Who can do what in your CRM

Four roles are enough

A product with twelve permission levels sounds thorough and never actually gets configured. Four will do for almost any small business:

• Owner. Can do everything, including adding people, changing the subscription and deleting the organisation. One person. Two owners means nobody is the last one responsible.
• Manager. Can do everything with customers and deals, and can invite colleagues. This is the role for whoever works with the team day to day.
• User. Can create and change customers, deals and tasks. The role for just about everyone who sells.
• Read-only. Can look and change nothing.

Read-only is the most useful one

This is the role that gets underrated most, and it solves the commonest problem of the lot: people who need to know what's going on but don't need to fill anything in.

Your bookkeeper, who wants to see whether an order is coming. An engineer who wants to read what was agreed before they turn up. A business partner who watches without working in it.

Without this role those people either get no access — and then they ring you — or full access, and then you run the risk of something disappearing by accident. Give read-only away generously. Information reaching more people is the whole point of a CRM.

Watch who can change roles

This is the detail that matters most in practice and is overlooked most often: whoever can change roles can make themselves the owner.

So that belongs with the owner, not with everyone who happens to be a manager. Check whether that line exists when you look at a new product. If it doesn't, the permission system is decoration.

The NCSC's guidance for small organisations makes the same point in plainer terms: give people the access their job needs and no more, and keep administrative accounts separate from the ones used for everyday work.

When someone leaves

Two things, and the order matters.

Transfer their customers first, and only then withdraw their access. The other way round leaves you with an account that can't reach anything while twelve deals are still in its name — and then nobody knows who should pick them up. See the piece on handing over a customer.

Then actually withdraw it, don't just change the password. An account set to inactive can do nothing; an account whose password you've changed can come back through a reset email. You only notice that difference when it goes wrong.

A notice period is a gift here: you usually know the last working day weeks in advance, which is enough time to plan the handover rather than improvise it on the Friday afternoon.

And leave their notes in place. Those belong to the business, not to them. A record that loses its history the moment someone leaves is exactly what a CRM is supposed to prevent.

What you have to be able to explain

You're responsible for customer data even when someone else supplies the software. In concrete terms that means you have to be able to say who can reach which data, and you have to be able to withdraw access.

A list of who holds which role is enough for that — provided it's accurate. Go through it once a year; in almost every business you'll find people on it who don't work there any more. That list is also what makes a subject access request answerable inside the month the ICO allows, because the first question is always *where is this person's data held*. More on that in the piece on customer data and UK GDPR.