Data cleaning for CRM imports
Privacy and GDPR
How to clean customer data without breaking GDPR
Cleaning a contact list feels like a chore, not a legal event. But a list of names, emails, and phone numbers is personal data, and cleaning it, deduping it, reformatting it, is processing under GDPR. That does not mean you cannot do it. It means the tool you reach for and where the data ends up are compliance decisions. Here are the practical rules, in plain terms, and the one habit that removes most of the risk.
Clean a list on your device, free →
The rule that catches people out
The most common mistake is not a dramatic one. It is dropping a customer list into the first free "clean my CSV" tool a search turns up, or pasting it into a chatbot, to save ten minutes. The moment that data leaves your device, you have handed personal data to a third party. Now you are responsible for whether they are a vetted processor, whether you have an agreement with them, where their servers are, and whether "we delete files after processing" is actually true. Most people never check, and that gap is the risk.
The practical rules
1. Minimize what you handle
Work with only the fields you actually need for the task. If you are preparing a list for a CRM import, you probably do not need to be moving around every sensitive field in the export. Less personal data in play means less to protect and less to explain.
2. Keep a lawful basis and a purpose
You should already have a lawful basis for holding the list at all, consent, legitimate interest, or a contract. Cleaning it for a legitimate purpose like a migration or an import fits within that. Cleaning it is not a reason to start using it for something new.
3. Don't send it to tools you haven't vetted
Before a customer list goes into any online tool, you would normally want a data processing agreement with the vendor, clarity on where they store data, and clarity on retention. If you cannot answer those questions, the safe move is not to upload. This is exactly the objection practitioners raise about upload-based cleaners: when someone promises files are "deleted after processing", the fair follow-up is "prove it", and you usually cannot.
4. Watch international transfers
If a tool's servers sit outside your allowed region without the right safeguards, uploading to it can be an international transfer you have not covered. Keeping the data on your own device sidesteps the question completely, because nothing is transferred anywhere.
5. Keep an audit trail
GDPR rewards being able to show what happened to personal data. A cleaner that applies opaque, unpredictable changes, an AI model, for instance, leaves you unable to say what was altered. A deterministic tool that logs every change at the cell level gives you a record you can keep for your own accountability.
6. Cleaning is itself good hygiene
GDPR expects personal data to be accurate and not kept longer than needed. Removing duplicates and stale rows, and merging duplicates into one correct record, is not just tidy, it directly supports the accuracy and storage-limitation principles. Cleaning done right is compliance work, as long as it is done somewhere the data is not exposed.
The habit that removes most of the risk
Almost every rule above points the same way: the less far your data travels, the less there is to go wrong. If the file never leaves your device, there is no third-party processor to vet, no DPA to chase, no transfer to justify, and no server that can be breached with your list on it. That is why processing personal data locally is the safest default, not because uploading is always wrong, but because not uploading removes the entire category of risk in one move.
How Sift fits
Sift is a free, browser-based cleaner built for exactly this. It does the first three habits by default:
- The file never leaves your browser. Cleaning, deduping, mapping, and export all run on your own device, enforced by a strict security policy, and it works offline once loaded. Nothing to upload, nothing to vet, nothing to transfer.
- Every change is a deterministic rule you approve with a before-and-after diff. No AI touches your data, so nothing is altered unpredictably.
- You can export a cell-level change log for your audit records, and a "needs your eyes" list of anything a rule should not silently decide.
Being honest about the limits: Sift produces an import-ready file, it does not connect to your CRM's API, and it will not verify email deliverability or enrich data from outside sources. It also cannot make your wider process compliant on its own, that is your organisation's job. What it does is take the hardest part, keeping the personal data on your machine, off the table.