Pomio CRM stores leads, contacts and companies with source, owner, labels and an activity timeline. In most SME databases, the largest group is not customers. It is people who once filled in a form, met someone at a fair or got a quote, and then went quiet. Nobody decided to keep them. They just stayed.
Why “keep everything” is the wrong default
Old leads feel free to keep, but they are not. Under the GDPR, personal data may be kept only as long as needed for the purpose it was collected for. A lead from four years ago with no contact since is hard to explain to a regulator, and harder to explain to the person who asks why you still have their phone number. Old records also make searches, lists and imports noisier, which undermines duplicate checks on import.
Choose one period and write it down
Set a single rule for leads with no open deal and no recent activity, for example 12 or 24 months after the last meaningful contact. The exact number is a business decision; consistency matters more than the figure. Put the period in your privacy notice and in your internal CRM rules, so sales, marketing and whoever handles privacy requests all work from the same answer. If you are unsure which period fits your situation, check it with your privacy adviser.
Measure from the last real contact
Count from the last activity that shows genuine interest: a reply, a call, a meeting, a quote. An automated newsletter that nobody opened does not reset the clock. This is where a clean lifecycle stage and a recorded lead source help: you can see who is a lead, who became a customer, and where each one came from.
Archive is not the same as retention
For deals and companies with business history, archiving instead of deleting keeps reports and relationships intact. A lead that never bought usually has no such history worth keeping. Archiving it only hides it; the personal data is still there. When the retention period has passed, delete or anonymise the personal details unless there is a concrete reason to keep them, such as an open dispute or a legal hold.
Review on a fixed date
Do not rely on someone remembering. Put a review in the calendar every quarter or every half year. Filter leads with no open deal and no activity inside the period, let each owner flag the few that are genuinely still in play, and clean up the rest in one go. If you need a record of what was removed, export only the counts or the company names you are allowed to keep, not the personal data you just decided to drop.
How Pomio CRM helps
In Pomio CRM each lead and contact keeps source, owner, labels and an activity timeline, so “no real contact since” is visible on the record. Privacy requests, legal hold and retention are managed inside the same tenant as the CRM, and the audit log shows who did what and when. Pomio does not decide your retention period for you; it gives you the data to apply the one you chose.
A practical checklist
Pick one retention period for leads without a deal; write it in your privacy notice and CRM rules; count from the last real contact; review on a fixed date; let owners keep only leads that are genuinely active; delete or anonymise the rest unless there is a legal hold.
Further reading
Does the GDPR set a fixed number of months?
No. It requires that you keep personal data no longer than necessary for the purpose. You choose a period you can justify and apply it consistently.
What about leads who opted in to a newsletter?
Their consent covers the newsletter. If they unsubscribe or never engage, the same retention question applies to the rest of their record.
Should customers follow the same rule?
No. Customer data has other purposes and obligations, such as contracts and invoicing. Treat customers and leads as separate groups.
Who decides when a lead is still active?
The owner, during the scheduled review. If nobody can name a concrete next step, it is not active.