Can You Export Your CRM Data? A Simple Portability Check for Owners

You own your customer data only if you can pull it out of your CRM in a clean, usable file whenever you need it. A login is not ownership. The real test is whether you can export your contacts, activity and consent records without begging a vendor or paying a fee. This post gives you a short check you can run this week.

The test matters for two reasons. Customers in some countries have a legal right to ask for their data in a portable format. And you may one day want to move to a different system, which only works if your records leave in good shape.

What the UK regulator says about portable data

The UK Information Commissioner's Office (ICO) publishes guidance on the right to data portability. It says the data must come in a format that is structured, commonly used and machine readable. The ICO names CSV, XML and JSON as three examples, and says other formats that meet those tests are acceptable.

The guidance says the right applies only when two conditions are met. The lawful basis for processing must be consent or the performance of a contract, and the processing must be done by automated means. Paper files fall outside the right.

The ICO also explains what is covered. It includes personal data the individual provided to you. It also includes observed data, such as website usage history, search activity, traffic and location data. It excludes inferred or derived data that your business created, and it does not apply to truly anonymous data.

On timing, the ICO says to respond without undue delay and at the latest within one month of receiving the request. The clock starts the day the request arrives, including weekends and holidays. You can extend by up to two months for complex or multiple requests, but you must tell the person within the first month.

As a rule you cannot charge a fee. The ICO allows only a reasonable fee for administrative costs when a request is manifestly unfounded or excessive. You may also refuse in those cases or when an exemption applies, but you must explain why and tell the person they can complain.

These rules come from UK guidance. If you serve customers in the United States, Australia or Canada, check the rules that apply in each country. The habit of keeping exportable records helps you everywhere.

A five step export check

Run this check on your own CRM. It takes about an hour, and it shows you how much control you really have.

1. Export all contacts. Use the export tool in your CRM and save the file as CSV. Open it in a spreadsheet and confirm that names, emails, phone numbers and company fields all appear.
2. Export activity. Check whether calls, emails, notes, form submissions and deal stages come out too. Many systems export contacts but leave history behind.
3. Export consent records. Confirm the file shows when and how each person opted in, what they agreed to and any opt-out date. A contact list with no consent history is only half your record.
4. Export lead source and value. Make sure each contact keeps its original source and any deal amount. Without these fields you lose your reporting history on the day you move.
5. Time it. Note how long the export took and who had permission to run it. If only one person can do it, you have a risk.

What a clean export looks like

A good export has one row per person and one column per field. Column names are clear, such as first name, email, source, created date and consent date. Dates use one consistent format.

Watch for common problems. Phone numbers lose leading zeros. Notes break across lines and split a record in two. Tags arrive crammed into one cell. Fix these by testing a small batch first and reading the file before you trust it.

Fields worth keeping in every export

• Contact name, email and phone number
• Date created and original lead source
• Consent type, consent date and channel
• Opt-out date and which messages the person stopped
• Deal stage, deal value and closed date
• Last contact date and owner

Know what you can and cannot hand over

The ICO split between provided data and inferred data helps you plan. Details the customer gave you, such as a form entry, and observed activity, such as page visits, fall inside the portability right. A lead score or a note that says "likely to buy" is inferred by you, so it falls outside it.

Tag your fields in a simple data map. Mark each as provided, observed or inferred. When a request arrives, you will already know which columns go in the file.

The ICO also has a separate page on the right of access. It points readers to its subject access guidance for details on that right. Read it alongside the portability page, since a customer may ask for a copy of their data under either one.

Set up a request routine

Do not wait for a request to find a gap. Write a one page routine and keep it with your CRM notes.

1. Name one person who receives requests and one backup.
2. Log the date each request arrives, because the one month clock starts that day.
3. Confirm the identity of the requester before you send anything.
4. Export only that person's records, in CSV or another standard format.
5. Send the file securely, then log the date you sent it.

If a request is complex, send your notice of extension inside the first month. Keep a copy of that notice with your log.

Why this protects your business, not just your customers

A system that exports cleanly is a system you can leave. That keeps you in control when prices change, a vendor shuts down or your needs grow. It also forces good habits, because messy records show up the moment you open the file.

Schedule an export once a quarter and store it in a place you control. Check that the file opens and that the counts match your CRM. A backup you have never opened is only a guess.

Your next step this week

Run the five step check, fill in the data map and write the request routine. If any export fails, ask your vendor in writing how to get that data out, and keep the reply. Owning your data starts with knowing exactly what you can take with you.