GDPR and Customer Chats in Your CRM

A WhatsApp thread, a call recording, a rep's note saying "customer annoyed, call back Wednesday" — all of it is personal data under GDPR, and all of it sits in your CRM. Here is what is worth checking in your own system, in plain language.

This is not legal advice. We are integrators, not lawyers: what follows is how the technical side is usually arranged. Policy wording and risk assessment belong with a lawyer practising in your jurisdiction.

A lawful basis, not "consent to everything"

The most common mistake is assuming a single "I agree to data processing" checkbox covers you. Processing needs a lawful basis, and different data needs different ones.

Messaging about a specific order usually rests on performance of a contract or on legitimate interest. Sending that same customer a promotion is a different matter, and there consent must be separate and withdrawable.

The practical consequence for a CRM: the marketing opt-in has to be its own field, not part of a blanket agreement on the contact form.

Retention periods

GDPR does not name specific periods, but it does require that a period exists and can be justified. "We keep everything forever in case it is useful" is not a justification.

What CRMs usually do: a last-contact date field plus a rule under which records with no activity beyond a set period are anonymised or deleted. Without such a rule the database grows without limit, and when a customer asks, you physically do not know where all their data lives.

Call recording

Calls can be recorded, but the other party must be told before recording starts, and the notice has to be audible. A single announcement at the start of the call, configured at the telephony layer, is the workable solution.

Keeping recordings indefinitely is the same problem as keeping records indefinitely. Automatic deletion by age is the usual answer.

Rights you will have to honour by hand

• Access. A customer may ask for a copy of their data. That means you must be able to assemble all of it: the record, the messages, the call recordings, the notes.
• Erasure. Not always absolute: what accounting law requires you to keep, you keep. But everything held "just in case" has to go.
• Rectification and objection. Technically easy when data sits in one place, and close to impossible when conversations live on reps' phones.

This is where the practical argument for the official API rather than personal handsets appears: while message history sits on an employee's device, you cannot service a customer request properly.

What to check in your CRM today

• Is there a marketing consent field separate from consent to handle the enquiry.
• Do you know where the data physically resides, inside the EU or outside.
• Do you have a deletion rule and somebody who actually runs it.
• Does the caller hear the recording notice.
• Could you assemble everything about one person in reasonable time.

If two of these get a "not sure", that is your task list for the coming week.

Where the data physically lives

A question easy to miss with cloud services: the CRM itself may be European while the mailing tool, the analytics or the call transcription service is not.

Transferring personal data outside the EU is not forbidden, but it needs a basis. In practice that means the vendor should have standard contractual clauses in place, or operate in a country with a recognised adequacy decision. You verify this in documents, not on a page with icons: the DPA, the sub-processor annex, the security page.

What to write into a table for every service that touches customer data:

• where the data is stored (data-centre region);
• whether a signed DPA exists;
• who the vendor's sub-processors are and where they sit;
• how long backups are retained.

A line of its own goes to AI services. If your assistant parses conversations through an external model, personal data goes there too, and that is processing with its own basis and its own vendor. This is usually the last thing anyone remembers.

A ten-row table answers most of what gets asked during a review, and you build it once.

This material is general in nature and does not replace advice from a qualified lawyer.