Supervisory authorities keep sanctioning weak transparency and unlawful secondary use of personal data — including large fines where profiling and commercial communications were poorly explained to individuals. Cleaning a database is not a neutral IT chore; it changes what you can lawfully say about a person.
Use a cleansing and profiling checklist that separates technical hygiene from marketing decisions.
Why cleansing projects drift into compliance debt
Teams merge duplicates, enrich firmographics and score ‘engagement’ without updating privacy notices or lawful bases. The Spanish AEPD case against EDP Comercializadora shows how profiling and third-party communications without adequate information and measures can trigger multi-hundred-thousand-euro fines.
Checklist: what good looks like
- Define match keys and survivorship rules before merging records.
- Separate bounce/invalid contact hygiene from marketing preference changes.
- Document every enrichment source and whether it creates a new purpose.
- Keep an audit log of bulk updates and who authorised them.
- Test access/erasure flows on the cleansed schema, not only the old one.
- Publish retention for dormant contacts and suppression lists.
Questions before you enrich
- Is this field required for a stated purpose, or ‘nice for later’?
- Would our privacy notice still be accurate after this enrichment?
- Can we reverse a bad merge without rebuilding the CRM?
How Dcode fits
Dcode handles database entry, cleansing, profiling and hosting as an operational service for brands that need disciplined data work alongside logistics and customer programmes.
Next step: bring your field dictionary and purpose map to a contact conversation — we will mark which cleanses are safe to automate.