SuiteCRM for GDPR consent and lawful basis

The lawful basis for each contact group is a decision the controller makes before any personal data is recorded in SuiteCRM, and it is not a setting that the software can make for you. Article 6(1) of the GDPR allows processing only where at least one of six bases applies: consent, performance of a contract, a legal obligation, vital interests, a public task or official authority, or legitimate interests. The Lawful Basis fields in SuiteCRM let you record the choice against each contact, but the choice itself has to be justified by your organization's purpose, relationship and legal position before it is entered. Treat the mapping as a register that your data protection lead owns, with one row per contact group, the purpose it serves and the basis chosen for it.

If the basis is consent, the controller must be able to demonstrate that the data subject consented under Article 7(1), and consent must be freely given, specific, informed and unambiguous. In practice, a single checkbox that bundles newsletters, event invitations and sharing with partners will usually fail the specific test, so each purpose needs its own request. Article 7(3) requires that withdrawal be possible at any time and be as easy as giving consent. That has a direct consequence for the CRM design: the route to withdraw must be as simple as the route to opt in, and the record must show when and how the choice was made and changed. Before relying on consent for a group, confirm with your legal counsel that the wording, the separation of purposes and the withdrawal route meet these tests.

If the basis is legitimate interests, the controller needs a documented assessment that balances its interest against the rights and expectations of the people concerned. That assessment is a document held by the organization, and it does not live in a SuiteCRM field. Record a reference to it on the contact group or in the mapping register, and keep it current when the purpose or data changes. Direct marketing is a special case: under Article 21(2) and (3), the data subject may object at any time, and processing for that purpose must stop. Your assessment should therefore state how objections are received, routed to the team that maintains the marketing lists and applied in the CRM, so that the basis is not only justified on paper.

Use the EDPB guidelines and the decisions of your competent national supervisory authorities as the reference for interpreting these bases, because the GDPR is directly applicable in every EU Member State and in the EEA states that apply it under the EEA Joint Committee decision. The European Data Protection Board issues guidelines that national authorities take into account, and the supervisory authority in your main establishment or in each relevant country is the body that will assess your position. Read the relevant EDPB guidance alongside the GDPR text itself, and record which guidance you relied on. The Lawful Basis guidance in the SuiteCRM user guide explains how the fields work, but it does not decide which basis applies to your contacts.

Before you configure any field, agree the full mapping with your legal counsel and sign it off. Confirm which contact groups exist, the purpose for each, the basis chosen, the documents that support it and the owner who reviews the choice when the business changes. Ask counsel to confirm whether any group relies on a basis that the CRM cannot evidence on its own, such as an assessment or a signed notice held elsewhere, and plan where those records will be kept. Agree the review cadence in writing so that a change in product, country or purpose triggers a review of the mapping before the data is reused.

The consent evidence in SuiteCRM can itself be personal data. The Lawful Basis value, the consent capture fields and the change log together show which contact consented, to what, and when. Where a controller relies on consent, Article 7(1) of the GDPR requires it to demonstrate that consent, so these records must be protected like the contact data they describe. The location question therefore covers more than the database server. It also covers backups, file storage, logs and any screen a support engineer sees. The EDPB Guidelines 05/2021 (version 2.0) state that remote access from a third country, even only displaying data on a screen for support or administration, is a transfer. Storage in a cloud outside the EEA is also a transfer. Chapter V of the GDPR, Articles 44 to 50, then applies.

The Court of Justice of the EU, in Case C-311/18 (Schrems II) on 16 July 2020, invalidated the EU-US Privacy Shield adequacy decision 2016/1250 but held that standard contractual clauses remained valid. Commission Implementing Decision (EU) 2023/1795 finds adequate protection for US organizations only where they appear on the Data Privacy Framework List. An appeal against the General Court's September 2025 judgment upholding that decision is pending as Case C-703/25 P. For any US-linked hosting or support provider, check its listing status directly against the official list, and ask the provider to confirm it in writing. Do not treat a sales statement about compliance as the evidence.

The US CLOUD Act matters even when data sit in the EEA. The provision at 18 U.S.C. 2713, added on 23 March 2018, requires electronic communication and remote computing service providers to preserve or disclose data in their possession, custody or control, whether inside or outside the United States. EDPB Guidelines 05/2021 (Example 12) say that using an EU processor subject to third-country law with extraterritorial effect is not itself a transfer, but complying with a third-country authority request would be. Controllers should therefore assess that exposure before engaging such a processor. GDPR Article 48 allows a third-country court judgment or administrative decision requiring disclosure to be recognized or enforced only if it rests on an international agreement, such as a mutual legal assistance treaty. EDPB Recommendations 01/2020 say that where a provider needs data in the clear and the destination's public authority powers go beyond what is necessary and proportionate, the EDPB cannot envision an effective technical supplementary measure.

Before engaging a hosting provider, implementation partner or support vendor that can reach the SuiteCRM instance, map every location and access path. Record the hosting region, backup locations, log and file storage, sub-processors, and the method each support engineer uses to connect. For each path, identify the transfer mechanism, whether the provider is subject to third-country law, and what the contract says about government requests. Ask the provider how it handles such requests, and have counsel review the wording. Transfer breaches under Article 83(5)(c) can carry fines of up to EUR 20 million or 4% of worldwide annual turnover, whichever is higher, so the map should be kept current.

This section does not decide whether any particular transfer is lawful. That depends on the facts of your deployment, the contracts you sign and the data you hold, so take legal advice before relying on any transfer mechanism. Counsel can assess whether standard contractual clauses under Commission Implementing Decision (EU) 2021/914 are appropriate, what supplementary measures are needed, and how the answer changes if the provider's remote access or storage moves. The GDPR text remains the baseline for this analysis, and the proposed amendments tracked by the European Parliament Legislative Observatory have not changed it as of October 2026.

Most of the delay on a consent and lawful basis project comes from inputs that the implementation team cannot produce on its own. Before any configuration starts, your team should assemble the current consent wording, every place it is shown, and the source of each contact record. Ask marketing and sales operations to export the wording from each web form, landing page, newsletter sign-up and event registration, with the date each version went live. Without that history, the team cannot tell which contacts were asked under which words, and the consent evidence the CRM is meant to record has nothing to point to.

The second input is a data map of the contact fields. List every field in SuiteCRM that holds personal data about a lead, contact or account contact, including custom fields added for campaigns, and note who enters it, which import jobs write to it and which integrations read it. The map should also show where the same person's data sits outside SuiteCRM, such as an email marketing tool or a web form provider. This list tells the implementer which Lawful Basis fields and change log behavior apply to which records, and it shows where data could be recorded without a basis at all.

Legal counsel or your data protection lead must make the basis decisions before build starts. For each processing activity, counsel should state whether the basis is consent, legitimate interests, contract or another option, and whether a marketing objection process applies to it. Ask for these decisions in writing, with the wording each one relies on. The implementer will set Lawful Basis values and workflow rules from that record, so the decisions need an owner and a date. Confirm also who signs off changes to the basis rules later, because a new campaign type may need a new decision.

Plan access before the build begins. Name an administrator who can change SuiteCRM configuration, a contact who can approve field and workflow changes, and a legal or privacy contact who can answer questions about edge cases during testing. Provide read access to the existing web forms and their hosting, and confirm which systems create or update leads. Also provide a staging instance that matches the production SuiteCRM version and customizations, with a recent copy of data that has been handled under your own data protection rules. Testing consent changes on a copy that differs from production gives results that do not carry over.

Finally, agree the scope in writing before work starts. The written scope should list the modules, forms, fields, campaign types and integrations in and out of the project, the decisions counsel has signed off, and the acceptance tests that will show each consent path works. Items left outside the scope, such as the email delivery service or a consent management platform, should be named so that nobody assumes they are covered. A fixed scope also makes it clear which work is quoted up front and which changes would need a separate change request.