GDPR does not ban CRM — it bans processing without a lawful basis and without security appropriate to the risk. Contact and database programmes that cannot show when consent was captured, for which purpose, and how opt-outs propagate will fail the first serious complaint.
CBI notes that contact centres process and store large volumes of customer information; the same discipline belongs in the database that feeds them.
Why consent and suppression drift apart
Marketing owns campaigns; ops owns files; legal owns policy. Without one suppression pipeline into every channel (email, SMS, outbound voice, post), a customer who opted out yesterday is dialled tomorrow.
Checklist: what good looks like
- Consent record: timestamp, channel, purpose text shown, source system, double opt-in evidence if used.
- Purpose limitation mapped to actual campaign types — not a single ‘marketing’ flag forever.
- Suppression file cadence into call centre, ESP and SMS gateways before each wave.
- Retention and deletion jobs with owners and logs.
- Access control: who can export full profiles vs campaign segments.
- Complaint and DSARs route with SLA into the same customer record.
Questions before the next outbound wave
- Can you produce the consent evidence for ten random dialler records in under an hour?
- How fast does an opt-out reach every channel after it is captured?
- Which fields are blocked from export to agencies by default?
How Dcode fits
Dcode runs GDPR-minded customer database work alongside call-centre and coupon programmes — so consent, cleansing and outbound suppression can be briefed as one operating layer. Read next: customer data cleansing checklist.
Next step: request a consent and suppression review via the contact page with a sample of your current flags.