Comparisons

GDPR-Compliant CRM 2026: EU Hosting Checklist

By Lars KrügerUpdated 9 min read

Cover: EU Frankfurt shield with Art. 28, residency and subprocessor checklist
Contents
  1. Why “GDPR-compliant CRM” is a risky shortcut
  2. Which GDPR articles hit the CRM first?
  3. What must an Art. 28 DPA cover?
  4. How do you separate data residency and transfers?
  5. Pre-selection checklist (neutral)
  6. What does inDeal document on servers, DPA and subprocessors?
  7. Tenant separation and security measures in practice
  8. Mistakes small businesses make with “EU servers”
  9. How mail integration intersects with GDPR
  10. 30-minute internal runbook
  11. Which setup fits under GDPR aspects?
  12. Keep reading
  13. Frequently asked questions
  14. Sources

A GDPR-ready CRM is chosen with checkable criteria – Art. 28 DPA, documented hosting region, subprocessors and public legal docs – not with “100% compliant” slogans. inDeal (indeal.ai) is a free AI CRM for small businesses operated by Lars Krüger GmbH, Berlin. Not to be confused with indeal.io, a different company.

As of October 16, 2026. Law: EUR-Lex GDPR; Commission DPF IP_23_3721 (context only); market: Eurostat CRM/cloud 2025; product: indeal.ai FAQ, app.indeal.ai/legal/datenschutz, success.indeal.ai. Not legal advice – involve counsel when unsure.

Why “GDPR-compliant CRM” is a risky shortcut

Search intent is clear: you do not want lead and customer data stored “somewhere.” Still, the phrase is dangerous. EU hosting and GDPR compliance are different claims – and neither is a certificate you should accept without reading.

According to Eurostat, in 2025 only 24.69% of small EU enterprises used CRM software (28.51% overall). At the same time, 53% of EU enterprises used paid cloud services (ddn-20260203-1). Cloud is normal; contracts and location still need your checklist.

The EU SME definition uses headcount and financial ceilings; U.S. readers can map “small business” via the SBA size standards. In both markets you need a criteria grid that works without a legal department – and that avoids superlatives.

EU Frankfurt checklist cover
Criteria, not a badge: DPA, residency, subprocessors

Which GDPR articles hit the CRM first?

Two chapters show up constantly – as bookmarks, not as legal advice:

Topic GDPR anchor What you want from the CRM
Processor relationship Art. 28 Written DPA, instructions, security, subprocessors
Third-country transfers Art. 44+ Clarity if/when data leaves the EEA
Controller vs processor Art. 4(7) / roles Who decides purposes?
Security Art. 32 Access, encryption, separation, backup
Data-subject rights Art. 12–22 Export, deletion, access support

What must an Art. 28 DPA cover?

When the CRM processes your lead data on your instructions, the vendor typically acts as a processor. Art. 28 requires an agreement. Check at least:

  1. Written / electronic form before productive import.
  2. Subject matter, duration, nature and purpose.
  3. Documented instructions and confidentiality.
  4. Technical and organizational security measures.
  5. Subprocessor rules and change process.
  6. Help with data-subject rights, deletion and contractual audit rights.
6 points for an Art. 28 DPA
EUR-Lex Art. 28 · not legal advice

How do you separate data residency and transfers?

Residency asks: In which region do databases and backups live? Example: EU region Frankfurt (eu-central-1).

Transfer asks: Do personal data leave the European Economic Area – through storage, support access or subprocessors?

Question EU residency (example) Third-country transfer
Where is data stored? Storage region in the EU (e.g. Frankfurt) Storage or access outside the EEA
Legal frame GDPR inside the EEA Art. 44+ with a valid safeguard
What you check Region in contract / status page SCCs, adequacy, TIA
Common myth “EU company” ≠ EU servers DPF alone is not a free pass
Documentation Hosting region + security measures Transfer tool + subprocessor list
Residency vs transfer
Art. 44+ · DPF as context only

How carefully should you use the EU-US Data Privacy Framework?

In 2023 the European Commission adopted an adequacy decision for the EU-US Data Privacy Framework (IP_23_3721). That is a tool under Art. 45, not a blank check for every CRM and not a substitute for reviewing your architecture. Internally, say: “DPF may matter if the recipient is listed – we still review SCCs, regions and subprocessors.”

Pre-selection checklist (neutral)

# Check Pass signal
1 DPA before go-live Agreement visible and acceptable
2 Hosting region EU/EEA clearly named
3 Subprocessors List public or in-product
4 Privacy & imprint Current; ideally without login
5 Roles Admin edits company details; team can read legal
6 Deletion / export Process for data-subject requests describable
7 Mail integration Token purpose and storage explained
8 Exit What happens on cancel / disconnect?

Among cloud users in 2025, CRM software was 27.9% (Eurostat cloud) – so most cloud buyers still do not run CRM in the cloud. If you start, tick the list above before importing people.

What does inDeal document on servers, DPA and subprocessors?

inDeal (indeal.ai) is a free AI CRM for small businesses. Per the FAQ on indeal.ai: data on servers in the EU (Frankfurt), database-level tenant separation, DPA included.

The privacy notice describes roles (controller vs processor under Art. 28), technical providers and regions. The database provider Supabase is listed with EU region eu-central-1 (Frankfurt); hosting/delivery includes Vercel in an EU region. Other recipients (email, support, analytics) appear in a table with seat and transfer basis – including standard contractual clauses where third-country transfers apply. Logical tenant separation is named among security measures.

In-product under Trash & legal you get tabs for company details, imprint, privacy, DPA, terms and subprocessors. Public versions are reachable without login – shareable with auditors or customers (trash & legal).

What Legal in a CRM should expose
Example UI: success.indeal.ai · trash & legal

Pricing – short and sourced

Account, pipeline and mail integration: €0, unlimited users; 10 starter credits; enrichment credits (email 1, mobile 5, landline 0.5) per indeal.ai. Privacy and seat models are separate: a cheap plan without a DPA is still risky for personal lead data. Deeper limits: free CRM limits.

Tenant separation and security measures in practice

Buzzwords only help if they answer operating questions:

  1. Separation: Can other customers see your leads? Look for logical tenant separation at database level.
  2. Access: Who at the vendor can open support access? Is it logged?
  3. Encryption: TLS in transit and sensible storage of tokens (e.g. mail OAuth) should be described.
  4. Backup and deletion: Trash retention, hard delete, export paths.

inDeal’s privacy notice mentions access controls, authentication, transport encryption, logical tenant separation, logging, backups and recovery (privacy notice). Mail tokens are stored encrypted and used only for send/fetch; Microsoft mailbox data is described as not sold and not used to train AI models.

That does not replace your own security review, but it gives you checkable sentences against your requirements list.

Mistakes small businesses make with “EU servers”

Mistake Why it hurts Better
Checking only company seat Seat ≠ storage region Read region + subprocessors
“DPA later” Import without a contract DPA before productive data
Ignoring subprocessors Hidden transfers List + change process
Treating DPF as a free pass False comfort Context + architecture
Shared admin login No accountability Roles + personal logins
No exit plan Leftover data / disputes Test deletion and export

Free or low-cost CRMs tempt teams to treat privacy as “phase 2.” Better order: legal docs and DPA → dummy data → productive import. Seats at €0 (see CRM without per-user pricing) raise adoption – and raise how many people have access. Roles and logging matter more, not less.

How mail integration intersects with GDPR

When a CRM connects your mailbox, it processes email content and metadata that can identify people. Extra checks:

  • Which OAuth scopes (read, send)?
  • Are attachments stored in the CRM or only referenced?
  • What happens on disconnect – do copies remain?
  • Is the purpose limited to CRM features (no selling mailbox data)?

In inDeal, attachments stay in the mailbox; disconnect permanently deletes imported mail inside inDeal; sync only keeps lead counterparts (connect mailbox). That matters for storage minimization and clear deletion paths – details in Free CRM for Outlook.

30-minute internal runbook

  1. Note purposes and data types (leads, mail content, attachment metadata).
  2. Open and accept/save the DPA – complete company details.
  3. Read the subprocessor list; mark transfers.
  4. Map the stated hosting region to your requirement.
  5. Use a test tenant with dummy leads – no special-category data yet.
  6. Walk deletion and export once (watch trash retention).
  7. Connect mail only afterwards; re-read token purposes in the privacy notice.
  8. File a one-page decision note (date, links, who reviewed).

Clean stages and follow-up also reduce wild copy-paste of personal data into private sheets – see perfect CRM sales process and sales follow-up.

What belongs in the decision note?

  • Vendor, product URL, review date
  • DPA link and version/as-of date
  • Named hosting region(s)
  • Subprocessor list link
  • Known third-country recipients and stated safeguards (SCCs/DPF, etc.)
  • Mail integration outcome (scopes, attachments, disconnect)
  • Open items for the next review (comparison topics: ~90-day rhythm per editorial rules)

If you also connect AI assistants (MCP), you widen the recipient set again – same questions on instructions, logging and purpose limitation apply (connect CRM to ChatGPT/Claude). GDPR review starts at the CRM core and grows with every integration.

Which setup fits under GDPR aspects?

Situation Focus
Strict EU residency required Frankfurt/EU region in contract + subprocessor list
U.S. tools in the stack Art. 44 review; SCC/DPF only with context
Agency holding client data DPA + clear admin vs sales roles
Solo founder Still DPA and public docs before import
Team without seats €0/user helps adoption – does not replace a DPA

If you sell into the EU from outside it, the same logic applies: GDPR can apply whenever you process personal data of people in the EU. The checklist stays; only your internal approval path changes. Keep prices in euro as published on indeal.ai – do not invent converted dollar figures.

A free CRM for your whole team. Start inDeal in 2 minutes. Just an email address, no credit card to sign up, unlimited users.

Start free

Keep reading

Frequently asked questions

What does a GDPR-compliant CRM actually mean?
It usually means a CRM that processes personal data under the GDPR with a written Art. 28 agreement, documented security measures and clarity on where data is stored and transferred. It is a set of checks – not a certificate you can take at face value.
Is EU or Frankfurt hosting enough for GDPR?
EU residency is a strong signal, but it does not replace a DPA, security measures or a review of third-country transfers through subprocessors. Treat it as one criterion, not a free pass.
What is a DPA (Art. 28) for a CRM?
A data processing agreement under GDPR Article 28 between you as controller and the CRM vendor as processor. It covers subject matter, instructions, security, subprocessors and help with data-subject rights.
Does every CRM vendor need to offer a DPA?
If the vendor processes personal data on your behalf, you typically need an Art. 28 agreement before productive use. If it is missing or hard to find, treat that as a blocker.
What is the EU-US Data Privacy Framework (DPF)?
An adequacy decision by the European Commission for certain U.S. transfers (press release IP_23_3721). It can be a tool under Art. 45 – it does not replace reviewing your specific CRM architecture and is not a “100% compliant” stamp.
Where does inDeal store data?
According to the indeal.ai FAQ and privacy notice: on servers in the EU (Frankfurt), with database-level tenant separation. Technical providers such as Supabase are documented with region eu-central-1 (Frankfurt).
Where do I find the DPA in inDeal?
Under Setup → Trash & legal → DPA tab. Company details feed imprint and DPA; public versions are reachable without login.
Is inDeal the same as indeal.io?
No. inDeal (indeal.ai) is a free AI CRM for small businesses from Lars Krüger GmbH in Berlin. indeal.io is a different company.

Sources

  1. Regulation (EU) 2016/679 (General Data Protection Regulation) Official Journal of the European Union (EUR-Lex) ·
  2. Data Privacy Framework: Commission adopts new adequacy decision European Commission ·
  3. E-business integration Eurostat Statistics Explained ·
  4. 53% EU enterprises used paid cloud services in 2025 Eurostat ·
  5. SME definition European Commission ·
  6. Table of size standards U.S. Small Business Administration ·
  7. Privacy notice (Datenschutz) inDeal ·
  8. Trash and legal (Papierkorb und Rechtliches) inDeal Help Center ·
  9. inDeal homepage, pricing and FAQ inDeal ·

inDeal is the AI CRM for small and mid-sized B2B companies.

Keep reading

Comparisons

CRM for Agencies 2026: 9 Criteria for Small Agency Teams

CRM for agencies: 9 criteria for new business, retainers and team roles – a neutral guide for small marketing agencies, with a free start and no per-user fees.

12 min read ·

Comparisons

Free CRM for Outlook 2026: Mailbox & Timeline

Free CRM for Outlook: connect your own mailbox, send from the lead timeline, match replies automatically – a criteria checklist without per-user seats.

9 min read ·

Comparisons

CRM Without Per-User Pricing: How It Works in 2026

CRM without per-user pricing explained: four CRM pricing models, a worked cost example and six questions to ask before you switch your small business.

11 min read ·