GDPR and customer data in software: what must an SMB arrange?

Customer data in software and the GDPR: controller or processor, data processing agreement, EU hosting, retention periods and what to ask a supplier.

In this article

Who is responsible when customer data sits in software?
Who does what?
What belongs in a data processing agreement?
Where is the data, and what does EU hosting mean?
How long do you keep customer data, and what about access and deletion?
What to ask a supplier
What do you arrange yourself, and when do you ask a lawyer?
Frequently asked questions

Short answer

When customer data sits in software, your company is the controller and the supplier is the processor. You sign a data processing agreement, you know which sub-processors have access and where the data is stored, and you can handle access, correction and deletion requests. This is general information, not legal advice.

By the makers of stiptUpdated September 7, 20266 min read

Who is responsible when customer data sits in software?

The GDPR knows two roles. The controller decides why and how personal data is used. The processor handles it on the controller's behalf and follows their instructions. If your customer data sits in a CRM, you are the controller and the software supplier is your processor. That stays true when the system runs in the cloud and you see little of it yourself.

You remain responsible for the data and have to choose a processor that offers sufficient guarantees. That is why the GDPR (Article 28) requires a written data processing agreement. For its own administration, such as invoicing and accounts for your employees, the supplier is a controller itself. That is separate from your customer data.

Who does what?

Topic	You (controller)	Supplier (processor)
Purpose and legal basis	You decide why you process data and on what basis	Processes only on your instructions
Requests from customers	You answer requests for access, correction and erasure, generally within a month	Helps you search, export and delete
Security	You choose a supplier with suitable measures and manage your own access	Takes technical and organisational measures
Sub-processors	You give permission and can object to changes	Engages them only with your permission and imposes the same obligations
Data breach	You assess it and, where needed, report it to the data protection authority within 72 hours	Reports it to you without undue delay
End of the agreement	You choose whether data is returned or deleted	Returns or deletes it, as you choose

What belongs in a data processing agreement?

What the processing is about: subject matter, duration, nature and purpose, type of data and categories of people
That the supplier only processes on your written instructions
Confidentiality for everyone who can reach the data
Security measures, such as encryption and access control
Rules for sub-processors: permission, a current list and the same obligations
Help with requests from data subjects and with a data breach
Return or deletion of the data when the agreement ends
Your right to check, for example through an audit or a report

Where is the data, and what does EU hosting mean?

The GDPR does not require hosting in the EU. It asks that data leaving the EEA stays properly protected: through an adequacy decision of the European Commission, such as the EU-US Data Privacy Framework for companies certified under it, or through standard contractual clauses. Hosting in the EU makes this simpler, but does not solve it entirely.

A database in Frankfurt says nothing about the rest of the chain. An email service, an AI model, error monitoring or a support employee can be outside the EU. Remote access from a country outside the EEA can also count as a transfer. So do not only ask whether it is in the EU, but which parties process what, and where. An honest supplier publishes that list. The stipt privacy statement, for example, says that database and files are in the EU, that not all processing takes place in the EU, and lists per sub-processor the purpose and the location, with the basis for the transfer.

How long do you keep customer data, and what about access and deletion?

The GDPR names no fixed retention period. The rule is that you do not keep data longer than needed for the purpose you collected it for. So you decide a period per type of data yourself and write it down. For your financial records the Netherlands has a tax retention obligation, generally seven years.

Data subjects also have rights: access, correction, erasure, restriction, objection and portability. When someone asks, you generally respond within a month. That only works if your software can search, export and delete the data of one person. Data you must keep by law, such as invoices, you do not delete on request.

What to ask a supplier

Do I get a data processing agreement, and can I read it beforehand?
Which sub-processors does the supplier use, where are they and on what basis does data leave the EU?
Where are my data and backups stored, and who can reach them remotely?
Where does the AI run, and are my messages used to train models?
How long does the supplier keep my data after the agreement ends, and can I export it first?
Can I search, export and delete the data of one customer?
How is data encrypted, and is two-step verification available?
Within what period does the supplier report a data breach to me?
Am I told when a sub-processor changes, and can I object?

What do you arrange yourself, and when do you ask a lawyer?

Software does not make you GDPR-proof. A supplier who does everything right does not help if the whole team shares one login or a former colleague still has access. So arrange personal accounts with only the rights someone needs, a fixed moment to withdraw access when someone leaves, and a short list of which personal data you process, for what and for how long. That overview is called the record of processing activities in the GDPR and is mandatory for many businesses.

This article is general explanation and not legal advice. If the data is sensitive or your supplier's agreement does not fit how you work, ask a lawyer or privacy adviser to look at it. The Dutch Data Protection Authority explains the rules at autoriteitpersoonsgegevens.nl.

Frequently asked questions

Do I have to sign a data processing agreement with my CRM supplier?

Yes, as soon as the supplier processes personal data on your behalf. Article 28 of the GDPR requires an agreement. Most suppliers offer one. Check it against the points in the list above rather than accepting it blindly. At stipt you accept the data processing agreement when you sign up, and the text is public on the terms page.

Is EU hosting mandatory?

No. The GDPR does not require hosting in the EU, but asks for suitable safeguards when data leaves the EEA. EU hosting makes it simpler. Also ask about sub-processors, backups and remote access, because a transfer can still happen there.

How long may I keep customer data?

The GDPR names no fixed period: no longer than needed for the purpose. Set a period per type of data. For your financial records the Netherlands has a tax retention obligation, generally seven years.

What do I do when a customer asks for access or deletion?

First check who is asking. You generally respond within a month. Find the data in your software and hand it over or delete it, except what you must keep by law, such as invoices. If your software cannot export or delete the data of one person, call your supplier.

What happens in a data breach at my supplier?

A processor reports a data breach to you without undue delay. You then assess as the controller whether there is a risk for the people involved. If so, you report it to the data protection authority within 72 hours of becoming aware. Have a concrete period for the report to you written into the data processing agreement.

See what stipt can handle for your business?

We'll show you what your working day looks like in stipt, set up for your kind of work and your way of working.

Book a demo See pricing