GDPR requires a lawful basis, transparency and records of processing.
