When you buy a CRM, you are not just trusting one company with your customer data. You are trusting its hosting provider, its support tooling, probably an email delivery service, and every marketplace app your team connects afterwards. Privacy obligations generally follow the data wherever it goes, so you need to know where it goes.

Start with a map, not a questionnaire

Many companies begin by sending a long vendor questionnaire. A better first step is a simple diagram of your own setup. Draw the CRM in the middle, then add everything that sends data in or receives data out: the website forms, the marketing platform, the telephony system, the accounting tool, the enrichment service, the AI assistant someone enabled last quarter, the data warehouse. For each arrow, note what data moves and why.

This exercise usually reveals integrations that nobody in legal or security knew about, which is the main reason to do it.

Controller, processor, sub-processor

The terminology varies by law, but the idea is common. You decide why and how personal data is used, so you are typically the controller or equivalent. The CRM vendor handles it on your behalf and is typically a processor. The vendor’s own suppliers, such as a cloud host, are sub-processors. Where this applies, laws commonly expect a written agreement with the processor covering things like permitted use, confidentiality, security measures, breach notification, assistance with data subject requests, and return or deletion at the end of the contract.

Which law applies to you depends on where your customers and your business are located, so confirm the details with a qualified professional. What you can do yourself is read the agreement you’ve actually signed rather than assuming it exists.

Questions worth asking each vendor

Keep the list short enough that you’ll actually get answers:

1. Where is our data stored and where can it be accessed from, including by support staff?
2. Who are your sub-processors, and how do you notify us of changes?
3. What happens to our data, including backups, when we leave?
4. How quickly will you tell us about a security incident affecting our data?
5. What independent assurance reports or certifications can you share? (Review them yourself, and check the scope, because a certificate covering one product may not cover the one you use.)
6. How do you help us fulfil access and deletion requests?
7. Is our data used to train or improve your models or services, and can we opt out?

Don’t rely on a marketing page. Look for the vendor’s current documentation, security pages and contract terms, and keep a copy of what you reviewed with the date.

Cross-border transfers

When personal data moves between countries, many laws place conditions on it, especially when it moves out of a region with strong protections. Mechanisms differ: approved contract clauses, adequacy decisions, certifications and other tools, depending on the jurisdiction. The details are changing and technical, so this is an area where professional advice is worth paying for. In day-to-day terms, your job is to know which countries your data is stored in and accessed from, and to be able to say so.

A common trap is focusing only on storage location. Support access from another country, or a sub-processor running analytics elsewhere, can also count as a transfer.

Don’t forget marketplace apps and integrations

Every app connected to the CRM becomes a processor of your data, and the permission screen during installation is easy to click through. Maintain a register of connected apps with an owner, a purpose and the data scopes granted. Remove anything with no owner. Review requested permissions critically: a scheduling add-on rarely needs to read every contact field.

What to record

Item	What to capture	Review trigger
Vendor and role	Name, processor or sub-processor, service provided	New vendor or contract change
Data involved	Categories of personal data shared	New integration or field added
Locations	Storage and access countries	Vendor announces changes
Agreement	Date signed, location of document, key terms	Annual review
Assurance	Reports or certifications reviewed, scope, date	Report renewal
Exit plan	How data is returned or deleted	Before contract end

A hypothetical example

A mid-sized firm decides to add an AI note-taking tool to its CRM. The sales lead installs it from the marketplace and grants broad read access. During a quarterly vendor review, the privacy lead adds the tool to the register and finds three problems: the tool processes call recordings in a location the firm hasn’t assessed, there is no signed processing agreement, and the vendor’s terms allow use of content to improve its service. The firm pauses the integration, asks the vendor the standard questions, negotiates a processing agreement and an opt-out, and restores access with narrower scopes. The review took a few hours; the same discovery after a complaint would have taken weeks.

Frequently Asked Questions

Do we need a separate agreement with every app connected to the CRM? If an app processes personal data on your behalf, expect to need appropriate terms with its provider. Low-risk apps that never see personal data are different, but verify that claim rather than assuming it.

What if the vendor won’t negotiate its standard terms? That is common with large providers. Read the standard terms, check they cover the points your law expects, and record your assessment. If a gap matters, consider the risk and alternatives.

Is hosting in our own country enough? Not always. Support access, sub-processors and backups can involve other countries. Ask about all of them.

How often should we review vendors? At least annually for key vendors, and whenever a vendor changes sub-processors, a contract renews, or you change what data the integration receives.

Who should own this review? Usually someone in privacy, legal or security, with input from whoever manages the CRM. Pick a named person so it doesn’t fall between teams.

Next Step

Draw the data-flow map for your CRM on a single page this week. Mark every arrow that you cannot explain, and take those to the relevant owners first.