Contents10
- 01Why does a poorly kept CRM cost so much?
- 02Step 1: measure before you touch anything
- 03Step 2: deal with duplicates
- 04Step 3: fields that mean only one thing
- 05Step 4: what there is no longer a reason to keep
- 06Step 5: rules to make it last
- 07Step 6: automatic checks
- 08What cleaning does not fix
- 09Where to start
- 10Frequently asked questions
Cleaning your CRM data becomes urgent the day a salesperson finds three “Dupont” records, half the phone numbers missing and a status nobody updates. They go back to their spreadsheet, and the CRM degrades a little more: a CRM is worth only the trust the team places in it.
This guide follows the order we recommend, from the figures that size the problem to the checks that make the result last. If you have not yet chosen your tool, our guide to choosing between Twenty, Dolibarr and Odoo starts from your processes. The guides on migration and operation are in our CRM and customer data section.
In short
A tested backup and a measured audit of the current state before any bulk correction.
Certain duplicates are found on a reliable key; probable duplicates go through human eyes, never through an automatic merge.
Fewer fields, lists rather than free text, and values that mean only one thing.
A retention period that is set and applied: in France, the CNIL (France’s data protection authority) suggests three years for a prospect.
Entry rules and an automatic check every night, otherwise the mess comes back through the same doors.
Why does a poorly kept CRM cost so much?
Adoption. Data that people doubt is no longer consulted, so no longer updated, so even less reliable. That circle dooms a CRM more surely than a poor choice of software.
Automations and AI. Every automation reads the CRM: a follow-up goes to the wrong contact, an invoice is created twice, a report counts the same customer twice. An AI plugged into it does worse, because it answers with confidence: asked who a customer’s contact is, it picks one of the duplicates without warning. Data quality is, incidentally, one of the reasons why the return on AI in business is slow to arrive.
The GDPR. Article 5 of the regulation requires data to be accurate and, where necessary, kept up to date, and that every reasonable step be taken to erase or rectify inaccurate data without delay. It also requires data to be limited to what is necessary (data minimisation), and kept no longer than necessary. A CRM that is never cleaned drifts a little further from these principles every year.
Step 1: measure before you touch anything
You do not clean blind, and you delete nothing without a safety net.
- A full backup before any bulk change, and a restore that has been tested.
- Reversible operations: a bulk correction is first run as a simulation, with a way of rolling back; as long as any doubt remains, you archive rather than delete.
- A measured audit of the current state, on your own data: number of records per object, share of records with neither email nor phone, records with no owner, number of different values in each list (a freely typed “Sector” field quickly reveals its spelling variants), records with no activity for a long time. These figures will then be used to measure progress.
One last prerequisite, a definition:
Definition
Usable record
The minimum without which a contact is useless: for example a name, a company, a way to reach them, an owner and a source.
Step 2: deal with duplicates
Where they come from
Duplicates always have a way in: repeated imports, a website form that creates a record on every submission, two salespeople entering the same company, and all the spelling variants (“Dupont SARL”, “SARL Dupont” and “Dupont”; a personal email and a work email; a website written with or without “www”). Finding the way in matters as much as the clean-up: otherwise, they come back.
Finding them
Two levels of search:
Certain duplicates
Spotted on a reliable key
The email for a person
The website domain for a company
Probable duplicates
The same name written differently, the same phone number, the same address
They need human eyes
A list to validate, never an automatic merge
In Twenty, the email and the domain are unique by default, and the documentation on uniqueness constraints explains how to make other fields unique in the data model settings, for example a customer number taken from your invoicing software.
Resolving them
For each group, you choose the record to keep (the most complete one, or the one carrying the deals in progress), bring over what is useful from the others (notes, phone number, links to deals), then delete the others. Depending on the tool, this goes through a merge function, through the API or by hand: check what yours offers before starting the job.
Three behaviours of Twenty are worth knowing, and the same documentation describes them. Before an import, duplicates inside the file are highlighted, and you can fix or remove those rows before launching the import. An imported row whose email or domain already exists updates the existing record instead of creating a second one: handy for filling gaps, dangerous if the file contains an older version of the data. The third bears directly on the clean-up.
Watch out
A deleted record can come back
Deleted records count in this check: reimporting the same value restores the deleted record. A clean-up by “delete, then reimport” can therefore resurrect what you wanted to see disappear.
Step 3: fields that mean only one thing
A good part of the mess comes from the model, not from data entry.
- Lists rather than free text for anything used to sort or count (sector, source, status, size): a few clean values give usable reports, free text gives variants.
- Fewer fields. Every field nobody fills in is noise, and one more reason not to open the record. It is also what the minimisation principle of Article 5 asks for: keep only what is useful.
- Required fields, but few. The bare minimum of the usable record. Too many requirements produce fake values (“to be completed”, “0000”), worse than an empty field because they look real.
- One value, one meaning. Any field used to make decisions (source, status, owner) can be checked with one question: does each value refer to a single reality? A “Website” source that mixes quote requests and newsletter sign-ups makes the two indistinguishable the day you want to know where sales come from.
Step 4: what there is no longer a reason to keep
Cleaning also means deleting. In France, the CNIL proposes reference retention periods for customer and prospect files, summarised in its questions and answers on the reference framework for managing commercial activities:
for a prospect’s data used for prospecting, from its collection or from the last contact coming from them, for example a click on a link in an email
for a customer’s data, after the business relationship ends (it is kept for the whole of its duration)
At the end of the period, you can contact the prospect again to ask whether they wish to keep receiving solicitations. Without a positive and explicit answer, their data is deleted, or archived in a database separate from the active data if an obligation justifies it (accounting or tax, for example).
Two clarifications on the same page matter for the clean-up. These frameworks are not binding: you can set other periods, provided you can justify the choice. And a person who has objected to prospecting must not come back through the next import: the CNIL recommends keeping what allows their objection to be respected for at least three years, in an exclusion list used for nothing else.
In practice: a “last contact” field kept up to date, ideally by an automation, and a regular list of the records that have exceeded the set period.
Step 5: rules to make it last
- One person responsible for the data, named, with a deputy. Not “the team”.
- Clear permissions: who creates, who edits, who deletes. The tool’s roles and permissions exist for that.
- Entry points under control: a website form first checks whether the email exists before creating a record, and an import always goes through a file that has been reviewed, deduplicated and compared against the exclusion list.
- A monthly review: the list of probable duplicates, of records with no owner and of records past the retention period. It stays short when the automatic checks have prepared the work.
Step 6: automatic checks
An automation can re-read the CRM every night and produce a short list: new probable duplicates, records created without a required field, values outside the list, records past the retention period. The list goes to the responsible person, through a channel they actually read. These are the principles of monitoring automations applied to data: an alert, a list to work through, no silent correction.
A check is above all there to say what it cannot settle.
From the field
On Palmora Property, a property listings portal that we operate, the audit of the property database found 20 mistyped records and 55 duplicated titles, and escalated to a person 7 duplicates that no rule could resolve.
A machine that merges on its own what it poorly understands does more damage than the duplicates themselves.
What cleaning does not fix
- A fuzzy process. If nobody knows who follows up a prospect or when to update a status, the data degrades again. The answer is organisational, not software.
- Legitimate similarities. A person who changes company, a group and its subsidiaries sharing a domain: not everything that looks alike is a duplicate.
- What was never entered. Cleaning makes what exists reliable; it does not reconstruct what is missing.
Where to start
Start with the audit of step 1, on your own figures: it tells you the scale of the job before you spend time on it, and it will serve as a point of comparison. If a change of CRM is on the horizon, do the big clean-up then and set the rules from the first day of the new tool: our guide to migrating from HubSpot to an open-source CRM shows where the clean-up fits into the migration.
If you would rather have support, in our CRM offer your existing data is imported, deduplicated and checked: nothing doubtful goes in as it is, and the team starts on a clean base. And if your CRM is Twenty, our report on running Twenty in production says what operating it day to day demands.
Frequently asked questions
How often should you clean your CRM?
One big clean-up, once, ideally when you change tool, then automatic checks every night and a short human review every month. The daily check catches duplicates and incomplete records the day they come in, when they are still easy to fix. An annual clean-up with no rules in between is like mopping the floor without turning off the tap.
Can you leave deduplication to an AI?
To spot probable duplicates (similar names, spelling variants, the same person with two emails), it is a good use: the AI proposes, a person validates. To merge or delete, no, not without human validation. A wrong merge mixes the history of two customers, their deals and their exchanges, and is hard to untangle. Keep the decision human, and take a backup before any batch merge.
How long can you keep a prospect’s data?
In France, the CNIL’s framework suggests three years from collection or from the last contact coming from the prospect. At the end of that period, you can ask whether they wish to stay in touch; without a positive answer, their data is deleted or archived separately. Another period remains possible, provided you can justify it.
Should you clean your data before changing CRM?
Yes, and it is the best moment: only the useful records are carried over, and the new tool starts without the old one’s duplicates. But a clean-up is not enough on its own. Without entry rules set from day one (unique fields, forms that search before creating, imports reviewed and deduplicated), the duplicates come back through the same doors, and the new CRM ends up like the old one.
Sources
- Article 5 of the regulation (new tab)cnil.fr
- Documentation on uniqueness constraints (new tab)docs.twenty.com
- Questions and answers on the reference framework for managing commercial activities (new tab)cnil.fr
Questions and answers on the reference framework for managing commercial activities
Read on cnil.fr(new tab)Jim · founder of Brain Plus AI
Also in crm and customer data

Practical guide9 min
Migrating from HubSpot to an open source CRM in seven steps
Leaving HubSpot for Twenty, Dolibarr or Odoo can be done without losing your customers, provided you deal with the model, export, cleaning, import and history in order. Here is our seven-step method, and the honest list of what does not come across by itself.

Understand8 min
Twenty CRM in production: our view, limits included
We have been running Twenty, an open-source CRM, on our own server since early 2025. What works, what takes effort, what the AGPL licence means for a company, and who we do not recommend it to.

Practical guide9 min
Monitoring your n8n workflows: no silent failures
An automation that fails without warning is worse than a manual task: nobody knows the work has not been done. Here is the minimal set-up that turns a silent failure into an alert, then into a rerun, using the tools n8n already provides.
