Can survey or nps answer from a CRM be fed to an AI tool?

Only with a lawful basis for profiling and a notice that says so; check Art. 22 where a decision follows.

Every field · Behaviour, engagement and scoring

Survey or NPS answer

Q: Is survey or nps answer personal data?

Personal data. Survey answers are opinions the person gave for a stated purpose; reuse for profiling needs a compatible purpose.

Survey answers are opinions the person gave for a stated purpose; reuse for profiling needs a compatible purpose.

personal data

personal data?

standard

sensitivity

needs a basis

AI use

consent or legitimate interest

lawful basis usually relied on

Keep it how long

12 to 24 months.

The gap we see most

Free-text survey answers holding complaints about named staff.

What holding it is evidence for

Requirement text and artefacts from a human-verified corpus licensed to Field Register.

Free text and attachments GDPR Art.5 · GDPR Art.15 · ISO/IEC 27701:2019 7.4.1 · ISO/IEC 27701:2019 7.4.7

GDPR Art.5 Principles relating to processing of personal data

Process personal data lawfully, fairly and in a transparent manner; collect it for specified, explicit and legitimate purposes and do not process it further in a way incompatible with those purposes; keep it adequate, relevant and limited to what the purpose needs; keep it accurate and up to date, e...

Evidence an auditor accepts: The purpose recorded for each processing activity, stated specifically enough that a later use can be tested against it; Retention schedule per data category with the criteria that set each period, and deletion evidence showing the schedule actually runs; Minimisation analysis per collection point showing why each field is necessary for the stated purpose

GDPR Art.15 Right of access by the data subject

On request, confirm whether personal data concerning the data subject is being processed and, where it is, provide access to that data together with the purposes, the categories of personal data, the recipients or categories of recipient including any in third countries or international organisation...

Evidence an auditor accepts: The search methodology showing every system, archive and unstructured store searched, and how completeness was assured; A worked response covering all the supplementary information items, not only the copy of the data; The redaction position and the applied redaction log where third party data was withheld, with a reason recorded per redaction

ISO/IEC 27701:2019 7.4.1 Limit collection

The organization must limit collection of personal data to the minimum that is adequate, relevant, proportional and necessary for the identified purposes, including data collected indirectly through means such as web and system logs, and where any optionality in collection and processing exists each...

Evidence an auditor accepts: Field level justification linking each item collected to an identified purpose; Assessment of indirectly collected data such as logs, telemetry and tracking; Evidence optional collection is off by default, captured from the live configuration

ISO/IEC 27701:2019 7.4.7 Retention

The organization must not retain personal data longer than the purposes for which it is processed require, developing and maintaining retention schedules that take account of legal, regulatory and business requirements and, where those requirements conflict, taking and documenting a business decisio...

Evidence an auditor accepts: Retention schedule covering every category of personal data, with the period and its justification; Evidence the schedule is enforced, not merely published; Documented risk based decisions where legal, regulatory and business requirements conflicted

Do this for your whole CRM

Paste your field list and get this classification for every field at once, with the record of processing per object, the gaps, and the controls the register is evidence for. No account for the first run.

Build my field register

Website visits, page views, sessions · Notes, description or comments (free text)