What does GDPR say about customer data in a CRM?

A CRM is by definition a database of people. That puts it squarely under Regulation (EU) 2016/679 and under the supervision of the Data Protection Commission (DPC) in Ireland.

Short answer

Every processing activity needs a legal basis: consent, contract, legal obligation or legitimate interest.
B2B prospecting often relies on legitimate interest; email, SMS or WhatsApp marketing is also subject to national e-privacy rules, which usually require consent.
You sign a data processing agreement (DPA) with the CRM vendor — they are the processor, you are the controller.
You must be able to answer data-subject requests: access, rectification, erasure, portability.
In a personal data breach, you notify the Data Protection Commission (DPC) within 72 hours, unless the breach is unlikely to put individuals at risk.

What must exist in the CRM for compliance

A field with the legal basis and the source of each contact — where it came from and why you process it.
A record of the consent for commercial communication, with date and channel.
Roles and permissions, so each employee only sees the data they need.
A change log: who changed a record and when.
Export and erasure on request, in a structured format.
A retention policy — contacts are not kept indefinitely "just in case".

The most frequent causes of sanction

Across EU supervisory authorities, the most frequent grounds for sanction include the absence of minimum IT security measures and non-compliant consent — pre-ticked, bundled or impossible to withdraw.

For serious breaches, the fine can reach 20 million euros or 4% of annual global turnover.

Common mistakes

Importing a purchased list with no way to prove where the data came from.
Emailing or WhatsApping the customer list between colleagues.
Full access for every user, "to keep things simple".
No signed DPA with the CRM vendor and the other suppliers that touch the data.
Deleting a contact without deleting the copies in local exports.

How 4softcrm helps

Legal basis, source and consent are recorded as structured data on every contact.
Granular roles and permissions, with a per-record change log.
Export and erasure on request, with data hosted in the European Union.