CRM and GDPR: retention periods and the right to erasure

A former prospect writes: “Erase all my data.” The request is legitimate, the deadline short, and the practical question follows at once: where is it? On their record, of course, but also in synced emails, the emailing tool, an export sent to the accountant last year and last night’s backups.

This guide from our CRM and customer data section covers both sides of the subject: how long to keep each piece of data, and how to erase it for good when asked. It complements our guide to cleaning your CRM data, which sets retention periods within a broader clean-up. It gives reference points, not legal advice: your data protection officer, or your lawyer, decides your case. The periods quoted are those of the CNIL, France’s data protection authority; other EU authorities may publish their own.

How long to keep what

The CNIL reference framework for managing commercial activities gives the reference points most used for a CRM:

These periods are not binding: according to the CNIL’s Q&A on these frameworks, you may depart from them provided you can justify your choices. The principle, however, is: Article 5 of the GDPR requires data not to be kept longer than necessary.

What “last contact” means

A prospect’s period runs from the last contact coming from them. The framework gives examples: a request for documentation, a click on a link in an email leading to the product promoted. Merely opening an email should not count. An email sent by your salesperson therefore does not reset the clock.

In practice, you need a “last inbound contact” field kept up to date automatically: by syncing email with the CRM, which sees replies, and by the website form, which sees requests.

When the period ends

The framework provides that you may get back in touch with the person to ask whether they wish to keep receiving solicitations. Without a positive and explicit answer, their data is deleted, or archived if an obligation justifies it. An automation can prepare the list of records reaching their deadline every month; the decision and the sending stay human.

The right to erasure: what the regulation requires

The right to erasure is set out in Article 17 of the GDPR. Four rules from the same chapter organise the response:

• One month to answer, from receipt of the request, extendable by two months given the complexity and number of requests, provided the person is informed within the first month (Article 12).
• Exceptions: data that a legal obligation requires you to keep, such as invoices, or data needed to establish, exercise or defend legal claims (Article 17).
• Notify the recipients to whom the data was disclosed, unless this proves impossible or involves disproportionate effort (Article 19).
• Objection to prospecting is always respected: the CNIL framework points out that it must be acted on systematically.

Proof of identity is requested only where there is reasonable doubt about the person’s identity, and deleted once the request has been handled, according to the same framework.

Where a contact’s data hides

Erasing a record is almost never enough. A person’s data also lives:

• in synced emails and their attachments, attached to their record;
• in the emailing tool, if it keeps its own list;
• in billing and support, which have their own records;
• in exports and spreadsheets sent by email or saved on a shared drive;
• in automation logs, which sometimes keep the content of the data processed;
• in backups, which hold the record as it was on the night of the backup.

This is where a single customer view, which connects tools around one key, saves the most time: it tells you where to look.

In the tool: the trash is not erasure

Most CRMs do not delete straight away: the record first goes to the trash, so that a mistake can be undone. In Twenty, according to its permissions documentation, “delete” moves the record to the trash, from which it can be restored, and “destroy” erases it permanently; these are two separate rights, assigned by role. Its legal FAQ states that deleted records are kept for 14 days by default before being removed, a period that can be changed in the security settings.

We have run Twenty in production since early 2025, on our own server, and that is where the question becomes concrete: when you self-host, the backups are yours. A record erased today still lives in every backup taken before, for as long as you keep those backups.

The suppression list, the only data you keep on purpose

Erasing someone who refuses prospecting entirely has a perverse effect: at the next file import, they come back. The CNIL recommends keeping, for at least three years, what is needed to respect their objection, in a list used for nothing else. Every import and every form checks it before creating a record.

And when the CRM decides alone

A CRM that scores contacts, sorts requests or rejects applications without human review enters another chapter of the regulation, that of automated decisions. Our article on automated decisions by AI sets out the limits.

Where to start

1. 01Write down your periods

   By category of data, with the justification for any departure from the framework.

2. 02Create the “last inbound contact” field

   And feed it automatically.

3. 03Reserve the destroy right

   For one role, and set the trash retention period.

4. 04Map the tools

   Where a contact’s data lives, backups included.

5. 05Write the erasure procedure

   With the person who owns it and the one-month deadline.

The rest of the section covers choosing between Twenty, Dolibarr and Odoo, Twenty in production, Twenty as a back office, migrating from HubSpot, sales follow-ups and why salespeople do not fill in the CRM.

A CRM delivered with its retention periods, role-based rights and tested backups is our CRM and ERP offer. For a first look at your situation, write to us.

Frequently asked questions

Sources

1. CNIL, reference framework for processing personal data to manage commercial activities, in French (new tab)cnil.fr
2. CNIL Q&A (new tab)cnil.fr
3. Regulation (EU) 2016/679, General Data Protection Regulation, EUR-Lex (new tab)eur-lex.europa.eu
4. Twenty documentation: Permissions (new tab)docs.twenty.com
5. Twenty documentation: Legal FAQ (new tab)docs.twenty.com