Sample privacy impact assessment: a client list moves to a US-hosted CRM

Example Distribution, a distributor with 25 employees, is replacing the spreadsheet that holds its client list on the office server with a customer relationship management (CRM) application offered online by an American vendor. The project aims to centralise client records and sales history in one place and to help staff follow up on quotes and reminders. The records concern the contact persons at each client, between 100 and 10,000 persons in all, as well as the employees who use the application.

This assessment covers the personal information that will be held in the CRM: the names and contact details of client contact persons, their purchase history, the free-text notes written by sales representatives, and the names and email addresses of employees who use the CRM. It looks at how this information is collected, hosted by the vendor, accessed internally, retained and returned. The information is not intended for any purpose beyond the two described, and the project does not involve any decision made exclusively by automated processing. The assessment does not extend to other systems or activities of Example Distribution.

Personal information about client contact persons originates with the clients themselves and with the sales representatives who deal with them. It includes names and contact details, purchase history, and notes that representatives type freely in a text field. Because that field has no set limits, it sometimes contains personal details unrelated to sales, such as the fact that a contact person is on sick leave. Whether the persons concerned are informed that their information is collected and held in this way remains to be confirmed. The names and email addresses of the employees who use the CRM are also recorded in the application.

The information is hosted and processed by the CRM vendor in the United States. Example Distribution accepted the vendor’s online terms without reading them, so whether a written agreement governs how the vendor protects and uses the information remains to be confirmed. Inside Example Distribution, all sales and customer service staff can see every record, whether or not they deal with the client concerned.

No retention period has been defined for the records, so the information stays in the CRM indefinitely for now. What the application returns to Example Distribution is a centralised view of client records and sales history, along with follow-ups on quotes and reminders. Whether the information can be retrieved from the vendor in a structured, commonly used format remains to be confirmed.

The assessment brought to light five findings about the move to the CRM. No written agreement with the vendor, which processes the information outside Québec, has been confirmed. Access is not limited to the staff who need it. No retention period is defined. Whether the persons concerned are informed, and whether their information can be communicated in a structured format, remains to be confirmed. From these findings, three main risks emerge: information processed outside Québec without adequate protection, unauthorised access to the information, and retention longer than necessary. The last two are considered likely. The free-text notes field adds to these risks because it can hold personal details, including health-related ones, that serve no purpose in the project.

Several points remain to be confirmed, notably the content of the vendor’s terms that Example Distribution accepted without reading them, and whether the persons concerned have been informed. Example Distribution adopts the five measures set out in this document to address the findings and risks identified.