Zoho CRM GDPR Compliance: Consent and Requests

Data protection laws give people rights over their personal data: to know why you hold it, to see it, to correct it, to have it deleted in many cases and to object to how it is used. For most businesses the CRM is where that data lives, so it is also where those obligations are met or missed. Zoho CRM GDPR compliance features help you record the lawful basis for processing, collect consent, track data subject requests and act on them. They do not make a business compliant on their own; they support processes you still need to design. This guide explains what the features cover, how to set them up, how integrations affect compliance and how to run requests reliably. It is general information, not legal advice.

What the regulation asks of a CRM

Under the UK and EU GDPR, an organisation that decides how personal data is used, the controller, needs a lawful basis for each purpose, must be transparent with people, must keep data accurate and no longer than necessary, and must respond to requests from individuals exercising their rights. In CRM terms, that means you should be able to answer, for any contact:

• Why do we hold this person's data, and on what basis?
• Where did it come from, and when?
• Have they consented to marketing, and how was that recorded?
• What requests have they made, and how were they handled?
• Which other systems hold a copy?

Zoho CRM GDPR compliance features

Zoho's help article on GDPR and Zoho CRM explains that GDPR features are supported for Leads, Contacts, Vendors and custom modules, and are switched on under Setup, Security Control, Compliance Settings by users with the Manage Compliance Settings permission. Once enabled for a module, records gain a Data Privacy section where you record the lawful basis for processing, and by default the data processing basis is set to Not Applicable until you change it.

Zoho's article on lawful bases for data processing describes consent management options: defining consent settings, setting up a consent form, adding a consent link to email templates and viewing the status of consent requests.

Zoho's article on data subject rights explains how requests are recorded. They can be added manually from the Data Privacy section of a record, for example after a phone call or email, or collected automatically by sending a data request link, with submitted requests captured in the CRM. Open requests can be reviewed from the compliance overview.

Setting it up well

Switching the features on is the easy part. Before you do:

• Decide which modules hold personal data about individuals and need the features
• Agree the lawful basis for each purpose, such as legitimate interests for some B2B sales activity or consent for certain marketing, with advice where needed
• Plan how existing records will be updated from Not Applicable to the right basis, rather than leaving the default in place
• Define who handles requests, how quickly, and how they are escalated
• Check that roles and profiles limit who can see and change privacy fields

Document these decisions, with the date and the person who approved each one. If a regulator or customer asks, you will need to explain them.

Integrations and compliance

Integrations are where compliance often breaks. Personal data flows from web forms, enrichment tools and imports into the CRM, and out to marketing platforms, support tools and reporting databases. Each flow should respect the privacy decisions recorded in the CRM:

• Record the source of every record created by an integration
• Set the lawful basis on creation where it is known, such as consent captured by a form
• Sync consent status to marketing tools, and stop sending to people who have withdrawn it
• Propagate deletion and restriction requests to every system that holds a copy
• Avoid sending personal data to systems that do not need it

Our guide to CRM data retention covers how long to keep data and how to archive, anonymise or delete it, and our guide to CRM security covers access controls and audit trails.

Running data subject requests

A reliable request process has clear steps:

1. Record the request in the CRM as soon as it arrives, whatever the channel
2. Verify the person's identity proportionately
3. Find all their data, in the CRM and in connected systems
4. Act: provide a copy, correct, restrict or delete, as the request and the law require
5. Respond within the legal deadline, and record what was done
6. Close the request, keeping a minimal record that it was handled

Train everyone who talks to customers to recognise a request, because people rarely use legal terms; "please remove me from everything" is an erasure request even if it arrives in a sales reply. The searching step is where integrations matter most. Keep a list of every system that receives CRM personal data, so nothing is missed.

Worked example: a request process for a training company

Suppose a training company holds delegate and prospect data in Zoho CRM, a marketing platform, a booking system and a reporting database. It designs this process:

StepOwnerSystems involvedRecord keptLog requestWhoever receives itZoho CRM data subject request on the recordDate, channel, typeVerify identityData protection leadEmail to the address on recordVerification outcomeLocate dataOperationsCRM, marketing platform, booking system, reporting databaseChecklist per systemAct on erasureOperationsDelete or anonymise in each system; add email to suppression listActions per system with datesRespondData protection leadEmail to requesterCopy of responseCloseData protection leadZoho CRM request closedMinimal record retained

The owners, systems and checklist are the company's own design. Keeping the email on a suppression list after erasure stops it being re-imported, a common practice the company has confirmed with its adviser.

Common mistakes

• Switching the features on and leaving every record on the default basis
• Treating the CRM features as the whole of compliance
• Forgetting copies of data in connected systems
• No owner or deadline tracking for requests
• Marketing tools that ignore consent changes made in the CRM
• Deleting a contact completely, then re-importing them from an old list

Frequently Asked Questions

Does Zoho CRM support GDPR compliance?

Zoho CRM provides features for recording lawful bases, managing consent and tracking data subject requests for Leads, Contacts, Vendors and custom modules.

Where are GDPR settings in Zoho CRM?

According to Zoho's help article, under Setup, Security Control, Compliance Settings, available to users with the Manage Compliance Settings permission.

Do integrations affect GDPR compliance?

Yes. Data copied to other systems must respect consent, restriction and deletion decisions, so integrations need to sync those decisions and record data sources.

Is enabling these features enough to be compliant?

No. They support your processes, but you still need lawful bases, clear policies, request handling and advice suited to your situation.

Make privacy part of your CRM

We configure Zoho CRM privacy features and build integrations that respect consent and requests across your systems. See our CRM and API integration services, or talk to us about your data protection setup.

About the Author

Manav Sharma is the founder of Insyrge and a CRM solutions architect. He works across Zoho, Salesforce, HubSpot, Odoo and more, designing the CRM setups, integrations and automations that keep sales and operations teams working from the same data.