CRM software and personal data: how the DPDP Act applies
Reviewed by Confidential Dispatch Editorial Team · Updated 31 Oct 2026 · 11 min read
Your CRM probably holds more customer personal data than any other system you use: leads, contacts, call notes, emails and often ID copies. Under India’s DPDP Act, your business is the Data Fiduciary and the CRM vendor is your Data Processor, so notice, consent, security, deletion and breach reporting stay with you, whichever CRM you use. Where your data is stored differs by vendor: Zoho, Salesforce and Freshworks offer India data centres, HubSpot doesn’t. Most CRMs have built-in privacy tools, but you have to switch them on.
Educational resource only. These are our findings from each company’s public documentation as of the “Last updated” date at the end of this page. Vendors change their products and terms, so check the current version before you rely on it. We don’t assess or certify any company’s compliance. This explains how India’s Digital Personal Data Protection Act, 2023 (DPDP Act) applies to your use of these tools; it is not formal legal advice.
The situation
Every enquiry from your website form, every lead your sales team adds, every call they log and every PAN copy they attach ends up in your CRM. It’s the system your business runs on, so it’s easy to forget that it’s also where most of your customers’ personal data lives. With the DPDP Act’s full obligations applying from 13 May 2027, the question is what that means for how you use it, and whether the CRM you picked changes anything.
Is any CRM “DPDP-compliant”?
That’s the wrong question: the DPDP Act puts the duties on your business, not on the software
You decide why customer data is collected and how it’s used, which makes you the Data Fiduciary. The CRM vendor stores and processes that data on your instructions, which makes it your Data Processor. The Act requires you to have a valid contract with any processor you use (Section 8), and you stay answerable for what happens to the data either way.
So no CRM makes you compliant, and none makes it impossible. What matters is whether your use of it delivers what the Act requires: a proper notice, valid consent where you need it, use limited to the stated purpose, security, deletion on time, and a way to handle requests and breaches. The vendor differences below are about how much help the tool gives you and where your data sits.
What personal data flows through a CRM?
Far more than names and phone numbers, and some of it arrives without anyone deciding to collect it
Whichever CRM you use, it typically holds:
- Lead and contact records: names, phone numbers, email addresses, company, address and any custom fields your team added.
- Web form entries: everything a person types into a form on your site that feeds the CRM, at the moment they submit it.
- Emails and call logs: if you connect Gmail or Outlook, or a telephony integration, the CRM stores email threads, call records and sometimes recordings.
- Notes and activity: free-text notes your team writes, which often hold more personal detail than any field does.
- Attachments: ID copies, signed forms, PAN or Aadhaar scans and other documents uploaded to a record. These are the most sensitive items in most CRMs, and the least visible.
What DPDP duties does your CRM create?
Each part of how you use the CRM maps to a specific duty
- Notice and consent at capture. A web form that feeds your CRM is a point of collection. It needs a clear notice of what you collect and why (Section 5), and separate, unticked consent for each purpose (Section 6), for example “contact me about this enquiry” apart from “send me offers”.
- Purpose limits. A lead who asked for a quote didn’t agree to your newsletter. Moving CRM contacts into a marketing campaign needs its own consent.
- Deletion on time. Leads that never converted and customers who left years ago are the commonest retention failure in any CRM. Once the purpose is over, the data has to be erased (Section 8).
- Security. Who can open attachments, who can export the full contact list, and whether ex-employees still have access are all part of your duty to protect the data.
- Rights requests. A customer can ask what you hold about them, ask you to correct it, or ask you to delete it. The CRM is usually where you’ll find it and act on it.
- Breaches. If CRM data is exposed, through a leaked export, a compromised login or a careless share, you must inform the Data Protection Board of India and the affected people.
Where does each CRM store your data?
Three of the five offer an India data centre; HubSpot doesn’t, and LeadSquared doesn’t publish where
The DPDP Act doesn’t require Indian data to stay in India: it allows transfers abroad except to countries the government restricts (Section 16), though some sector regulators set their own rules. You should still know where your data is, because it decides which country’s servers hold your customers’ records.
| CRM | India data centre? | How the region is set |
|---|---|---|
| Zoho CRM | Yes (Mumbai, with Chennai as backup) | By the country chosen at sign-up |
| Salesforce | Yes (an India region on its Hyperforce infrastructure) | Set for your account; ask Salesforce which region yours runs in |
| HubSpot | No (US, EU, Canada and Australia) | By your location at sign-up; paid accounts can move region |
| Freshsales | Yes (Mumbai) | Chosen at sign-up |
| LeadSquared | Not stated publicly | Ask LeadSquared before you sign up |
Zoho CRM
Zoho stores Indian accounts in India and has the most complete set of built-in privacy tools of the five
Zoho assigns each account to a data centre based on the country chosen at sign-up. India’s are in Mumbai (primary) and Chennai (secondary), and an India-region account logs in at a zoho.in address, so your login page tells you where you are.
Its privacy tools sit under the GDPR compliance settings (GDPR is the EU’s equivalent law), which are off until you turn them on. Once they’re on, you can record the basis on which you hold each record and track consent, with statuses such as pending and obtained. For rights requests, Zoho CRM can send a person a copy of their data as a CSV file, lock a record from further use, and delete it. When it deletes, it keeps the email address on a block-list, so the person isn’t imported again by mistake. Ordinary deleted records sit in the recycle bin for 60 days before they’re permanently removed, unless you empty them from there sooner.
Salesforce
Salesforce can run your account in India, but you need to confirm which region your account is on
Salesforce’s Hyperforce infrastructure lets accounts run in chosen regions, and India is one of them. Accounts set up before that, or through a partner, may run elsewhere, so ask Salesforce or your implementation partner where yours sits.
Deleted records go to the Recycle Bin and stay there for 15 days before Salesforce schedules them for permanent deletion. That matters for an erasure request: a record you “deleted” is still recoverable for those 15 days, and Salesforce’s bulk tools offer a hard delete that skips the Recycle Bin. Salesforce’s consent and privacy settings are extensive but need an administrator to set them up, so treat them as a project, not a switch.
HubSpot
HubSpot has no India data centre, so an Indian account’s data is stored abroad
Its data centres are in the US, the EU, Canada and Australia. Paid accounts are assigned a location based on where you sign up from, free accounts are hosted in the US, and paid customers can move their data to another HubSpot data centre from their account settings at no charge. None of these is in India. That’s allowed under the DPDP Act, but you’ll need the answer ready if a client or a sector regulator asks.
HubSpot’s data privacy settings let you record the legal basis for processing each contact, add notice and consent text to its forms and meeting links, show a cookie consent banner, and permanently delete a contact on request. Turn the data privacy settings on in your account before relying on any of these.
Freshsales
Freshworks, the Indian company behind Freshsales, runs a data centre in Mumbai and lets you pick the location when you sign up
If your account was created with another region, Freshworks support can advise on moving it. Check which region your account is in before you assume your data is in India.
Freshsales has a “Forget” action for a contact, lead, account or deal. Forgetting a contact permanently deletes its details, timeline, notes, tasks, call logs and recordings, meetings and marketing list memberships. Files and email conversations stay if they’re also tied to other records, so check those separately when a request has to be complete.
LeadSquared
LeadSquared is an Indian company, but its public pages don’t say which region holds your data
It hosts its service on Amazon Web Services across multiple regions and doesn’t publish which one serves Indian customers. Ask before you sign up, and get the answer in writing.
Its Data Protection and Privacy settings include an email opt-in flow that logs each opt-in and opt-out with the date and IP address, a page where leads can ask to view, update or delete their data, and a cookie consent banner. Requests to view, update or delete come to you to complete by hand. A separate setting permanently removes a deleted lead’s backup copy, which you need for an erasure request to be final.
How to set up any CRM for the DPDP Act
The steps are the same whichever CRM you use; only the setting names change
- Find out where your data is storedUse the table above, then confirm for your own account.
- Turn on the privacy settingsMost CRMs ship with consent and privacy tools switched off and named for GDPR. Turn them on and use them to record DPDP consent: when it was given, how, and for what. As the DPDP Act’s 13 May 2027 deadline approaches, you can expect most large Indian platforms, and those that operate in India, to launch features in line with the Act. Keep an eye on your CRM’s privacy settings, release notes and announcements to see what has changed.
- Fix your web formsAdd a notice above the submit button and separate, unticked checkboxes for each purpose, and cut any field the purpose doesn’t need.
- Lock down attachments and exportsUse roles and permissions so only the people who need ID copies can open them, and limit who can export records in bulk.
- Set a retention rule and act on itDecide how long a dead lead or a former customer stays, then delete on schedule. Check how long your CRM’s recycle bin keeps deleted records, and empty it when a deletion has to be final.
- Have a process for rights requestsKnow how your CRM exports, corrects and permanently deletes one person’s data, and who on your team does it.
- Keep fewer documents in the CRMIf your team attaches PAN or Aadhaar copies to records, ask whether the CRM needs them at all. A record that notes “KYC verified on 4 Nov” carries far less risk than one holding the scan.
FAQ
Which CRM is DPDP-compliant?
None of them is “compliant” or “non-compliant” on its own. The DPDP Act’s duties fall on your business as the Data Fiduciary. What the CRM changes is how much help it gives you, through consent tracking, deletion and export tools, and where your data is stored.
Which CRMs store data in India?
Zoho CRM stores Indian accounts in Mumbai and Chennai. Salesforce offers an India region, and Freshworks runs a Mumbai data centre for Freshsales; in both cases, confirm the region your own account uses. HubSpot has no India data centre, and LeadSquared doesn’t state its regions publicly.
Is it illegal to use a CRM that stores data outside India?
No. The DPDP Act allows personal data to be transferred abroad except to countries the government restricts. Some sector regulators, such as RBI for payment data, set stricter rules of their own, so check those if they apply to you.
Do I need a contract with my CRM vendor under the DPDP Act?
Yes. The Act requires a valid contract with any Data Processor that handles personal data for you. Check that your agreement with the vendor covers processing on your behalf, and keep a copy with your compliance records.
Will my CRM add DPDP features?
As the DPDP Act’s 13 May 2027 deadline approaches, you can expect most large Indian platforms, and those that operate in India, to launch features in line with the Act. Keep an eye on your CRM’s privacy settings, release notes and announcements to see what has changed.
Can I use my CRM’s GDPR features for DPDP?
Yes, as tools. They were built for the EU law, but recording consent, honouring access and deletion requests, and restricting records all map onto DPDP duties. Use Indian terms in your notices and records, not GDPR ones.
Every article is checked against the current law and the judgments it cites before it is published.
Updated 31 October 2026 · Not legal advice.
