GDPR Requests in a CRM: Finding Every Copy of One Person
A customer asks you to delete their data. You open the CRM, type their surname, find one contact card, delete it. Done, right? Three weeks later an auditor wants to know what happened to that same person’s support history, the two quotes you sent last spring, and the newsletter list they were somehow still on. The card was never the whole story.
Answering a data request properly means knowing where one human being got scattered across your systems - and that’s knowledge you want long before someone hands you a deadline.
Table of Contents
Why One Person Lives in Twenty Places
One buyer rarely occupies one row. They show up as a lead from a web form, turn into a contact when sales finally picks up the phone, then collect deal notes, a signed contract, half a dozen support tickets, several invoices, and a scattering of task descriptions where a colleague typed “call Anna about the renewal.” Duplicates pile up without anyone doing anything wrong. Same person registers twice, work address one time and private the next, once as Anna Kowalska and once as Anna Nowak after a name change.
And then the shadow copies. Exports somebody pulled for a quarterly report, spreadsheets sitting on a laptop, attachments buried in a mailbox. Nobody tracks those once the quarter closes. The obligation covers them anyway. Before this is a legal problem it’s a data architecture problem - and the architecture is the part you can actually fix.
What a Data Subject Actually Asks For
Strip away the legal vocabulary and the requests fall into a handful of shapes:
- Access - send me a copy of what you hold about me.
- Rectification - my details are wrong, correct them.
- Erasure - remove me from your records.
- Portability - hand my data over in a file I can reuse elsewhere.
- Objection and restriction - stop processing my data, or pause it while we disagree.
Erasure is the one people get wrong. It isn’t absolute. Invoices and signed contracts usually stay right where they are, because accounting and contract law impose retention periods of their own. What erasure means in practice is stripping out the marketing and sales context - consent flags, enrichment data, prospecting notes - while the financial trail stays intact.
One more thing your team has to internalize. These requests almost never arrive on a formal legal template. They come as a two-line email, or a support ticket that says “please take me off your system.” Somebody on the front desk has to recognize that sentence for what it is.
Building a Search That Finds Everything
Start from identifiers. Never names. An email address, a phone number, a company tax ID, an account number - those are stable. Names are not. Search by surname and you’ll miss the diacritic somebody typed as a plain letter, the married name on the newer record, the trailing space pasted in from a web form, the two letters transposed in a hurried entry.
Cast the net over free text as well. Notes, task descriptions, ticket replies, even attachment filenames routinely carry the same person in a form no structured field ever captured. Use your CRM’s filtering to pull a working list, export it, then walk through it module by module instead of trusting one global result screen.
Tip: run the query twice - once against the email domain, once against the phone number - and compare the two result sets. Whatever shows up in only one of them is exactly the record your first pass would have quietly left behind.
A Repeatable Checklist for Each Request
Improvising under a deadline is how records get missed. Write the sequence down once, then follow it every single time:
- Log the request with the date it arrived.
- Verify the requester is who they claim to be.
- Search every module - contacts, leads, contracts, projects, tickets, invoices.
- Review what must legally be retained.
- Act: delete, correct, or export.
- Document what you found and what you did.
Give each request one owner, so it can’t stall in the gap between sales and accounting. Tracking it as a task on a Kanban board with a deadline reminder keeps the clock where everyone can see it, rather than buried in one person’s inbox. Keep a short internal record of the outcome too - that’s your answer if an audit ever shows up. And when you reply, write plainly, in the person’s own language, listing categories of data instead of dumping raw database rows nobody can read.
Where Access Control Does the Heavy Lifting
Half this problem gets solved by deciding who can copy data out in the first place. Fewer people with export rights, fewer stray files drifting around outside the system, fewer places to search when a request lands. Roles and permissions do similar work upstream: if support agents can’t open contracts and the sales team can’t open invoices, the data stays somewhere you can account for it.
Centralizing customer history matters more than any single control. Chasing spreadsheets across individual laptops is a losing game. A platform such as EpicCRM keeps contacts, contracts, tickets and invoices under one search and one permission model, so a single query reaches all of it. That said - discipline beats tooling. A clean field convention, one place for the email and one for the phone, makes every future search cheaper than any feature ever will.
Preventing the Next Fire Drill
Most of the pain here is preventable maintenance. Merge duplicates as routine hygiene, on a schedule, not as a panic response the morning a request arrives. Standardize capture at the point of entry: one field for email, one format for phone numbers, agreed across everyone who touches the form.
Write a retention rule for each record type. How long invoices live, how long sales notes live, when ticket history expires. Deciding that once, calmly, beats relitigating it under time pressure with a clock running. And record in the contact itself when consent was given and what it covered, because “we think they agreed somewhere” is not an answer you ever want to give out loud.
Tip: rehearse. Pick a real customer record, run a full request against it end to end, and time yourself. The rehearsal will expose the module everyone forgets, and it costs you nothing when there’s no deadline attached.
FAQ
Do I have to delete invoices when someone asks to be erased?
Generally no. Accounting and tax rules set their own retention periods, and for those specific documents they override an erasure request. What you can do is everything around them - withdraw marketing consent, delete sales notes and enrichment data, pull the person off campaign lists - while the invoice itself stays in the books. Tell the requester exactly which records you kept and on what legal basis. A clear explanation reads as competence. Quietly ignoring part of the request reads as evasion, and that’s the sort of thing that turns a routine exchange into a complaint.
What makes GDPR requests manageable
One person is many records, and a request is only ever as good as the search behind it. Work from identifiers, review module by module, follow a written checklist instead of your memory of how it went last time. Retention rules settled in advance take the guesswork out of it when a deadline is running. There’s a quiet bonus in all this, too: the same cleanup that answers a data request - duplicates merged, fields standardized, history in one place - hands your sales team a much clearer picture of the customer than they had the week before.
