Can postal address from a CRM be fed to an AI tool?

Only with a lawful basis for profiling and a notice that says so; check Art. 22 where a decision follows.

Postal address

Q: Is postal address personal data?

Personal data. A home address identifies a person and their location; a business address of a sole trader is also personal data.

A home address identifies a person and their location; a business address of a sole trader is also personal data.

personal data

personal data?

standard

sensitivity

needs a basis

AI use

contract or legitimate interest

lawful basis usually relied on

Keep it how long

With the relationship.

The gap we see most

Home addresses of contacts at business accounts, collected for gifts, kept indefinitely.

What holding it is evidence for

Requirement text and artefacts stated in our own words from the published standards.

Contact details used for marketing GDPR Art.6 · GDPR Art.7 · GDPR Art.21 · CCPA/CPRA §1798.120 · ISO/IEC 27701:2019 7.2.4

GDPR Art.6 Lawfulness of processing

Process personal data only where at least one lawful basis applies: the data subject's consent, necessity for a contract with the data subject or pre-contractual steps at their request, compliance with a legal obligation, protection of vital interests, performance of a public interest task or exerci...

Evidence an auditor accepts: A lawful basis recorded per processing activity, not per system or per department; Legitimate interests assessments showing the interest pursued, the necessity test and the balancing against the data subject's rights; The Union or Member State provision cited where the basis is legal obligation or public task

GDPR Art.7 Conditions for consent

Where processing rests on consent, be able to demonstrate that the data subject consented. Where the consent request forms part of a wider written declaration, present it in a manner clearly distinguishable from the other matters, in an intelligible and easily accessible form, using clear and plain ...

Evidence an auditor accepts: Consent records capturing who consented, when, to what wording, and through what mechanism; The consent wording and interface as presented, versioned, so an old record can be tied to what was actually shown; The withdrawal mechanism, with evidence it works and takes no more steps than giving consent did

GDPR Art.21 Right to object

Where processing is based on the performance of a public interest task, official authority or legitimate interests, including profiling on those bases, the data subject may object at any time on grounds relating to their particular situation, and processing must stop unless the controller demonstrat...

Evidence an auditor accepts: Objection records that distinguish direct marketing objections, which are absolute, from Article 21(1) objections, which are balanced; The compelling legitimate grounds analysis for every Article 21(1) objection that was refused; Evidence the right to object was presented clearly and separately at first communication, such as the template or screen as sent

CCPA/CPRA §1798.120 Honour the right to opt out of sale or sharing

Consumers may at any time direct a business selling or sharing their data to stop. The business must give notice that it may sell or share data and that this right exists, and after receiving the direction must not sell or share that consumer's data unless the consumer later consents. A business tha...

Evidence an auditor accepts: Opt-out preference store and the integrations that read it before any sale or sharing; Inventory of data flows that count as selling or sharing, including advertising pixels and SDKs; Due diligence checklist for acquired data sets carrying over opt-out status

ISO/IEC 27701:2019 7.2.4 Obtain and record consent

The organization must obtain and record consent according to its documented process, recording it so that on request it can produce the details of the consent given, including when it was given, the identity of the individual and the consent statement itself, having first provided the information re...

Evidence an auditor accepts: Consent records holding timestamp, individual identity and the exact statement consented to; The version of the information presented before consent, retained alongside; Evidence consent was freely given, meaning a real alternative existed

Do this for your whole CRM

Paste your field list and get this classification for every field at once, with the record of processing per object, the gaps, and the controls the register is evidence for. No account for the first run.

Build my field register

Phone or mobile number · Related person record (lookup)