Ask a sales team whether a contact has agreed to receive marketing email and you’ll often get a shrug. The answer might be in the marketing tool, in a spreadsheet from an event, or in the memory of whoever collected the lead. If your CRM can’t answer that question quickly and with evidence, you have a privacy problem waiting for its first complaint.

Consent is not the only basis, and that matters

A frequent misunderstanding is that every contact in the CRM needs a tick-box consent. Privacy laws differ by country and by type of communication, and many allow other grounds for processing, such as performance of a contract or a legitimate interest, for some activities. Marketing by email or text, however, is commonly subject to stricter rules than routine service messages. Because requirements vary by jurisdiction, have a qualified privacy professional tell you which rules apply to which contacts. What the CRM needs to do is record the basis you rely on, whatever it turns out to be, rather than leaving it implied.

What to store against each contact

A workable minimum looks like this:

• Purpose. What the person agreed to or what you rely on: newsletter, product updates, sales follow-up, event invitations.
• Basis. Consent, contract, legitimate interest, or another recognised ground.
• Source. The form, event, import or conversation where it was captured.
• Date and time. When it was given or recorded.
• Wording or version. Which consent text the person saw. If your text changes, this is how you know who saw what.
• Status and change history. Opted in, opted out, withdrawn, unknown, with timestamps for each change.

The history matters as much as the current value. Overwriting “opted in” with “opted out” and losing the earlier record means you can’t show that you honoured the request on time.

Keep purposes separate

One checkbox that covers “marketing, partner offers and anything else” is hard to defend and hard to act on. Break preferences into purposes a person can understand, and store each independently. Someone who unsubscribes from the newsletter may still want invoices and may still be an active customer. Your CRM should model that without forcing a single global flag.

Make opt-outs travel

The most damaging failures are not about collecting consent, they are about forgetting withdrawals. Opt-outs have to reach every system that sends or segments:

1. The CRM record itself.
2. The email or SMS marketing platform.
3. Any advertising audience that was built from a CRM export.
4. Sales sequencing or dialling tools.
5. Any list that lives in a spreadsheet.

Decide which system is the source of truth for preferences, and make the others read from it or sync to it. If two systems both let users change status, you’ll eventually have a conflict, so define which one wins and test it.

Handle imports and purchased lists with care

Imported lists are where consent records usually collapse. When you import contacts from an event, a partner or an old system, bring the source and basis with them, or mark the status as unknown and keep them out of marketing until it is resolved. Treat a bulk import with no provenance as a risk rather than an asset. If you don’t know where a list came from, you can’t prove what those people agreed to.

Build the check into the workflow

Documentation alone won’t protect you. Put the check where people act: segments that exclude contacts without a valid basis for the purpose, send lists that filter out opted-out records automatically, and a field in the record that sales can see before they pick up the phone. A rule that depends on someone remembering to check will fail on a busy day.

Reviewing your records

Question	What a good answer looks like	Common gap
Can we show when and how consent was given?	Date, source and wording version on the record	Only a yes/no flag
Are purposes separate?	Independent status per purpose	One global marketing flag
Do opt-outs reach every tool?	Single source of truth, synced	Unsubscribes stay in one platform
Are old consents still valid?	Review rule for stale or unclear records	Records kept indefinitely
Are imports traceable?	Source and basis on every import batch	Lists with no provenance

A hypothetical example

A small training company collects sign-ups at a trade event on paper forms and later types them into a spreadsheet, which is imported into the CRM with a generic “event lead” tag. Months later, a contact complains about a sales email. The team can’t show what the person agreed to. They fix the process: event forms carry a short, specific consent line with a version number, imports require a source and basis column, contacts without one are held in an “unknown” status and left out of marketing, and a monthly job reconciles opt-outs between the CRM and the email platform. The next complaint takes ten minutes to resolve instead of two days.

Frequently Asked Questions

Do we need consent for every email we send from the CRM? Not necessarily. Rules depend on the jurisdiction and the type of message, and service messages are often treated differently from marketing. Get advice from a qualified professional on how your contact types are treated.

How long should we keep consent records? Long enough to demonstrate compliance for as long as you rely on the consent, and in line with your retention policy. Keep the evidence even after the person has opted out, so you can show the request was honoured.

What do we do with contacts whose status is unknown? Keep them out of marketing until you can establish a valid basis, for example by sending a permitted, non-promotional message asking them to confirm preferences, if your advisers agree that is appropriate.

Can sales reps override an opt-out if the prospect is hot? No. Build the opt-out into the tools so it can’t be bypassed, and give reps a legitimate path for one-to-one contact where the rules allow it.

Is a double opt-in required? Some regions or industries expect or encourage it, and it produces stronger evidence. Whether it is required for you depends on local rules, so check with your adviser.

Next Step

Pull a sample of twenty contacts from your CRM and try to answer, for each, what they agreed to, when, and where it came from. The gaps you hit will tell you exactly which fields and processes to fix first.