CRM Customer Record: All Your Customer Data in One Place

A single customer record is the first thing to build in any CRM system: one place holding the customer's name and numbers, who looks after them, and everything that has passed between them and the business, known to sales, customer service and management alike. In part one we saw that customers get lost at 4 points, and that two of them, duplication and leaving with the employee, come from the absence of this record. This second part of Digitizing CRM, a 7-part series, sets the minimum fields, shows how to stop duplicate copies, explains what the record must support from the five data subject rights in Article 4 of the Personal Data Protection Law, and gives you an exercise on 10 customers to measure how scattered your data is.

What a customer record is and the least it must hold

A customer record is one page per customer that any authorised employee can open to learn who this customer is, who looks after them, and what they are waiting for now. The common mistake is to start with dozens of fields nobody fills in, so half of them stay empty and the team stops trusting the record. Start with the minimum you actually need:

• Name and mobile number. The mobile in particular is the key of the record in the Saudi market, because most contact runs through WhatsApp and calls.
• Company and city if your customer is a business, with the name of the person you deal with there.
• Source: which door they first came through, WhatsApp, a call, the website or a referral.
• Relationship owner: the name of one employee, not a department.
• Status: prospect, active customer or former customer.
• Date of last contact, the next step and its date.
• Consent to marketing messages: whether they agreed, when, and through which channel. We cover this in part 6.

This minimum is not only an organisational choice. Article 11 of the Personal Data Protection Law states that the content of personal data must be appropriate and limited to the minimum necessary to achieve the purpose of collecting it. So for every field you add, ask: why do we need it?

One record, not three copies

Duplicate copies do not come from carelessness; they come from each door saving the customer its own way. The salesperson saves them on their phone as Abu Fahad, the receptionist writes down the company name on paper, and the Excel file holds only their landline. Three copies of one customer, each knowing part of the story. Worse, the copies disagree: an old number here, a new address there, and nobody knows which is right.

Stopping duplication needs 3 clear rules before any software:

• One key. The mobile number in a standard format, searched before any new record is created; if it exists, the existing record opens instead of a new copy.
• A merge rule. When two records turn up for one customer, who decides which data stays, and how the history of both copies moves into one record.
• A data owner. One person who reviews duplicates regularly and approves merges, rather than every employee using their own judgement.

If your customer list lives in an Excel file today, clean it before moving it into any system, or the duplicates will travel with it. We explained how in cleaning data before the move: what must not travel as-is.

The customer's history and who owns the relationship

A record that holds only a name and a number is a phone book. What makes it a customer record is the history attached to it: conversations, calls and their summaries, the quotes that were sent, the orders that were delivered, and the complaints and what happened to them. When the customer calls, the employee opens the record and sees the whole story without asking the customer to repeat it from the start.

Every customer has one relationship owner, named in the record. That does not mean nobody else contacts the customer; it means someone is answerable if a reply is late. When the owner leaves or moves role, the whole record is handed to a new owner by a manager's decision, so the relationship stays with the business, not the person. That is exactly what closes the leaving point we described in part one.

What the data protection law asks of the record

An individual customer's data is personal data, and a single record is what makes you able to respect their rights. Article 4 of the Personal Data Protection Law, published on the SDAIA website, states that the data subject has, in accordance with the provisions of the law and what the regulations set, the following rights (our translation of the official Arabic text):

• The right to be informed, including being told the legal basis for collecting their personal data and the purpose of collecting it.
• The right to access their personal data held by the controller.
• The right to request their personal data held by the controller in a readable and clear format.
• The right to request the correction, completion or updating of their personal data held by the controller.
• The right to request the destruction of their personal data held by the controller that is no longer needed.

Turning these rights into practice means the record must be able to do 4 things: show everything the business holds about the customer on one screen, produce a readable copy of it, correct and update it while keeping a trace of each change, and destroy what is no longer needed within what Article 18 allows. Article 14 adds that data must not be processed without sufficient steps to verify its accuracy, completeness and currency, and Article 21 requires the controller to respond to the data subject's requests within a period and through a means set by the regulations. None of this is possible when a customer's data is spread across phones and paper. We set out what applies to conversations specifically in your customer conversations and the Personal Data Protection Law. This is not legal advice, so confirm the details and the implementing regulations with SDAIA or a lawyer.

Permissions: who sees, who edits, who exports

Gathering customer data in one place makes it easier to reach, which means it needs more protection, not less. Article 19 requires the controller to take the necessary organisational, administrative and technical measures to safeguard personal data. In practice, start with a simple split:

• A salesperson sees and edits the records of their own customers.
• The sales and customer service managers see everyone and reassign customers.
• Export, deletion and merging belong to a very small number of people, with a log of who did what and when.

Designing permissions once data leaves the files for a system is covered in permissions: who sees what once data leaves the file.

The Origami view

We are a technology company that builds custom systems, apps and integrations, and in any customer management project we start with the customer record before any follow-up screen or report. We gather the existing copies from phones, files and email, agree with the client on the key, the merge rule and the data owner, and then move only what has been cleaned.

We design the record to connect to the WhatsApp, calls and website your team already uses, so contact is logged automatically instead of asking an employee to copy it, with permissions and a change log from day one. What we build is described on our services page.

Exercise: 10 customers and how many places hold them

This is an exercise you can run yourself in one day, and it gives you an accurate picture of how scattered your data is:

• Pick 10 customers you dealt with in the last 3 months, a mix of large and small.
• Count the places where each one exists: salespeople's phones, the company WhatsApp, Excel files, email, the accounting system, and paper.
• Compare the copies: are the name, number, address and owner the same everywhere? Mark every difference.
• Ask two questions: if this customer asked today for a copy of what you hold about them, how many hours would you need? And who really owns their relationship?

The average number of places per customer, and the number of differences between copies, are the two figures you start from. If the average is more than one place, a single customer record is your first project.

In the next part

We have built the record that holds the customer; what remains is for every inquiry from every door to reach it. Part 3, Customer Inquiries: Every Channel in One Inbox, brings WhatsApp, calls, website forms and email into one place, where each inquiry has an owner, a status and a reply deadline your business sets for itself.

Sources

• Personal Data Protection Law — Saudi Data and AI Authority (SDAIA) — Article 4 on data subject rights, Article 11 on minimum data, Article 14 on accuracy, Article 18 on destruction, Article 19 on safeguarding data, and Article 21 on responding to requests.