CRM hygiene is an operations job. In the EU it is also a legal duty.

What is CRM hygiene?

CRM hygiene is the ongoing work of keeping records accurate, complete, deduplicated and current enough to route leads, forecast revenue and report on. It is a maintenance function rather than a project, because records decay continuously as people change jobs, companies restructure, and reps enter data inconsistently.

Three things are usually meant by it: fields hold true values, one real person or company maps to one record, and stale records are either refreshed or removed.

What the GDPR requires

Article 5(1) of the GDPR lists six principles that apply to all processing of personal data. The fourth is accuracy, and it is stricter than most CRM owners expect.

The wording that matters for operations is "every reasonable step" and "without delay". Neither is defined as a number, which means the standard is what a reasonable controller in your position would do, and you are the one who has to be able to describe it.

Two neighbouring provisions tighten this further. Article 5(1)(e), storage limitation, says personal data must be kept "for no longer than is necessary for the purposes for which the personal data are processed", so a contact record nobody has touched in four years is a retention question as well as a data-quality one. A migration is the moment that question gets answered or ducked, and it is worth settling who holds the data while it moves before anything is exported. And Article 5(2) states that "the controller shall be responsible for, and be able to demonstrate compliance with, paragraph 1".

That last clause is the one that converts hygiene from an intention into a process. Demonstrating compliance requires evidence, and evidence requires a repeatable check with a record of its results.

Why CRM records decay

Records go stale for ordinary reasons: people change jobs and job titles, companies rebrand or get acquired, phone systems change, and reps type into free-text fields that nobody validates.

You will see confident annual decay percentages quoted across the industry. Treat them carefully. The most widely repeated figures trace back through vendor blogs to studies that are either a decade old or not published in a form you can inspect, and the same number is often attributed to different originators depending on who is citing it. A benchmark you cannot verify is a poor basis for a budget, and under Article 5(2) it is not evidence of anything. Measure your own instead.

How to audit CRM hygiene

Six steps. It takes an afternoon, it produces a number that is true about your database, and it leaves the written record that accountability requires.

1. 1.
   Pull 200 records at random

   Filter to contacts created more than six months ago, then sort randomly. Not your best accounts, not the ones a rep touched last week. A biased sample returns a comforting number.

2. 2.
   Freeze the sample outside the CRM

   Export the record ID, created date, and the fields you actually route and report on: email, job title, company, phone. Verify in a sheet, not in the CRM, or you edit the evidence while you collect it.

3. 3.
   Check each field independently

   Email against a validation service. Job title and company against the person's current public profile. Mark each field valid, stale or unknown, and keep unknown as its own bucket rather than folding it into either.

4. 4.
   Score per field, never per record

   A record with a good email and a dead title is not 50% decayed. It is a routable record with a broken personalisation token. Four separate rates tell you what to fix. One blended rate does not.

5. 5.
   Divide by the age of the sample

   If the sample averages 14 months old and 21% of job titles are stale, title decay runs at roughly 18% per year. It is a 200-record sample, so treat the output as a range.

6. 6.
   Keep the sheet, then re-run in 90 days

   The saved sheet is your Article 5(2) evidence: what you checked, when, and what you found. One measurement is a snapshot. Two is a trend, and the trend tells you whether the fix held.

At 200 records the margin is roughly seven percentage points either way at 95% confidence. That is enough to distinguish 10% decay from 30%, which is the decision you are actually making.

What your result tells you to fix

Decay is usually a missing rule about who updates what and when, which is one layer of the wider system it sits in.

If job titles decay fast and emails hold, the problem is enrichment cadence rather than list quality. If emails decay fast, the problem is where the list came from. If everything decays fast on records from one source, you have found a broken intake.

That last case is the common one, and it is why cleanup as a one-time project rarely holds. The records are the symptom. The form, the import, the integration or the rep habit that produced them is the cause, and cleaning without closing the intake puts you back within a quarter. It is also the weakest position under Article 5(1)(d), because repeating a cleanup you know will decay again is difficult to describe as every reasonable step.