GDPR checklist for crm tools.
CRM tools hold contact records, communication history and sales notes about prospects and customers. Compare 38 common tools and see what to check for each.
Compared at a glance
| Tool | Usual role | Data location | Agreement |
|---|---|---|---|
 HubSpot | Usually a processor | Set per account or project | Published by the vendor |
 Salesforce | Usually a processor | Set per account or project | Published by the vendor |
 Pipedrive | Usually a processor | Set per account or project | Published by the vendor |
 Attio | Usually a processor | Often the European Union, check your account | Published by the vendor |
 Close | Usually a processor | Set per account or project | Published by the vendor |
 Insightly | Usually a processor | Often the United States, check your account | Published by the vendor |
 Nutshell | Usually a processor | Set per account or project | Published by the vendor |
 Capsule | Usually a processor | Set per account or project | Published by the vendor |
 Folk | Usually a processor | Often the European Union, check your account | Obtained through the vendor |
 Freshsales | Usually a processor | Set per account or project | Published by the vendor |
 Less Annoying CRM | Usually a processor | Often the United States, check your account | Obtained through the vendor |
 SugarCRM | Usually a processor | Set per account or project | Published by the vendor |
 Oracle NetSuite | Usually a processor | Set per account or project | Published by the vendor |
 SAP | Usually a processor | Set per account or project | Obtained through the vendor |
 Teamleader | Usually a processor | Often the European Union, check your account | Published by the vendor |
 Odoo | Usually a processor | Set per account or project | Obtained through the vendor |
 Vtiger | Usually a processor | Set per account or project | Published by the vendor |
 EspoCRM | Usually a processor | Set per account or project | Published by the vendor |
 Clay | Usually a processor | Set per account or project | Published by the vendor |
 Clearbit | Depends on the activity | Set per account or project | Published by the vendor |
 ZoomInfo | Depends on the activity | Set per account or project | Published by the vendor |
 Lusha | Depends on the activity | Set per account or project | Published by the vendor |
 Cognism | Depends on the activity | Often the European Union, check your account | Published by the vendor |
 Kaspr | Depends on the activity | Set per account or project | Published by the vendor |
 Dropcontact | Usually a processor | Often the European Union, check your account | Published by the vendor |
 Hunter | Depends on the activity | Usually Belgium | Published by the vendor |
 Gong | Usually a processor | Set per account or project | Published by the vendor |
 Fireflies | Usually a processor | Set per account or project | Published by the vendor |
 Avoma | Usually a processor | Set per account or project | Published by the vendor |
 Dealfront | Depends on the activity | Set per account or project | Published by the vendor |
 Leadfeeder | Depends on the activity | Set per account or project | Obtained through the vendor |
 Albacross | Depends on the activity | Set per account or project | Published by the vendor |
 Demandbase | Depends on the activity | Set per account or project | Published by the vendor |
 Vitally | Usually a processor | Set per account or project | Obtained through the vendor |
 Gainsight | Usually a processor | Set per account or project | Published by the vendor |
 ChurnZero | Usually a processor | Set per account or project | Published by the vendor |
 Totango | Usually a processor | Set per account or project | Published by the vendor |
 Planhat | Usually a processor | Set per account or project | Published by the vendor |
What to check for crm tools
- Define a retention period for inactive leads and contacts.
- Make sure you can find, export and delete one contact across the CRM.
- Record the legal basis for outreach, and respect objections to marketing.
- Record the region and any transfer outside the EEA.
All crm tools
- HubSpotCRM
- SalesforceCRM
- PipedriveCRM
- AttioCRM
- CloseCRM
- InsightlyCRM
- NutshellCRM
- CapsuleCRM
- FolkCRM
- FreshsalesCRM
- Less Annoying CRMCRM
- SugarCRMCRM
- Oracle NetSuiteCRM
- SAPCRM
- TeamleaderCRM
- OdooCRM
- VtigerCRM
- EspoCRMCRM
- ClayCRM
- ClearbitCRM
- ZoomInfoCRM
- LushaCRM
- CognismCRM
- KasprCRM
- DropcontactCRM
- HunterCRM
- GongCRM
- FirefliesCRM
- AvomaCRM
- DealfrontCRM
- LeadfeederCRM
- AlbacrossCRM
- DemandbaseCRM
- VitallyCRM
- GainsightCRM
- ChurnZeroCRM
- TotangoCRM
- PlanhatCRM
Questions, answered.
What should I check before using a crm tool under the GDPR?
Define a retention period for inactive leads and contacts. Make sure you can find, export and delete one contact across the CRM. Record the legal basis for outreach, and respect objections to marketing. Record the region and any transfer outside the EEA.
Do I need a data processing agreement with a crm provider?
If the provider handles personal data on your behalf, yes: Article 28 of the GDPR requires a written contract. Some providers publish the text, others give it to you inside your account. Providers that decide their own purposes may act as independent controllers instead, so check the role.
Which crm tools does Privacyboard cover?
HubSpot, Salesforce, Pipedrive, Attio, Close, Insightly, Nutshell, Capsule, Folk, Freshsales, Less Annoying CRM, SugarCRM, Oracle NetSuite, SAP, Teamleader, Odoo, Vtiger, EspoCRM, Clay, Clearbit, ZoomInfo, Lusha, Cognism, Kaspr, Dropcontact, Hunter, Gong, Fireflies, Avoma, Dealfront, Leadfeeder, Albacross, Demandbase, Vitally, Gainsight, ChurnZero, Totango, Planhat. Each has a page with its agreement, usual role and data location, checked on 1 November 2026.
Other categories
Privacyboard is not affiliated with these vendors. Checked on 1 November 2026. This is guidance, not legal advice.