Keep customer records that won't land you in trouble
Most small firms aren't breaking GDPR on purpose. They're breaking it because customer details are scattered across inboxes, phones and a shared drive nobody's ever tidied.
Where it hurts
You hold names, addresses, phone numbers, maybe card details or photos of people's homes. GDPR's ask is plainer than people fear: know what you hold and why, have a lawful reason for holding it, tell people about it, keep it secure, and don't keep it longer than you need.
In practice it's in Gmail, on WhatsApp, in a spreadsheet, in an old quoting tool nobody's logged into for a year, and on the laptop of someone who left. If a customer asked what you hold on them, you couldn't honestly say, because you don't know yourself.
Then a deletion request lands and the panic starts. The right to erasure isn't absolute (you can keep invoices HMRC requires, or records you'd need to defend a legal claim), but you get a month to respond, and you can't respond to data you can't find.
What I'd build
GDPR doesn't require a CRM, and moving everything into one doesn't make you compliant by itself. It just makes the actual duties practical. So I'd pull your records into one controlled place, lock down who sees what, set retention dates, and write the basics in plain English: what you hold and why, the lawful basis for keeping it, a privacy notice that says so, who you share data with, and proper agreements with any tool that processes it for you. Then an AI pass that hunts stray personal data in old mailboxes and spreadsheets, flags records past their date, and drafts the reply when someone asks what you hold or wants deleting, noting what you can lawfully keep, for you to approve. Anything genuinely legal, I'll flag for proper advice.
What changes
- Customer data in one tidy, controlled place instead of scattered everywhere
- A plain-English record of what you hold, why, and who it's shared with
- Retention dates that get applied, so old records don't hang around forever
- Access and deletion requests answered properly, knowing what you can keep
Facts on this page last checked 12 July 2026, against ico.org.uk.
Related fixes
Sound like your week? The free half-hour review is where we work out whether this is your first fix or your fifth.