The customer register and data protection: what a salesperson may store and send

In brief

• A customer organisation’s contact details are personal data when they relate to an individual. The controller determines the purposes and means of processing.
• Electronic direct marketing may be sent to a corporate entity unless it has prohibited it (section 202); a natural person has to give prior consent (section 200).
• Every marketing message has to carry a free-of-charge opportunity to prohibit further messages, and that opportunity has to be clearly signposted.
• A customer register has no statutory retention period; the organisation decides the periods itself and justifies them by the purpose.

The name, the job title and the work e-mail of a customer organisation’s contact are personal data, even when the relationship runs between organisations. Two sets of rules follow from that, and they are easily mixed up in everyday sales work: the GDPR decides what may be collected into the register and how long the data is kept, and the Act on Electronic Communications Services decides who electronic direct marketing may be sent to. The former applies to every contact in the same way; the latter separates a corporate entity from a natural person.

Customer details and contact details

Basic customer details include the name, business ID, billing address, industry and e-invoice address. These can also be personal data when they relate to an identifiable individual, such as a sole trader. A contact’s details concern a person: name, job title, work e-mail, work phone, the correspondence exchanged and the notes recorded about them. A work address in the form firstname.lastname@company.fi identifies the person as precisely as a private address does, and a note about who was negotiated with and about what is data about them.

The controller determines the purposes and means of processing personal data. For a customer register, this is usually the organisation using the register. The system supplier processes the data on the controller’s behalf, and the division of work is written into a data processing agreement. Responsibility for the data subject’s rights stays with the controller even when the data lives in a purchased service.

The GDPR’s principles govern the customer register

The Regulation speaks about processing in general; in sales, five decisions follow from it that have to be made before the first row is saved.

The purpose is defined before collecting. A customer register’s purpose is usually managing the customer relationship, quoting and customer communication. When the same contact details start being used for something else, such as a campaign for a new product area or a partner’s marketing, that is a new purpose, assessed separately.

Necessity and data minimisation. Collect the details that contacting the person and closing the deal require. A contact’s home address or private phone number is rarely of any use when the dealing happens in a work role.

Storage limitation. Data in identifiable form is kept for as long as the purpose requires. In practice this means the register has to be given retention periods – otherwise everything stays in the spreadsheet forever.

Informing the data subject. The data subject has to be told about the processing. The obligation covers data collected from somewhere other than the person themselves as well: from a public register, from a trade fair’s attendee list or from a form on the website.

The data subject’s rights. A person has the right to access data concerning them, to ask for incorrect data to be rectified, and to object to direct marketing. An objection to direct marketing is always carried out, with no balancing of interests.

Choose the legal basis according to the purpose and parties involved. Processing a customer organisation’s contact details may rely on legitimate interests if the conditions are met and a balancing assessment has been carried out. A contract between organisations does not itself make the contact person a party to it. The contract basis applies when processing is necessary for the individual’s own contract or for preparatory steps at their request. Public authorities may rely, for example, on a legal obligation or a task in the public interest; they cannot rely on legitimate interests when performing their tasks. Record the basis and how its conditions are met before collecting the data.

Electronic direct marketing separates a corporate entity from a natural person

Marketing carried out by e-mail, text message or a similar message is governed by the Act on Electronic Communications Services, and its two sections lead to different outcomes depending on who the recipient is.

A legal entity may receive electronic direct marketing under section 202 unless it has opted out. Every message must clearly offer an easy, free opt-out, such as a working unsubscribe link or reply address. A named employee’s work email does not automatically fall under this rule. Sending without prior consent requires the marketer to establish the person’s duties and the product or service’s substantial connection to them.

To a natural person, electronic direct marketing may be directed under section 200 only if the person has given their prior consent to it. The section has one exception: if the seller has obtained the contact detail from a natural person who is a customer, in connection with the sale of a product or a service, the same seller may use it to market their own products in the same product group, or other corresponding products. Even then the customer must be given the opportunity to prohibit the use of the contact detail easily and free of separate charge, both when the detail is collected and in connection with every message. Other direct marketing, such as a letter or a phone call, may be directed to a natural person unless they have expressly prohibited it.

A sole trader – a person carrying on business under a business name – is a natural person even though they hold a business ID and are buying for the company. The same goes for a self-employed professional. A business ID in the register therefore does not tell you which section applies to the recipient; the company form does.

A marketing opt-out is data in the register, not a setting in the e-mail tool. The opt-out has to be recorded where the sending list is built, and it has to survive a rebuild of that list: if the row of the person who opted out is deleted altogether, the next import may bring them back. Many organisations keep the opt-out as a separate record for as long as marketing is carried out.

What goes into the customer register and what stays out

The register holds the data the relationship is managed with: contact details, job title and role in the purchase, the correspondence exchanged, agreed next steps, quotes and orders, and the marketing opt-out with its date.

Customer management does not normally require health, belief or trade-union information. Free text can also contain these special categories of data: a note about long sick leave is health data. If dietary requirements are needed for an event, handle them separately from sales notes, on an appropriate legal basis and only as long as necessary.

The second group is personal observations: judgements about character, family situation, financial standing, or about who in the organisation is difficult. The detail sales actually needs can usually be written through the job title: “decides on the purchase together with the CFO” says the same as a judgement about character, and it can be checked.

Write every note so that you could read it aloud to the person it concerns. The data subject’s right of access to their data covers free text the same way it covers structured fields.

Free text is also the part that goes uncleaned when a person is deleted. Structured fields are cleared by a single action; the titles of activities and the notes stay as they were written and may still name the person. The shorter the free text, the less work an erasure request creates.

Who can see saved emails?

When customer e-mails are filed into the customer register with a blind copy address or through Microsoft 365 mail, the message becomes the organisation’s information. It is seen by everyone with access to the customer’s data: another salesperson, the head of sales, the next customer owner. This is worth telling the sales team before taking it into use, because the correspondence moves from a personal mailbox into a shared register.

Save only messages needed for the customer relationship. Address filtering helps, but does not guarantee exclusion of private or sensitive messages: the same person can send them from the same address. Define what is saved, how exceptions are removed and who can see the content. Assess internal customer discussions on necessity and access rights too.

Tracking opens and clicks is processing of its own, not a by-product of filing e-mail. If it is used, it is decided on and disclosed separately.

The retention period is decided separately for three situations

The data in a customer register has no single statutory retention period, unlike accounting material and working-time records. The organisation decides the periods itself and justifies them by the purpose.

The periods are the organisation’s own decision, and they have to withstand a justification: two years of a silent lead is a different matter from ten. The decision is written into the privacy notice and carried out in the register, so that it does not stay on paper.

Invoices and contracts are different material. Chapter 2, section 10 of the Accounting Act requires a financial period’s vouchers to be kept for at least six years from the end of the calendar year during which the financial period ended, so tidying the customer register does not reach them. When a contact’s details are erased, the name left on invoices remains as part of the voucher.

Answering a data request

A request rarely arrives in a formal form. It can be one sentence in an e-mail: “remove me from your lists” or “what data do you hold on me”. The answer is built in order.

1. Identify what is being asked. A direct marketing opt-out, access to the data, rectification and erasure are different requests, and one message may contain two of them.
2. Check who is asking. The address the correspondence has been exchanged through is usually enough to identify a customer contact; further details are asked for only if there is reason for doubt.
3. Gather every source. Structured fields, activities, filed e-mails, attachments, marketing lists and free-form notes. The data most often hides in free text and in a separate campaign spreadsheet.
4. Respond on time. Reply without undue delay, normally within one month. Complexity or request volume can justify up to two further months; notify the person of the extension and reasons within the first month.
5. Act according to the processing bases. Delete unnecessary personal data, retain legally required data and explain the decision. Removing a name does not anonymise data if other events, text or attachments identify the person.

The privacy notice and the practices

The notice is the document the duty to inform is met with. For the customer register it records at least:

• the controller and a contact address from which the data subject gets an answer;
• what data is collected and where it comes from, including sources other than the person themselves;
• the purpose and the legal basis separately for managing the customer relationship and for marketing;
• who processes the data: your own roles and the system and communication services you use;
• whether data is transferred outside the EU;
• the retention periods, or the criteria by which they are determined;
• the data subject’s rights and how they are exercised;
• the right to lodge a complaint with the Office of the Data Protection Ombudsman.

The notice is made available where the data is collected: on the contact form, at newsletter sign-up and as an attachment to a quote. Alongside it, it is worth writing a short internal instruction for the sales team on two things the notice does not cover: what gets written into the customer register and who sees it, and what happens to the data once the relationship ends.

Example: the customer register’s fields on a contact

One contact’s row is taken apart field by field. The columns are the ones the notice and the erasure practice need.

Choose fields based on what managing the relationship requires. Unnecessary data adds maintenance and privacy risk without corresponding benefit.

Example: the same newsletter to three recipients

The newsletter goes to three addresses collected at the same trade fair. The rule changes with the recipient.

Before sending, check the recipient’s role, the message’s connection to their duties, consents and opt-outs. Legal form or a work email address alone does not settle every case. Record your assessment and the source of any consent.

Checklist

• The controller is named and a processing agreement has been made with the system supplier.
• The purpose and the legal basis are recorded separately for managing the customer relationship and for marketing.
• The collected fields have been reviewed: each one has a use, and an unused field has been removed from the form.
• Sensitive data is absent from the register, free text included.
• The notes are written so that they hold up when the data subject reads them.
• The scope of e-mail filing is defined and the sales team has been told who sees the filed messages.
• The marketing basis is assessed: recipient’s status, duties, message content, consents and opt-outs.
• Every marketing message carries an opt-out that is free of charge and findable, and it has been clearly signposted.
• Marketing opt-outs survive a rebuild of the list.
• Retention periods are decided for an active relationship, an ended relationship and an unanswered lead, and they take effect in the register.
• A handler for data requests is named and the sources the data is gathered from are listed.
• The privacy notice is up to date and available where the data is collected.