Can notes, description or comments (free text) from a CRM be fed to an AI tool?

No. Keep it out of any model feed.

Every field · Free text and attachments

Notes, description or comments (free text)

Q: Is notes, description or comments (free text) personal data?

Depends on what it holds. Free-text fields hold whatever anyone typed: health, family, complaints, other people. Whether the field holds personal data, and how sensitive it is, depends on what was typed, which is why it cannot be minimised by design.

Free-text fields hold whatever anyone typed: health, family, complaints, other people. Whether the field holds personal data, and how sensitive it is, depends on what was typed, which is why it cannot be minimised by design.

depends on what it holds

personal data?

unknown until reviewed

sensitivity

never

AI use

depends on what is typed; assume the strictest data in it

lawful basis usually relied on

Keep it how long

Review and purge; free text cannot be retained by rule.

The gap we see most

Notes fields holding special category data ("off sick", "going through a divorce") that no retention rule will ever reach.

What holding it is evidence for

Requirement text and artefacts from a human-verified corpus licensed to Field Register.

Free text and attachments GDPR Art.5 · GDPR Art.15 · ISO/IEC 27701:2019 7.4.1 · ISO/IEC 27701:2019 7.4.7

GDPR Art.5 Principles relating to processing of personal data

Process personal data lawfully, fairly and in a transparent manner; collect it for specified, explicit and legitimate purposes and do not process it further in a way incompatible with those purposes; keep it adequate, relevant and limited to what the purpose needs; keep it accurate and up to date, e...

Evidence an auditor accepts: The purpose recorded for each processing activity, stated specifically enough that a later use can be tested against it; Retention schedule per data category with the criteria that set each period, and deletion evidence showing the schedule actually runs; Minimisation analysis per collection point showing why each field is necessary for the stated purpose

GDPR Art.15 Right of access by the data subject

On request, confirm whether personal data concerning the data subject is being processed and, where it is, provide access to that data together with the purposes, the categories of personal data, the recipients or categories of recipient including any in third countries or international organisation...

Evidence an auditor accepts: The search methodology showing every system, archive and unstructured store searched, and how completeness was assured; A worked response covering all the supplementary information items, not only the copy of the data; The redaction position and the applied redaction log where third party data was withheld, with a reason recorded per redaction

ISO/IEC 27701:2019 7.4.1 Limit collection

The organization must limit collection of personal data to the minimum that is adequate, relevant, proportional and necessary for the identified purposes, including data collected indirectly through means such as web and system logs, and where any optionality in collection and processing exists each...

Evidence an auditor accepts: Field level justification linking each item collected to an identified purpose; Assessment of indirectly collected data such as logs, telemetry and tracking; Evidence optional collection is off by default, captured from the live configuration

ISO/IEC 27701:2019 7.4.7 Retention

The organization must not retain personal data longer than the purposes for which it is processed require, developing and maintaining retention schedules that take account of legal, regulatory and business requirements and, where those requirements conflict, taking and documenting a business decisio...

Evidence an auditor accepts: Retention schedule covering every category of personal data, with the period and its justification; Evidence the schedule is enforced, not merely published; Documented risk based decisions where legal, regulatory and business requirements conflicted

Do this for your whole CRM

Paste your field list and get this classification for every field at once, with the record of processing per object, the gaps, and the controls the register is evidence for. No account for the first run.

Build my field register

Survey or NPS answer · Attachment or uploaded file