On this page
Key takeaways
Who owns customer data? It should always be your business. Keep the CRM, mailing lists and customer records in accounts held in your company's name, with providers given access as data processors under a written contract. If a provider holds your only copy of the customer list, you cannot switch, and you may struggle to meet your duties as data controller.
- Hold the CRM and lists in your company's own accounts.
- Providers act as processors under a written contract.
- Export a full copy of customer data every month.
- The contract must return or delete data at exit.
Want to check whether you really own your customer data? Message us on WhatsApp.
Chat on WhatsApp →Why must the business own customer data?
Because the customer list is one of the most valuable assets an SME has, and the legal duties attach to it. As data controller, you decide why and how the data is used and must be able to answer subject access requests and correct errors. If a provider controls the only copy, those duties become hard to meet.
Where does ownership go wrong?
Usually by convenience, not intent.
- An agency sets up the CRM in its own account.
- A provider's system is the only record of orders.
- Mailing lists live in a freelancer's email tool.
- Nobody has an export from the last year.
What should the contract say?
UK GDPR requires a written contract with any processor, covering instructions, confidentiality, security, sub-processors, assistance with data rights and return or deletion of data at the end. Add that the data belongs to you and must be provided in a usable format on request.
How do you keep control day to day?
Own the admin accounts, give providers user-level access, take a monthly export to storage you control and review who can export data. When a provider leaves, remove access the same day.
What does this look like in practice?
A pattern we see: a business switches marketing agency and finds its email list was in the agency's account. Firms that hold accounts in their own name switch providers in days, with no loss of customers.
Customer data ownership checklist
- List every system holding customer data.
- Move accounts into your company's name.
- Sign processor contracts with every provider.
- Export a full copy monthly.
- Remove access when providers leave.
Next step
Try exporting your full customer list today. If you cannot without asking a provider, fix ownership first.
Message us on WhatsApp, or book a 30-minute consultation.
Chat on WhatsApp →Sources and further reading
- Controllers and processors · Information Commissioner's Office
- Contracts and liabilities between controllers and processors · Information Commissioner's Office
Frequently asked questions
Who owns customer data when you use an agency?
It should be your business, as data controller. The agency should act as a processor under a written contract, working in systems held in your name or returning all data on request. Check that the CRM and mailing tools are in your company's accounts.
Can an outsourcing provider keep your customer data?
Not if the contract is properly written. UK GDPR processor contracts must require the provider to delete or return personal data at the end of the service, unless the law requires them to keep it. Add a clause requiring return in a usable format.
How do I make sure I own my CRM?
Hold the CRM subscription and the main administrator account in your company's name, pay for it yourself, give providers user-level access, and take regular exports. If an agency set it up in its own account, ask for it to be transferred.
Written by
Global Bridge Labs (GBL) is a UK–Sri Lanka partner for social media, websites and BPO. Everything here comes from client delivery, not theory.
