Can lead score, propensity or ranking from a CRM be fed to an AI tool?

Only with a lawful basis for profiling and a notice that says so; check Art. 22 where a decision follows.

Every field · Behaviour, engagement and scoring

Lead score, propensity or ranking

Q: Is lead score, propensity or ranking personal data?

Personal data. A score derived about a person is profiling (Art. 4(4), Art. 22). The person must be told scoring happens and on what.

A score derived about a person is profiling (Art. 4(4), Art. 22). The person must be told scoring happens and on what.

personal data

personal data?

standard

sensitivity

needs a basis

AI use

legitimate interest with a notice; consent where it produces significant effects

lawful basis usually relied on

Keep it how long

Recompute; do not keep score history beyond the model window.

The gap we see most

Scores fed by web-tracking data that was never covered by consent.

What holding it is evidence for

Requirement text and artefacts stated in our own words from the published standards.

Scoring and profiling of people GDPR Art.22 · GDPR Art.13 · GDPR Art.35 · CCPA/CPRA CCR 7220 · ISO/IEC 27701:2019 7.3.10

GDPR Art.22 Automated individual decision-making, including profiling

Do not subject a data subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning them or similarly significantly affects them, unless the decision is necessary for entering into or performing a contract between the data subject and the co...

Evidence an auditor accepts: An inventory of automated decisions with the assessment of whether each produces legal or similarly significant effects; The exception relied on for each in scope decision, and for contract based ones the necessity reasoning rather than a convenience argument; The human intervention process, showing the reviewer has the authority and the information to change the outcome

GDPR Art.13 Information to be provided where personal data are collected

Where personal data is collected from the data subject, provide at the time it is obtained the identity and contact details of the controller and any representative, the contact details of the data protection officer, the purposes and the legal basis, the legitimate interests where that is the basis...

Evidence an auditor accepts: The privacy notice mapped item by item against every information element Article 13 lists; Evidence of the point and timing at which the notice is presented for each collection channel, including forms, telephone and in person; The storage periods or criteria as published, reconciled against the actual retention schedule

GDPR Art.35 Data protection impact assessment

Where a type of processing, in particular using new technologies and taking account of the nature, scope, context and purposes of the processing, is likely to result in a high risk to the rights and freedoms of natural persons, carry out an assessment of the impact of the envisaged processing operat...

Evidence an auditor accepts: The screening or threshold process applied to new and changed processing, with its outcomes recorded including the negative ones; Completed assessments checked against the four minimum content elements Article 35(7) requires; The data protection officer's advice sought and given on each assessment, recorded as advice rather than as approval

CCPA/CPRA CCR 7220 Give a pre-use notice before using ADMT for significant decisions

Applies from 1 January 2027 to ADMT already in use for significant decisions, and from first use for later deployments (7200). Before collecting the data to be processed by the ADMT, or before repurposing data already held, the business must give a prominent pre-use notice in its usual channel stati...

Evidence an auditor accepts: Pre-use notice text for each ADMT used for a significant decision; Inventory of ADMT uses with the significant decision each supports; Description of the alternative process for consumers who opt out

ISO/IEC 27701:2019 7.3.10 Automated decision making

The organization must identify and address the obligations, including legal obligations, that it owes to individuals arising from decisions it makes about them based solely on automated processing of their personal data, taking account of jurisdictions that impose specific obligations where such dec...

Evidence an auditor accepts: Inventory of decisions made solely by automated processing, with their effect on individuals assessed; Obligations register per jurisdiction for those decisions; Notification content disclosing the existence and logic of automated decision making

Do this for your whole CRM

Paste your field list and get this classification for every field at once, with the record of processing per object, the gaps, and the controls the register is evidence for. No account for the first run.

Build my field register

Call recording or transcript · Email opens and clicks