Roles, Permissions and Keeping Customer Data Safe

A CRM is the most valuable list your business owns. Every customer, every phone number, every quote, every conversation. That is exactly why it needs more care than a spreadsheet ever got.

The last lesson connected the CRM to accounts, the website and ads. The more systems it talks to and the more people use it, the more it matters who can see what, and what happens when someone leaves.

This lesson covers roles, permissions and the basics of keeping customer data safe, including what India’s data protection law now expects.

01Start From Jobs, Not People

A role is a set of permissions for a job, not for a person. When someone joins, you give them a role. When they change jobs, you change their role. Nobody gets permissions one by one, because nobody will remember to take them away.

Most small businesses need four roles, sometimes five:

An immigration consultancy adds a fifth, case coordinator, who sees documents and deadlines for assigned cases but not fees. A real estate agency with outside brokers adds partner, who sees only the leads shared with them.

02Three Permissions That Matter Most

Every CRM has dozens of permission settings. Three of them prevent most of the damage.

1. Export. Who can download the customer list as a file. This is the one that walks out of the door with a departing employee. Keep it to the owner.
2. Delete. Who can permanently remove records. Most people should archive, not delete; a deleted customer cannot be recovered when you discover the mistake a month later.
3. Sensitive fields. ID numbers, passport details, bank details, income. Visible only to the roles that need them for the job, and masked for everyone else.

Remember the real estate agency from Module 1 whose departing executive emailed the whole customer sheet to a competitor? In a CRM with export limited to the owner, that is not possible.

03When Someone Leaves

This is the moment a CRM proves its worth, or its weakness. A short, written routine makes it painless:

Last working day — deactivate login (do not delete the user) — reassign open deals and tasks to named colleagues — remove from WhatsApp and phone integrations — check the export log for the last 30 days — change any shared passwords

Deactivating rather than deleting matters. The history of every conversation they had stays on the customer records, which is the whole point of having a CRM. A manufacturing distributor that once lost two years of dealer chats on a departing salesperson’s phone now runs this routine in ten minutes, and the customers never notice the handover.

04Backups, Logs and Two-Step Login

Three habits protect against the mistakes, not just the bad actors.

• Backups you have tested. Daily automatic backups, kept for at least thirty days, and one restore actually tried. A backup nobody has restored is a hope, not a backup.
• An activity log. Who changed what, when: deals moved, records deleted, exports run, permissions changed. You will rarely read it. When you need it, nothing else will do.
• Two-step login. A password plus a code on the phone, for everyone, and compulsory for anyone who can export or change settings. Most break-ins start with a reused password.

05What India’s Data Protection Law Expects

The Digital Personal Data Protection Act, 2023 and its Rules, notified on 14 November 2025, apply to almost any business that holds customers’ personal data digitally, which means any business with a CRM. The Rules give businesses an eighteen-month phased period to comply, so most obligations apply from around May 2027. In plain terms, the law expects you to:

• Ask clearly and for a purpose. Tell people what you collect and why, and get consent that is clear and easy to withdraw. This is the consent field from the campaigns lesson.
• Collect only what you need and keep it accurate. The “only what someone will act on” rule from Module 2 is also the law’s data minimisation principle.
• Keep it safe. Reasonable security safeguards: roles, limited exports, backups, logs, two-step login.
• Answer people’s requests. Customers can ask to see, correct, update or erase their data, and requests must be dealt with within ninety days.
• Tell people if something goes wrong. After a personal data breach, affected individuals must be informed without delay, in plain language, with what happened and what to do; the Data Protection Board must be told as well.
• Name a contact. Show who to contact about personal data questions.

The penalties are large enough to take seriously: up to ₹250 crore for failing to keep data safe, up to ₹200 crore for not reporting a breach, and up to ₹50 crore for other violations. Most small businesses will never be near those figures, but the safeguards that avoid them are the same ones that protect the business anyway.

This summary was checked on 22 October 2026 against the government’s own explainer, “DPDP Rules, 2025 Notified” (Press Information Bureau). It is a plain-English overview, not legal advice; for your own obligations, speak to a lawyer.

06What This Means for Your CRM

Turn the law into five features you can check on any CRM, including one built for you:

• A consent field with date and source on every record, and opt-out that updates it.
• Role-based access with export and delete limited to the owner.
• A way to find, export and erase one customer’s data on request, quickly.
• An activity log and tested backups.
• Data stored where you know it is stored, with a provider you can name.

Generic tools offer most of these on higher tiers. Where they struggle is the specific case: the immigration consultancy that must restrict passport scans to two people, or the distributor whose dealer pricing must be hidden from support staff. That is where a CRM built around your roles is simpler than configuring around someone else’s.

Next lesson: custom fields and workflows, and how to tell when configuring a generic CRM is enough and when the process itself deserves its own system.