The Department for Education describes CRMs as business applications designed to manage customer information and streamline business processes. Customer records in a CRM are personal data under the UK GDPR when they relate to people who can be identified. For choosing a system, see how to choose travel agency software.

What the ICO’s guidance says

• Lawful basis. You need a valid lawful basis for each purpose. Decide it before you start, document it and explain it in your privacy information.

• Accuracy. Take all reasonable steps to make sure records are not incorrect or misleading, and correct or erase any that are. How far you must update them depends on what you use them for.

• Retention. Keep personal data no longer than you need it. Set standard retention periods where possible and review what you hold, erasing or anonymising what you no longer need.

• Health details. A note of a medical condition is special category data, which needs a separate Article 9 condition as well as a lawful basis.

Marketing emails and texts

The Privacy and Electronic Communications Regulations (PECR) apply on top. To send unsolicited marketing emails or texts to individuals, you need their consent or must meet every part of the soft opt-in: you collected their details yourself while selling or negotiating a sale, you market only your own similar products and services and you offered an opt-out then and in every message since. People have an absolute right to object to direct marketing. If they do, you must stop. The ICO suggests keeping a suppression list. Using a bulk email platform does not normally make the platform responsible: you remain responsible.

The Data (Use and Access) Act 2025 clarified that direct marketing can be a legitimate interest. The ICO says all its data protection provisions were in force by 19 June 2026. More on marketing a travel agency.