Can personal name from a CRM be fed to an AI tool?

Only with a lawful basis for profiling and a notice that says so; check Art. 22 where a decision follows.

Every field · Identifiers

Personal name

Q: Is personal name personal data?

Personal data. A name identifies a person directly. It is personal data in every regime.

A name identifies a person directly. It is personal data in every regime.

personal data

personal data?

standard

sensitivity

needs a basis

AI use

contract or legitimate interest

lawful basis usually relied on

Keep it how long

With the relationship, then per your retention schedule (commonly 2 to 7 years after the last interaction).

The gap we see most

Full name split across inconsistent fields (first, last, full, nickname) so deletion requests miss copies.

What holding it is evidence for

Requirement text and artefacts from a human-verified corpus licensed to Field Register.

Direct identifiers (name, email, phone) GDPR Art.6 · GDPR Art.13 · GDPR Art.30 · ISO/IEC 27701:2019 7.2.8

GDPR Art.6 Lawfulness of processing

Process personal data only where at least one lawful basis applies: the data subject's consent, necessity for a contract with the data subject or pre-contractual steps at their request, compliance with a legal obligation, protection of vital interests, performance of a public interest task or exerci...

Evidence an auditor accepts: A lawful basis recorded per processing activity, not per system or per department; Legitimate interests assessments showing the interest pursued, the necessity test and the balancing against the data subject's rights; The Union or Member State provision cited where the basis is legal obligation or public task

GDPR Art.13 Information to be provided where personal data are collected

Where personal data is collected from the data subject, provide at the time it is obtained the identity and contact details of the controller and any representative, the contact details of the data protection officer, the purposes and the legal basis, the legitimate interests where that is the basis...

Evidence an auditor accepts: The privacy notice mapped item by item against every information element Article 13 lists; Evidence of the point and timing at which the notice is presented for each collection channel, including forms, telephone and in person; The storage periods or criteria as published, reconciled against the actual retention schedule

GDPR Art.30 Records of processing activities

Maintain a written, including electronic, record of processing activities under the controller's responsibility containing the name and contact details of the controller, any joint controller, the representative and the data protection officer, the purposes of the processing, a description of the ca...

Evidence an auditor accepts: The record of processing activities in full, checked against the seven controller elements, or the four processor elements, the Article lists; Version history showing when each entry was last reviewed and by whom; Reconciliation of the record against a system inventory or data flow map, to show nothing is missing rather than that the entries read well

ISO/IEC 27701:2019 7.2.8 Records related to processing PII

The organization must determine and securely maintain the records that support its obligations for processing, typically an inventory of processing activities covering the type of processing, its purposes, the categories of personal data and of individuals including any special cases such as childre...

Evidence an auditor accepts: Processing inventory carrying each required element; Named owner accountable for its accuracy and completeness; Evidence the inventory is maintained through change, not rebuilt for audits

Do this for your whole CRM

Paste your field list and get this classification for every field at once, with the record of processing per object, the gaps, and the controls the register is evidence for. No account for the first run.

Build my field register

Given name · Department or team