How long can you keep client and prospect data? GDPR retention periods for your CRM

A CRM never forgets on its own. The prospects you imported for a campaign three years ago, the quote requests from your contact form, the client who bought once in 2021: they all stay there until someone deletes them. That is handy for sales, and it is exactly what data protection law asks you to stop.

There is no table of GDPR data retention periods in the regulation itself. It says you keep personal data only as long as the purpose you collected it for requires, and that you must be able to justify the period you chose. The figures come from elsewhere: regulators’ benchmarks, such as the CNIL’s three years for prospects in France, and other laws, such as the tax rules for invoices.

This guide gives you the periods that matter for a CRM (the tool, or spreadsheet, where you keep contacts and deals) in France, the UK and beyond, then shows how to make the CRM apply them for you.

GDPR data retention periods: what the law actually says

The rule is Article 5(1)(e) of the GDPR, the storage limitation principle: personal data is kept in a form that identifies people for no longer than necessary for the purposes it is processed for. There is no number in it. You set the period for each purpose, write it down and stick to it.

Three things supply the numbers:

1. Other laws that make you keep certain records, such as accounting and tax rules.
2. Regulators’ benchmarks. France’s CNIL publishes recommended periods. They are not binding, but if you choose a different period, you must be able to explain why.
3. Your own reasons: how long your sales cycle runs, how long a quote stays relevant, how often clients come back.

The UK GDPR keeps the same principle, and the ICO’s guidance on storage limitation is blunt: data protection law sets no time limits, you decide them, and you cannot keep data indefinitely just in case.

The periods also follow your contacts across borders. A business in the UK, Switzerland, the US, Canada or Morocco that offers its services to people in the EU falls under the GDPR for their data (Article 3(2)), wherever its office or server is. My GDPR guide for small teams explains when that applies.

Prospects and clients: the CNIL’s three-year benchmark

The CNIL’s reference framework for managing commercial activities (the “gestion des activités commerciales” référentiel, deliberation no. 2021-131 of 23 September 2021) sets these periods:

• A prospect who never became a client: three years from collection, or from the last contact that came from the prospect.
• A client: as long as the commercial relationship lasts, then three years from its end for marketing (in practice, from the end of the contract or the last order).
• When the three years are up, you may contact the person to ask whether they want to keep hearing from you. Without a clear yes, you delete the data, or archive what another law makes you keep.
• Your do-not-contact list: what you need to honour an objection is kept for at least three years.

The CNIL’s questions and answers on these frameworks (in French) give the details.

The ICO publishes no equivalent figure for prospects. A UK business can still adopt three years as its own rule: a period a regulator already considers reasonable is easier to defend than one picked out of the air. If your sales cycle is short, choose shorter. If your prospects come from cold emailing, my cold email GDPR checklist covers what you must tell them in the first message.

Invoices, contracts and card details: periods set by other laws

Some records must outlive the relationship, and commercial, tax and civil law set how long.

The GOV.UK guidance on company records lists the cases where the six years run longer, such as a late Company Tax Return or an open compliance check.

Look at what these laws make you keep: the invoice, the contract, the proof of payment. None of them justifies keeping a former client’s mobile number in your sales pipeline for ten years. The invoice goes to the accounting archive; the marketing record follows the three-year rule.

A retention schedule for a small team’s CRM

Here is a starting point to copy into your own records. The periods are the French benchmarks and the legal minimums above; outside France, adjust them and write your reason next to each line.

A reason sounds like “three years, because our clients plan building work up to two years ahead”. “Because we might need it” is not a reason.

When the clock runs out: archive, delete or anonymise

The CNIL’s guide on retention periods splits a record’s life into phases, and for a CRM they come down to three:

1. Active base: what the team uses every day, such as open deals, current clients and prospects within their three years.
2. Intermediate archive: closed files kept only because a law requires it or a dispute is possible, such as invoices and signed quotes. They are separated from the active base, physically or logically, and only the people who need them can open them; in a small team, often just whoever does the accounts.
3. Deletion or anonymisation, when the last period ends. (The guide’s third phase, permanent archiving, is only for archiving in the public interest, not for a sales database.)

Anonymisation is how you keep your statistics. “Twelve leads from the website in March, four from referrals” is useful and identifies nobody. Swapping a name for a contact number is not enough: that is pseudonymisation, and the GDPR still treats the result as personal data (Recital 26).

Backups expire on their own cycle, so note that cycle in your policy (for example, “overwritten after 30 days”) and, if you ever restore one, apply your deletions again.

How to automate retention in your CRM

A retention period nobody applies is just a sentence in your privacy policy. The fix is to let the CRM do the counting.

Add four fields. Most CRMs record a “last activity” date, but it often includes your own emails and calls, which is the wrong clock. You need:

• the date the contact was collected, and its source;
• the date of the last contact from them (a reply, an inbound call, a form, a click);
• a status: prospect, client or former client;
• for clients, the date the relationship ended.

Review once a month. Save a filter for prospects whose last inbound contact is 35 months old or more. They get one short message asking whether they still want to hear from you; those who have not said yes by month 36 are deleted in bulk. Former clients follow the same routine three years after the relationship ends. Most CRMs can filter on a custom date field and delete the results in bulk.

In a spreadsheet, one formula column gives each row its deletion date, with the collection date in column B and the date of the last contact from them in column C:

=EDATE(MAX(B2, C2), 36)

Format the column as a date and filter it once a month. My tutorial on automating lead follow-up with Google Apps Script adds alerts and reminders to the same kind of sheet; a monthly retention reminder works the same way.

In a custom tool, the schedule can run by itself. When a client’s team had more prospects than it could call back, I built them an internal app so that no one would be forgotten; the story is in my article on building a bespoke CRM. Retention is the mirror image of that problem, making sure the tool forgets on time, and a custom CRM can handle it too: a nightly task can move closed files to an archive table and delete expired prospects, keeping a count of what it removed. If you are having a tool built, ask for the four fields and that task from day one; adding them later means rebuilding dates nobody recorded.

Your retention checklist, and when to get help

1. List what your CRM and its satellites hold: prospects, clients, quotes, invoices, form messages, applications.
2. Give each category a period and a reason, starting from the schedule above.
3. Put the periods in your privacy policy: Article 13(2)(a) of the GDPR asks for the period or the criteria used to set it. My guide to what a privacy policy must say shows where they go.
4. Put them in your record of processing activities: Article 30(1)(f) asks for the time limits for erasure, where possible.
5. Add the fields and the monthly filter to the CRM, clean the old copies, and book the first review in your calendar.
6. Keep the periods to hand: when someone asks for a copy of their data, your answer must say, where possible, how long you will keep it (Article 15(1)(d)). Here is how to answer a subject access request.

This article explains the rules and the regulators’ guidance; it is not legal advice. A lawyer or a DPO is worth paying for if you hold health or other sensitive data, work in a sector with its own retention rules such as insurance, finance or healthcare, face a complaint, or hold large volumes of data on people in several countries. For an ordinary B2B contact list, the schedule above and an afternoon of work are a solid start.