How long should a company keep CRM records?

Why one retention period does not fit a CRM#

A CRM retention period cannot be a single number because a CRM holds three different kinds of record at once: personal data about people, commercial records about deals and contracts, and the company's own reasoning in notes and activities. Each kind is governed by different rules and carries different value.

Privacy laws such as GDPR and CCPA may apply to the personal data and generally expect it to be kept no longer than its purpose requires. B2B contacts are not automatically outside those rules: California's temporary CCPA exemption for business-to-business personal information expired on January 1, 2023. Tax, accounting and contract obligations pull the other way for records that support invoices and agreements, and notes and activities sit in between, which is where most companies either keep everything by accident or delete their most useful history in a cleanup.

Retention logic for each CRM object#

Retention logic works best when it is written per object in Salesforce, HubSpot, Dynamics or Pipedrive, with a trigger that starts the clock and an action at the end. The table gives the usual reasoning; the actual periods come from your counsel and your own policy, not from a generic list.

Which rules come from law and which come from you?#

Some CRM retention rules come from law or contract, and the rest are business choices you are free to set. Legal and contractual sources include tax and accounting retention for records that support invoices, terms in customer agreements, open disputes, legal holds and privacy laws that may apply to the people in your database.

Tax rules usually set the floor for accounts and won deals that support revenue. The IRS says to keep records supporting income, deductions or credits until the period of limitations for that return runs out: generally 3 years, 6 years if unreported income exceeds 25 percent of the gross income shown, 7 years for a bad debt deduction, and indefinitely if no return or a fraudulent return was filed. The invoice usually lives in the accounting system, so decide whether the CRM copy needs to follow the same period.

Everything else is policy: how long a cold lead stays useful, whether to keep lost deals for win-loss analysis, how much activity history the sales team needs. Write those choices down with a reason, because a documented business purpose is also what privacy laws generally expect. This is general information, not legal advice, and the specific periods should be confirmed with counsel.

A CRM cleanup sequence that keeps the useful history#

A CRM cleanup should start with a full export and end with a log, so that nothing is lost by accident and every deletion can be explained later. The order matters because bulk deletions in most CRMs cascade to related records, and a recycle bin is not an archive: HubSpot, for example, lets users restore deleted records and activities for up to 90 days, after which they are permanently deleted.

Check how your CRM exports activity history before you rely on an export. HubSpot's standard record export includes current property values and associations, but calls, notes and other activities need a separate export method. Where history is useful but identities are not needed, pseudonymizing personal fields can be an alternative to deletion, but GDPR Recital 26 treats pseudonymized data that can be re-linked with additional information as personal data, so treat that as a decision for counsel.

• 1Step 1: export the full CRM, including activities, notes, attachments and history objects, with record IDs, using a separate activity export where the standard one leaves activities out.
• 2Step 2: list each object and its retention trigger, such as last activity, contract end or opt-out date.
• 3Step 3: confirm with counsel that no legal hold or dispute covers the records in scope.
• 4Step 4: run deletions object by object, starting with unconverted leads and stale contacts.
• 5Step 5: check that related deals, activities and notes you meant to keep were not removed by cascade.
• 6Step 6: log what was deleted, when, under which rule and by whom, and update the written policy.

Illustrative: a HubSpot cleanup at a quality software vendor#

Illustrative: a fictional quality management software company selling to manufacturers ran HubSpot for marketing and sales. Years of trade show scans and webinar sign-ups had filled the database with contacts who never engaged, while deal records held detailed notes on evaluations, pilots and renewal negotiations.

The COO and CFO set rules per object. Unconverted leads with no activity over a set period were reviewed and deleted, consent and unsubscribe records were kept, and accounts and won deals followed contract and invoice retention. Deal notes and activities on customer accounts were kept deliberately as sales history. The database shrank, marketing risk fell, and the reasoning behind every won and lost deal stayed intact.

Why deal notes and activities deserve a second look#

Deal notes and activities deserve a second look because they record how the company actually sells: what prospects objected to, how pricing was negotiated, why a deal stalled and what changed at renewal. That history trains new sales hires, explains win rates and feeds forecasting.

It is also the part of a CRM that AI developers find most useful when they license business records, because it is human-written reasoning tied to an outcome. Any such use depends on customer contracts, privacy notices and the removal of personal details, and it is assessed deal by deal with counsel.

How SourceX looks at CRM history#

SourceX looks at CRM history through the SourceX Enterprise Data Value Framework, where human-generated signal, recency, data cleanliness and rights raise value and privacy burden reduces net value. A CRM with clean stage history and written deal notes rates very differently from a large contact list with no activity.

Assessment begins with a description of the CRM rather than an export: the platform, the objects in use, how far back activities go and which note fields teams actually fill in. Deal notes, if included, pass through the Preparation step of the SourceX five-step transaction, Supply, Rights, Preparation, Approval and Delivery, where personal details are removed before the company approves any release, and the records are licensed, not sold.