A CRM holds your most valuable list: customers and prospects. Protect it with access rules, logging and backups, and respect the data protection law that applies to personal data.
Basic controls
| Control | Why |
|---|---|
| Role-based permissions | Reps see only the leads they need |
| Two-factor login | Stolen passwords are not enough |
| Audit log | Who viewed, changed or exported what |
| Export restriction | Stops bulk download by one user |
| Backups | Recovery after failure or mistakes |
| Offboarding | Disable access the day someone leaves |
The DPDP Act in practice
India's Digital Personal Data Protection Act, 2023 sets duties for handling personal data. In general this means collecting data for a stated purpose, keeping it secure, being able to correct or delete it on request and handling consent properly. Rules and timelines are being phased in, so check current requirements with your legal advisor.
Practical steps
- Record the source and consent where relevant.
- Collect only fields you need.
- Delete or anonymise data you no longer need.
- Have a process to answer data requests.
- Train staff not to share lists on messaging apps.
Example role design
| Role | Typical access |
|---|---|
| Sales rep | Own leads and deals; no bulk export |
| Team lead | Team leads and reports |
| Sales manager | All leads, pipeline and targets |
| Accounts | Quotations, invoices and payments |
| Admin | Users, settings, backups; two-factor required |
Review access every quarter and remove users who have changed roles or left.
Note: This is general information, not legal advice.
Related guides: NexoraCRM - CRM Software for Sales, Service and WhatsApp
CRM Software IndiaCRM Implementation ChecklistWhatsApp CRM for Sales TeamsPrivacy Policy
A CRM That Protects Your Data
See roles, audit logs and two-factor login in a free NexoraCRM demo.
Book a Free Demo +91 98115 51004