Guide
CRM and GDPR: what a UK small business needs to know
Keeping the names, emails and phone numbers of the people you work with is normal and lawful. Doing it carefully is mostly common sense, written down.
30-day free trial · no card · £12.99 + VAT per person a month after
The short answer
Under UK GDPR you can keep business contacts in a CRM, usually on the basis of legitimate interests, as long as you only hold what you need, keep it accurate and secure, delete it when you no longer need it, and tell people how you use it. You are the controller of that data; your CRM provider is a processor acting on your instructions.
Last checked 27 October 2026
This is general information for UK small businesses, not legal advice. For your own situation, read the ICO’s guidance at ico.org.uk or speak to a data protection adviser.
Your lawful basis: usually legitimate interests
UK GDPR says you need a lawful basis for processing personal data. For keeping the contact details of clients and the people you deal with at them, the usual basis is legitimate interests: you have a genuine business reason, the processing is necessary for it, and it does not override the person’s own interests.
Where you are delivering a service under a contract with someone, contract may also apply.
The ICO suggests recording a short legitimate interests assessment: why you need the data, why a CRM is a reasonable way to hold it, and why people would expect it. For client contacts this is usually a few lines.
The principles, applied to a CRM
Only what you need
Name, job title, work email and phone are normally enough. Do not add home addresses, birthdays or personal notes unless there is a real business reason.
Keep it accurate
Update details when people move on. A CRM that the whole team uses tends to stay more accurate than scattered spreadsheets.
Do not keep it forever
Decide how long you keep contacts after a client relationship ends, write it down, and stick to it.
Keep it secure
Use logins for each person, limit who can do what, and keep files out of public links and personal inboxes.
Be open about it
Your privacy notice should say what you collect, why, how long you keep it and who your processors are.
Controller and processor
| You (the business) | Your CRM provider | |
|---|---|---|
| Role under UK GDPR | Controller: you decide what data to hold and why | Processor: holds and processes it on your instructions |
| Responsible for | Lawful basis, privacy notice, retention, answering requests | Security, confidentiality, only acting on your instructions |
| Needs | A written contract with the processor | Terms that cover the processing (UK GDPR Article 28) |
Gather360 acts as processor for the client data you add, under our terms and privacy policy. Data is hosted in the UK.
Subject access and deletion requests
Anyone can ask what personal data you hold about them (a subject access request). You normally have one month to respond. Search your CRM for their name and email, and include notes that mention them.
People can also ask you to correct or delete their data. If you have no continuing reason to keep it, delete it from the CRM and anywhere else you hold it.
The ICO’s guidance covers the details, including when you can extend the deadline or refuse a request.
Marketing emails are a separate question
Keeping a contact in your CRM is one thing. Sending them marketing emails is covered by a different law, PECR (the Privacy and Electronic Communications Regulations).
In short: business-to-business emails to people at limited companies and other corporate bodies are generally allowed if you offer an easy way to opt out. Sole traders and some partnerships are treated like individuals, so you usually need their consent or an existing customer relationship. Check the ICO’s PECR guidance before you send a campaign.
Gather360 does not send marketing emails, so this applies to whatever email tool you use.
Do you need to pay the ICO?
Most organisations that process personal data must pay the ICO an annual data protection fee, unless they are exempt. The ICO has a short self-assessment on ico.org.uk that tells you whether you need to pay and which tier you fall into.
How Gather360 helps
Built to make the basics easy
Each customer’s data is kept separate from every other customer’s and hosted in the UK. Documents are stored privately, not as public links. Every user has their own login and a role, so you control who can do what.
If you need a copy of your data for a request, or want an account deleted, email hello@gather360.co.uk.
Questions people ask
Do I need consent to keep business contacts in a CRM?
Usually not. Legitimate interests is the normal basis for client and business contacts. Consent matters more for marketing to individuals under PECR.
How long can I keep contacts after a client leaves?
UK GDPR does not set a fixed period. Decide what is reasonable for your business, write it down and apply it. Many firms align it with how long they keep related records.
Is my CRM provider responsible for GDPR?
Partly. You are the controller and responsible for why and how you use the data. The provider, as processor, is responsible for keeping it secure and only acting on your instructions.
Where is Gather360 data stored?
In the United Kingdom. Card payments are handled by Stripe, which never receives your CRM data.
Is this legal advice?
No. It is general information. For your circumstances, check the ICO’s guidance at ico.org.uk or speak to a data protection adviser.
See if it fits in ten minutes
Click round the live demo with no sign-up, or start a free trial with your own clients. No card, no sales call.
30-day free trial · no card · £12.99 + VAT per person a month after