Small business CRM rules and ethics: a review framework

CRM software does not make a business compliant. Small business CRM rules and ethics have to be translated into decisions made by people: why a record exists, who may see it, whether a message is promotional, what evidence supports an advert, and what happens when a customer objects. A small firm in England needs separate controls for each decision.

This is general information, not the position for a particular business. UK data law and electronic-marketing rules apply across the UK.

The Equality Act 2010 framework discussed here covers Great Britain, so England, but not Northern Ireland. The CAP Code is the UK non-broadcast advertising code. Consumer rules apply when a firm acts towards consumers, not just because a contact sits in a CRM.

What to take away

CRM compliance requires separate controls for privacy, marketing, advertising, accessibility, security and contracts.
The Data (Use and Access) Act 2025 did not replace the UK GDPR, the Data Protection Act 2018 or PECR.
Direct marketing needs its own PECR analysis, separate from UK GDPR, based on subscriber class and route.
Advertising claims need documentary evidence before publication, not just a CRM segment.
Passing one compliance gate cannot offset failure in another gate.

Start with the activity, not the software

Make an inventory of relationship activities. A useful row describes one event: collecting an enquiry, recording a purchase, handling a complaint, sending requested information, conducting genuine research or issuing direct marketing. Add the people affected, data fields, source, purpose, channel, recipient category, owner, retention rule, supplier and destination country.

Do not assign one blanket label such as "customer communication". A service update can have a different purpose and rule set from a sales offer, even when both use the same address. A preference field is evidence to interpret, not an automatic legal answer.

For each row, ask five questions:

Start with the activity

Which rule or code is engaged, and what is its territorial reach?
What fact makes it relevant, such as personal data, direct marketing or a consumer transaction?
Who is responsible for the decision and the evidence?
Which system action follows, and which actions remain blocked?
What change or incident forces a fresh review?

Record the current legal baseline

The Data (Use and Access) Act 2025 changed several data and electronic-communications provisions. It did not replace the UK GDPR, the Data Protection Act 2018 or PECR. The Act as enacted remains the primary statutory record.

Not every older guidance page has been fully revised. Some ICO pages used below are marked under review because of the DUAA. Record the page version and warning, apply the enacted law, and obtain advice on any gap. Draft consultation material is not a settled rule.

Gate	Main source status	Trigger in CRM work	Required record
privacy and UK GDPR	legislation plus current ICO guidance	identifiable customer, prospect, worker or contact data	purpose, lawful basis, fields, rights, retention and owner
PECR and direct marketing	PECR as amended plus ICO guidance	calls, email, text or similar promotional messages	purpose, channel, subscriber class, source, permission analysis and suppression
advertising and consumer	CAP Code and DMCC Act consumer provisions	claims or commercial practices affecting consumers	evidence file, audience, qualification, approval and expiry
accessibility and equality	Equality Act 2010 in Great Britain plus EHRC code	customer or worker encounters a barrier	task test, adjustment route, owner and evidence
security	UK GDPR security requirements plus NCSC guidance	personal data or a service dependency	risk assessment, access, recovery, testing and incident route
contract and transfer	role-specific UK GDPR terms and transfer rules	supplier processes data or data goes to a separate overseas organisation	parties, roles, instructions, sub-processors, safeguard, exit and review

These gates are non-compensating: passing one row cannot offset failure in another. Valid electronic-marketing permission does not substantiate an advertising claim. A processor contract does not establish accessibility. A security certification does not decide whether collection was lawful.

Add a CRM-specific ethics gate

Legal compliance is a floor, not an ethical sign-off. Apply a separate ethics gate using fairness, transparency, accountability, respect for privacy and autonomy, and proportionality. Record the principles considered, who is affected, the evidence, the decision owner, mitigations and unresolved concerns in the release ledger.

Inspect the actual CRM configuration, not just the supplier’s claims: segmentation and profiling, customer scoring, automated decisions and workflows, AI-generated recommendations or messages, preference controls, suppression handling, access controls and employee monitoring. Ask whether each use is necessary and proportionate, whether customers can understand and challenge consequential outcomes, and whether staff monitoring is transparent and limited.

Look for dark patterns such as confusing preference controls or obstructive opt-outs, and consider whether targeting could exploit vulnerable customers or pressure them into choices. Before release, assess the customer journey from their perspective and provide clear ways to correct data, opt out or seek human review. Escalate uses that could produce discriminatory outcomes or significant effects, even when the legal gates appear to pass.

Decide the privacy purpose and role

The Data Protection Act 2018 sits alongside the UK GDPR. For each CRM purpose, identify the actual controller and any processor from what they decide and do. A supplier calling itself a processor is not decisive if its real activity differs.

State the UK GDPR lawful basis before collection or reuse. If special-category or criminal-offence information is involved, the Article 6 analysis is not enough; qualified reviewers must identify any additional condition and sector restriction. Collect only fields needed for the stated purpose, set role-based access, correct inaccurate records and define retention by record type.

The ICO's data protection by design guidance supports making these decisions at the start and throughout the lifecycle. A data protection impact assessment may be mandatory where proposed processing is likely to result in high risk. The ICO's DPIA guidance is marked under review following the DUAA, so a reviewer should check the current statutory test and guidance before launch.

Small size alone does not settle these duties. Check the ICO’s data protection fee self-assessment: controllers must pay the fee unless an exemption applies, and the ICO maintains a public register of fee payers. A firm is not automatically required to appoint a data protection officer; one is required where the firm is a public authority, or its core activities involve regular and systematic monitoring of people on a large scale, or large-scale processing of special-category or criminal-offence data. Record-keeping exemptions for smaller organisations are limited, so check their conditions rather than assuming size removes the obligation. If no data protection officer is required, assign an accountable person to oversee records, risks and review dates.

Transparency is its own control. The ICO's privacy information guidance lists information that may need to be given when data is collected directly or obtained elsewhere. Put the correct notice at the collection point and keep the version shown. A link hidden in general terms may not explain a new purpose.

Separate direct marketing from other contact

The Privacy and Electronic Communications Regulations 2003 contain rules for electronic and telephone marketing. The ICO's electronic-mail guidance explains that subscriber category and the route used matter, and reflects the DUAA changes, including a distinct charitable-purpose soft opt-in.

Do not transpose the charity provision to an ordinary commercial business; the products-and-services soft opt-in has cumulative conditions. Vendor claims that a purchased list is compliant do not prove those conditions or valid consent.

Record the source, wording, date, organisation named and channel, and log each objection. Suppression data should stop further prohibited use, without quietly reviving the marketing record after an import.

UK GDPR and PECR analyses remain separate. Direct marketing may be capable of being a legitimate interest in some circumstances, but that does not remove PECR requirements for the chosen channel. Requested information, genuine research and operational service contact should also be classified by their actual content rather than their CRM campaign name.

Hold evidence before advertising

CRM segments can target an advert, but segmentation does not prove the claim. CAP Code Section 2 requires marketing communications to be recognisable as such. Section 3 covers misleading advertising and requires documentary evidence for objective claims before publication.

Keep a claim register with exact wording, audience, media and evidence owner. You should also record source period, material qualifications, approver and expiry.

Reviews, testimonials, endorsements and affiliate relationships need evidence and disclosure. The CMA's unfair commercial practices guidance explains consumer provisions in Chapter 1 of Part 4 of the Digital Markets, Competition and Consumers Act 2024, applying to practices from 6 April 2025. It also explains the guidance is not a definitive interpretation of the law.

If the offer concerns a regulated product, such as financial services or medicines, send it to the relevant sector reviewer before any audience is selected. The general CAP and consumer checks do not displace sector-specific promotion rules.

Test accessibility and security independently

A customer may face a barrier in a form, portal, email or complaint route. Section 29 of the Equality Act 2010 covers services and the duty to make reasonable adjustments. The Act's Great Britain scope includes England but not Northern Ireland.

Test the real task with disabled users and relevant assistive technology under an approved research process, because a template or supplier statement is not proof that the delivered journey is accessible.

Security decisions depend on the data and harm that could follow. The ICO's data security guide covers risk-based technical and organisational measures, confidentiality, integrity, availability and restoration. It is marked under review following the DUAA. Record the assessed risk, access design, logging, backup, restore test, supplier evidence and remediation owner rather than writing "industry-standard security".

If an incident involves personal data, route it through a breach assessment. The ICO's personal data breach guide explains when notification may be required and the applicable timing. Do not put an automatic regulator notification into CRM logic without the legal assessment of the actual breach.

Contract for the real data flow

Map parties, roles, services, data categories, locations, sub-processors and integrations before reading the template agreement. The ICO's controller and processor contract guidance covers Article 28 terms and end-of-contract matters, but is also under review after the DUAA.

A contract review should cover documented instructions, confidentiality, security, assistance with rights and incidents, sub-processor change, audits, return or deletion, term, renewal, price mechanics, service support, liability, export and transition. Commercial acceptability and data-protection sufficiency are different judgements.

Remote access or onward disclosure can engage the UK international-transfer rules even when a dashboard says data is hosted in the UK. The ICO's international transfers hub reflects the amended terminology and links to current adequacy, safeguard and data-protection-test material. Record the actual transfer, recipient, mechanism, scope and reassessment trigger.

Keep finance, tax and sector questions visible

CRM records feed invoices, tax records, credit decisions, medical services or regulated promotions. Do not let a privacy approval answer a separate retention, accounting, tax or professional-duty question.

For tax records use the applicable HMRC source and a qualified adviser; for regulated communications, the competent regulator and an authorised reviewer. Write the legal reason beside each retention schedule rather than keeping all records "just in case".

Operate a release ledger

Before a workflow goes live, the accountable owner should see one ledger containing each legal and ethics gate, reviewer, evidence, status, expiry and unresolved issue. Statuses should be pass, fail, not applicable with reason, or unknown. Unknown is not pass; a legal pass is not an ethical sign-off.

Reopen the ledger after a new purpose, channel, recipient class, automated decision or data field; new supplier, sub-processor, destination, claim or price presentation; or new complaint pattern or incident. On publication recheck commencement orders, regulator updates, CAP sections, sector rules.

Map one real CRM journey and refuse release until every engaged gate has a named owner and current evidence.

Before you act

Inventory each relationship activity as a separate row with its own rule set.
Identify the actual controller and processor from what they decide and do.
State the UK GDPR lawful basis before collecting or reusing personal data.
Classify messages by actual content, not by CRM campaign name.
Keep a claim register with evidence before publishing any advert.
Record page versions and warnings for guidance marked under review.
Apply a separate ethics gate covering fairness, transparency, accountability, privacy, autonomy and proportionality.
Review profiling, automated decisions, AI, dark patterns, vulnerable customers and employee monitoring before release.

Common questions

Does the Data (Use and Access) Act 2025 replace the UK GDPR?

No. The Act changed several data and electronic-communications provisions but did not replace the UK GDPR, the Data Protection Act 2018 or PECR. The Act as enacted remains the primary statutory record.

Can a purchased marketing list be used if the vendor says it is compliant?

No. A purchased list described by its vendor as compliant does not prove the cumulative conditions for the products-and-services soft opt-in or valid consent. You must record the source, wording, date, organisation named, channel and each objection. Suppression data should prevent further prohibited use without reviving the marketing record after an import.

What evidence is needed before making an objective advertising claim?

CAP Code Section 3 requires documentary evidence for objective claims before publication. Keep a claim register with the exact wording, audience, media, evidence owner, source period, material qualifications, approver and expiry. Reviews, testimonials, endorsements and affiliate relationships need their own evidence and disclosure.