Map customer success software data protection duties before you sign

What to take away

Decide who the controller is before anything else. If your customer success software holds names, emails or usage records, that is your business, not the vendor's.
Choose and record a lawful basis before the first campaign, because consent and legitimate interests carry different rules.
Keep a retention schedule and a deletion log you could show a regulator.
Check vendor terms, sub-processors and transfer routes before signing.

Start with the role you hold

Most retention teams assume the software vendor carries the compliance load. That is wrong. Under the UK GDPR, your business decides why personal data is processed, so your business is the controller. The vendor is a processor acting on your instructions.

Controller vs processor duties

Controller (your business)

Decides why data is processed: Yes
Decides how long data is kept: Yes
Acts on instructions: Sets them
Chooses lawful basis: Yes
Handles data for you: No

Processor (vendor)

Decides why data is processed: No
Decides how long data is kept: No
Acts on instructions: Follows them
Chooses lawful basis: No
Handles data for you: Yes

Those duties reach England, Scotland, Wales and Northern Ireland, because the UK GDPR and the Data Protection Act 2018 apply across the UK.

Your team decides who enters a health score and how long a lapsed contact stays live. Those are controller decisions.

For contracts, access requests and audit trails, the customer success software UK rules and compliance guide sets out the wider framework.

Choose a lawful basis before the first campaign

Customer success platforms blur the line between service messages and marketing. A renewal reminder tied to a live contract differs from a product upsell.

Lawful basis per use case

Service messages

Example: Renewal reminder
Lawful basis: Contract
Evidence needed: Contract record
Opt-out handling: Service rules

Marketing

Example: Product upsell
Lawful basis: Consent
Evidence needed: Consent record
Opt-out handling: Consent withdrawal

The ICO's guidance on choosing your lawful basis for direct marketing explains why consent and legitimate interests need different evidence and different opt-out handling.

Record the basis per use case, not per platform. One record might be held under contract for service, under consent for marketing and under legitimate interests for analytics. Mixing them creates a problem you cannot unpick later.

Opt-outs need to travel with the record. If a contact withdraws consent, the suppression flag must survive every later import and enrichment job. Test that path before a campaign, not during one.

If you also run lead generation from the same platform, the customer success software advertising rules cover what your consent prompts and claims must say.

Set retention limits and keep evidence

A retention schedule is the part of customer success software data protection that auditors ask for first. It states, per category, how long records stay live and what happens afterwards.

What counts as a retention schedule

A schedule lists data categories, a retention period, a reason and an owner. For example, a team might keep closed churn tickets for 24 months and dashboard telemetry for 13 months. The period should follow a stated need, not a platform default.

Retention periods should be shorter for behavioural data than for contract records.

What a deletion request covers

A valid erasure request reaches backups, exports, spreadsheets and the vendor's own logs. Test the path once in a sandbox, and record where it stalled. Do that before a live request arrives, not during one.

Keep the schedule, the deletion log and the business owner's sign-off together. Regulators ask how you applied the rule, not whether a policy exists.

Check vendors before you sign

Map the duties into the contract

Ask in writing where data is stored, which sub-processors touch it and how deletion works at contract end. Also request evidence for each duty below, and make the agreed responsibilities part of the contract.

Article 28 — data processing agreement:If the vendor processes personal data for you, document the processing and the parties’ responsibilities. Cover your instructions, confidentiality, security, sub-processor authorisation and change notices, assistance with data subject requests and breaches, audit rights, and return or deletion of data when the arrangement ends.
Article 30 — records of processing:Keep an applicable record of the customer-success processing you control, including its purposes, data categories, recipients, transfers and planned erasure periods. Confirm which records the vendor keeps for its own processing.
Article 32 — security:Agree how the vendor will apply appropriate technical and organisational security measures, and obtain evidence relevant to the data and risks in your service.
Articles 33 and 34 — personal data breaches:Require the processor to notify you without undue delay. Where a breach is reportable, the controller must notify the ICO without undue delay and, where feasible, within 72 hours of becoming aware; tell affected people without undue delay when the breach is likely to create a high risk. Agree an incident escalation route that gives you time to act.
Article 35 — data protection impact assessment:Assess whether the planned processing is likely to result in high risk and, if so, complete a DPIA before it begins. Check that the vendor will provide information and assistance for it.
Article 15 — access requests:The controller handles the response to a data subject access request. Agree how the vendor will help locate and provide the relevant records in time for you to respond.
Restricted international transfers:Identify the destination and transfer route. Where required, check that the International Data Transfer Agreement (IDTA) or the UK Addendum to the EU Standard Contractual Clauses is in place.

Finally, check whether your organisation must pay the ICO data protection fee under the Data Protection (Charges and Information) Regulations 2018. A vendor subscription does not settle your organisation’s separate obligations.

Glossary

Controllerthe body that decides why and how personal data is used.
Processora supplier that handles data only on the controller's instructions.
Lawful basisthe UK GDPR condition that permits one stated processing purpose.
Retention schedulea document setting how long each data category is kept.
Sub-processora supplier the vendor uses to help run the service.

Common questions

How long can we keep a churned customer's record?

There is no single legal period. Set one from a stated business need, review it at renewal, and delete on schedule. If you cannot explain the period, shorten it.

Do we need consent for every retention email?

No. Messages about an existing contract are usually covered by that contract. Promotional content needs consent or a properly assessed legitimate interest, and the ICO guidance above sets out the test.

Who answers if the vendor has a breach?

The processor must tell you about a breach without undue delay. Your business still answers to the regulator, because you chose the vendor. Individual cases need a qualified adviser.