On CRM: SugarCRM Rolls Out GDPR Compliance Features. What About Your Vendor?

BERLIN, GERMANY - JANUARY 12: Server racks in a server center on January 12, 2018, in Berlin, Germany. (Photo Illustration by Thomas Trutschel/Photothek via Getty Images)

If you don't think your business will be affected by the European Union's General Data Protection Regulation (GDPR) which goes into effect on May 25th you're probably wrong. Most of us are affected - particularly if we have CRM systems.

That's because GDPR will impact any company of any size and located anywhere - from solopreneur to non-profits to research organizations - as long as we're collecting any data about people that either reside in an EU country, or have even just visited one for a few days. "A U.S. tourist who visits Germany for one day and returns to the U.S. has rights under the law if that person used (a service like) Facebook while on the trip.," Alex Stern, an attorney wrote on his firm's blog. "Organizations may still be wildly underestimating the scope of the GDPR."

The regulation, which was passed back in 2016, is designed to protect people's privacy. It requires companies and cloud service providers to comply with any person's request to erase, migrate or deliver information about them to them. Companies must demonstrate to authorities that they have policies and procedures for protecting this data and they should be communicating what they're doing to their community. If found in violation the penalties are steep - 20 million euros (about $24 million) or four percent of a company's annual revenues, whichever is higher.

The good news is that many mainstream CRM vendors are responding. The big ones, which include Salesforce, Microsoft, Oracle and Sage, have all announced new data controls aimed directly at being in compliance. Last week another mainstream CRM vendor, SugarCRM, jumped into the fray with their own list of GDPR-related enhancements.

SugarCRM is not re-inventing the wheel.  Its new features are similar to other controls implemented by their competition.  For example, the product now has a "command center" for data privacy and a new user role for a "data privacy manager" within an organization. There are new export features to more easily get information out to customers when they request and the creation of flags for when customers who specifically request that their information is not used for profiling or automated business processes.

Opt-out is now the default setting in SugarCRM for email addresses and a customer's consent to use their data is more accessible. Administrators can remove fields that are deemed “irrelevant” and new searching tools are included to help companies figure out what's relevant or not.  Finally, the company has upgraded its own internal policies for securing customer data.

“The latest release of our products and services will help Sugar customers to meet compliance requirements and build trust with their customer base," Rich Green, SugarCRM's chief technology officer said in a press release. "GDPR is simply the most current and newsworthy issue related to data privacy. It’s likely that more regulation and legislation will be enacted in various countries.”

If you're running a mainstream CRM application at your company, chances are that your vendor has already taken steps similar to SugarCRM to ensure that the application and its database is in compliance with the GDPR. Of course, you should make sure of this by asking your vendor.

However, if your CRM system is more niche, or industry-focused, or homegrown, your antenna should be raised. It could be very likely that you've got information in your database that would be subject to the new EU regulations and you need to be taking steps to ensure that you are in compliance. Just because you're located in the U.S. doesn't mean you're not subject to these new rules. Pretending otherwise could be a very expensive mistake.

Follow me on Twitter or LinkedIn. Check out my website.
