CRM for small business — what it is, when you need it and how to choose

A small company's problem is rarely that it has no CRM. The problem is that its customer contacts live in five places at once: the owner's phone, a salesperson's inbox, a spreadsheet somebody set up years ago, a notebook and a chat history. While one person runs everything, this works, because it all sits in that person's head. The trouble starts on the day that person goes on holiday, leaves, or simply forgets to call back.

A CRM for a small business doesn't have to be an elaborate system. It has one job: to make sure that what you know about a customer belongs to the company, not to whoever happened to be talking to them.

We write this from an unusual position. We built our own CRM, and it handles every enquiry that comes through this site. That is exactly why we can say, honestly, that most small businesses are better off with an off-the-shelf system. Below: what a CRM is, when you need one, what it has to do, how to square it with the GDPR, and how to choose one without reading rankings written by the vendors themselves.

What is CRM (and what it isn't)

CRM (customer relationship management) is a system for managing your relationships with customers: one place where the company keeps its contacts, the history of every conversation with each of them, and the stage each sale has reached. With it, anyone on the team can see who is a customer, what you last talked about and what is supposed to happen next.

That is the whole definition. In practice, a CRM system answers three questions a small company asks every day: who did we talk to, what about, and whose move is it now? Everything else — reports, automations, sales forecasts — is an add-on that only makes sense once those three answers live in one place.

Most systems today are online CRMs: a service in the browser, paid for by subscription. You install nothing on a server of your own, and the data sits with the provider — we come back to that when we get to choosing one. The acronym is also used in a broader sense, and that is worth knowing when you search for the CRM meaning: a way of working in which the company deliberately looks after its contact with customers before and after a purchase. The system is only the tool of that way of working. Without the habit, even the best CRM ends up as an expensive address book.

ERP vs CRM — how they differ

The two acronyms often come up together, but they describe different things. An ERP runs what happens inside the company: orders, stock, production, invoices, accounting. A CRM runs what happens between the company and its customer, before and after they buy: enquiries, conversations, quotes, repeat business. An ERP answers "what do we have and what have we shipped"; a CRM answers "who are we talking to and how far have we got". In larger companies the two are connected — an order from the ERP lands in the customer's history in the CRM — but a small business usually starts with one of them.

A customer database in a spreadsheet is not yet a CRM

A spreadsheet with a list of customers is a customer database, not a system for managing relationships. The difference isn't the tool; it is what the tool can record. A spreadsheet holds a state: name, phone number, maybe an amount. It doesn't hold history — who called, when, what they promised — and it won't remind anybody that a quote has to go out on Thursday. As long as that history fits in one person's memory, the spreadsheet is enough. When it stops fitting, you need something more.

How many European companies use CRM

If you don't have a CRM, you are in the majority. According to Eurostat, in 2025 CRM software was used by the following shares of enterprises in the EU:

About one small company in four — and that is within the group that employs at least ten people. Companies with fewer than ten aren't covered by the survey at all, and there the share is very likely lower still. For comparison, ERP software was used by 41.08% of small EU enterprises, clearly more than CRM.

Two conclusions follow. First, having no CRM in a small company is normal, not negligent. There is no reason to adopt one because "everybody has one", because everybody doesn't. Second, the share climbs steeply with company size: from roughly a quarter to nearly two thirds. Eurostat doesn't ask about the reasons, but the simplest explanation is that as headcount grows, so does the number of people who talk to the same customer — which is exactly the problem a CRM solves. So the question isn't "should we have a CRM", but "has that moment arrived for us yet".

It is also worth being clear about what these figures don't tell you. They show how many companies use CRM-type software, not how they use it. A system nobody enters conversations into looks, in the statistics, exactly like one that carries the whole sales operation.

When is a spreadsheet enough, and when do you need a CRM?

A spreadsheet is enough as long as one person handles customers and a sale closes within one or two conversations. A CRM becomes necessary as soon as any one of the four signals below appears — and none of them is about the number of customers. They are about how much information on each customer has to pass between people.

More than one person talks to customers. The owner and a salesperson, two salespeople, a salesperson and whoever answers the phone. From that moment, "who talked to them last and what did they promise?" no longer has one obvious answer. This is the most important of the four signals, because the other three can still be held in one person's memory.

Customers come back. If people buy from you a second and a third time, the history of previous orders and conversations starts to have value — and a spreadsheet has nowhere to keep it.

A sale takes longer than a week. Enquiry, conversation, quote, revisions, decision. With several of these running at once, somebody has to remember where each one stands.

Follow-ups get lost. If, even once a month, it turns out that someone was waiting for a quote or a call that never came, this is the moment. Every such case is a customer who could have bought from a competitor in the meantime.

If you don't recognise any of these signals, don't adopt a CRM just because it seems the done thing. A well-kept spreadsheet will last a long time, on three conditions. It has two tabs, contacts and conversations, and every conversation has a date and the name of the person who had it. It has a "next step" column with a date — that column replaces reminders. And it has a single owner who reviews once a week what has got stuck. A spreadsheet like that is, incidentally, the best preparation for a CRM: when the time comes, you move tidy data instead of chaos. If you recognise two signals or more, reach for an off-the-shelf system. Building your own only makes sense at the third threshold, which we describe further down.

What a CRM for a small business must have

The market sells CRM through feature lists: automations, reports, artificial intelligence, integrations with dozens of services. A small business needs five things, and the rest can wait.

Contact and company. A person with a name, email address and phone number, attached to the company they work for. Each contact should exist in the database once — which means the system needs some key by which it recognises that two records are the same person. Ours is the email address, always stored in lower case and without spaces, because "[email protected]" and "[email protected]" are two different strings to a database and one person to you.

History, including email. A note from a call, a quote that went out, a meeting. Email is what is most often missing here: the most important agreements with a customer sit in an inbox, not in the CRM, because nobody has time to copy them across. That is why, for a small business, email integration isn't an extra. It is the condition for the history being complete.

Stage — with a record of changes. New contact, qualified, customer, repeat customer, lost. The current stage on its own is not enough; the value lies in knowing when a contact moved from one stage to the next. That is what later tells you how long your sales actually take.

Reminders. A task such as "call on Thursday", assigned to a person and a contact. This is the feature that pays for itself fastest, because it is directly responsible for follow-ups not getting lost.

Contact source. Where somebody came from: a form, a referral, a phone call, a trade fair. Without this field, a year from now you won't be able to say which channels bring customers and which only cost money.

Sales pipeline — how many stages you really need

A sales pipeline is the sequence of stages a contact goes through from first enquiry to purchase, with fewer people left at each stage than at the one before. A CRM shows it as columns or as a list of stages.

The most common mistake is too many stages at the start. Ten columns look professional, but nobody moves contacts between "needs analysis" and "preparing an initial quote", so the pipeline stops matching reality. Four or five stages are enough to begin with, and each should have a clear condition for moving on: "we sent the quote", not "they seem interested". Add the two stages that people forget: "rejected" and "spam". Contacts that aren't and won't be customers shouldn't disappear, because they will come back with the next form submission. They should drop out of your statistics instead.

If you are looking for a CRM for sales teams, the pipeline is its heart: a salesperson starts the day with the list of contacts that have sat at one stage for too long.

CRM and the GDPR — a customer database is personal data

The first name, surname, work email and phone number of a specific person are personal data, even when that person works for a company you are dealing with. When you set up a CRM, you are therefore setting up a database of personal data, and that comes with a few obligations. We describe them the way they shaped our own system.

Every purpose needs a legal basis. Answering an enquiry and preparing a quote count as steps taken at the person's request before entering into a contract (GDPR, Article 6(1)(b)), while keeping a history of contacts falls under the company's legitimate interest (Article 6(1)(f)). You collect data for a specific purpose and don't use it for another (Article 5(1)(b)).

Email marketing needs prior consent — and consent is best recorded per channel. The rule sits in the ePrivacy Directive, Article 13(1): automated calling systems, fax and electronic mail may be used for direct marketing only to people who have given their prior consent. "Electronic mail" in the directive covers any text message sent over a public network, so SMS falls under the same rule. There is one exception you should know about (Article 13(2)): if you obtained a customer's email address in the course of selling them a product or service, you may use it to market your own similar products or services — provided that you gave them a clear, free and easy way to object when you collected the address, and give it again in every message. For other channels, such as phone calls made by a person, each member state decides whether you need consent first or only have to respect a refusal (Article 13(3)). And the directive's consent rules protect individuals; how far the same protection extends to companies as recipients is left to national law (Article 13(5)). The details depend on the member state, so check your own country's rules before relying on an exception. What doesn't vary: because you must be able to demonstrate consent (GDPR, Article 7(1)), your CRM should show which channel someone agreed to, when, and with what wording. Consent to a newsletter is not consent to a phone call.

Withdrawing must be as easy as signing up. The GDPR says so directly: "It shall be as easy to withdraw as to give consent" (Article 7(3)). If consent takes one click, withdrawing it can't require logging in or writing to customer service. Separately, everyone has the right to object to direct marketing at any time, and once they do, their data may no longer be used for it (Article 21(2) and (3)).

Minimisation and retention. You collect only what the purpose requires (Article 5(1)(c)) — a date of birth or a national ID number in the CRM of a service company is a warning sign. Data must be "kept in a form which permits identification of data subjects for no longer than is necessary for the purposes for which the personal data are processed" (Article 5(1)(e)). In practice: every contact should have a date until which you keep it, and the database needs someone who reviews it from time to time.

How we built our own CRM (and why)

We have our own CRM because our case is unusual: every form, calculator, quiz and meeting booking on this site is a separate source of contacts, and we want to know which ad brought in the person who later called us. An off-the-shelf system wouldn't have given us that link without stitching together data from several places. Below are the solutions that will be useful to you when choosing an off-the-shelf CRM too, because they are questions to put to the vendor.

Login separate, CRM separate. The account somebody signs into on the website and the contact in the CRM are two different things, only linked when they concern the same person. That lets us develop the CRM without risk to the login, and the other way round.

Email as the key, phone as a supplement. We merge contacts on the email address, normalised to lower case and without spaces. We store phone numbers in international format. For the two markets where the country is unambiguous — Poland and Switzerland — the system adds the country code itself. On this European site the country can't be guessed from the language, so a number typed without its country code is stored exactly as typed rather than given a guessed prefix: a wrong prefix doesn't just fail to match, it points at somebody else's number. Either way, the phone merges nothing; it only fills an empty field. Every contact keeps its source: a form, a tool, a brief, a meeting, the mailbox, an import or a manual entry.

Consent stored with the text the person read. The marketing consent field never blocks a form from being sent, because consent has to be freely given. When somebody ticks it, we store not just "yes" but the exact wording of the consent, in the language they saw it in. A later form without the box ticked withdraws nothing — withdrawal works only through the unsubscribe link.

One-click unsubscribe. The link in every marketing email withdraws consent without a login and without a form. The response is always the same, whether or not the link matched anyone, so it can't be used to check who is in the database.

One place that enforces consent. Every action aimed at people — email, SMS, an audience list for ads — builds its recipients through the same filter, which requires consent for the specific channel and excludes contacts marked as spam, rejected or excluded. Nobody has to remember this before the next campaign.

A person judges the stages. The system records the history of every stage change, but moves only one stage by itself: from "customer" to "repeat customer" when a second project appears. Everything else is judged by a person, and the automation never overwrites a negative stage.

Deletion that doesn't come back. When someone asks for their data to be erased, the record is reduced to a "tombstone": all that remains is a hash of the email address (SHA-256), from which the address can't be read, and all other data is wiped — including in the submissions the contact was created from. Why keep the hash? So that the same person doesn't return to the database with the next import. Every contact also carries a date until which we keep it, pushed forward with each new interaction.

Email and ads. Every ten minutes we synchronise the company mailboxes and attach emails to contacts — we store the subject, a short snippet and a link to the message, never the full content or attachments. We send Google Ads the conversions that happened off the site through a quality gate: spam and rejected contacts aren't reported as conversions, because the ad system would learn to look for more of them.

And the most important point: for most small businesses, all of this is too much. An off-the-shelf CRM will handle contacts, history, the pipeline and reminders better than the first version of your own would. We built ours because our value lies in joining a contact to the data our own website produces. How to decide this for yourself, feature by feature, is covered in our article on off-the-shelf versus custom software.

How to choose an off-the-shelf CRM without a ranking

Most "best CRM for small business" rankings are written by the vendors themselves, so instead of another comparison — five criteria you can check in any offer.

Data export and switching provider. Before you enter the first contact, check how you will get the data out. Since 12 September 2025 the EU Data Act (Regulation 2023/2854) has applied, and it covers software delivered as a service, so cloud CRM too. The contract with the provider must set a notice period for starting a switch of no more than two months, a transition period of up to 30 days during which the provider helps with the move, and an exhaustive specification of the data that can be ported (Article 25(2)). From 12 January 2027, the provider may not charge for the switch itself (Article 29). Ask a concrete question: does the export include contact history and notes, or only the list of names?

Price per seat for the team you are planning. Most systems charge per user. With two people that is a trifle; with ten it isn't. Work out the subscription for the team you expect to have in two or three years, and check which plan contains the features you can't start without.

Email and form integration. A CRM into which enquiries from the website and emails have to be copied by hand is out of date within a month. Check whether the form on your website can write the contact straight into the CRM, and whether the system attaches correspondence from the mailbox. If not, see what can be joined up with automation — we cover that in our article on business process automation.

Where the data lives. An online CRM is a service in which the provider processes your customers' data on your behalf. Under the GDPR you may only use a processor that gives sufficient guarantees of protecting that data (Article 28(1)), and you need a processing agreement with them. It is also worth knowing which country their servers are in: with providers outside the EU, a transfer assessment comes on top. A good provider has these documents ready and hands them over without being asked.

The limits of the free plan. A free CRM is usually a plan with a cap: on users, contacts, history or integrations. For a start it can be perfectly adequate. But check which limit will hit you first and how much crossing it will cost — because at that point moving will already be hard, and the data will be with the provider.

And one practical tip: before you sign an annual contract, test two systems for two weeks on real contacts from your current sales, not on sample data. After that you will know which one the team actually opens, and that matters more than the feature list.

Where to start: the first 30 days

Rolling out a CRM in a small company rarely fails on technology. It fails because in the first week everyone tries to move everything across and design the perfect process. Three decisions are enough for the first month.

One list. Gather contacts from phones, inboxes and spreadsheets in one place — but only those you have spoken to in the last year. Move older lists later, if at all.

One pipeline. Four or five stages with a clear condition for moving on, one pipeline for the whole company. After a month you will see which stage is missing and which is superfluous.

One source of truth. Agree that a conversation that isn't in the CRM didn't happen. It is the only rule that keeps the system up to date three months in.

If, after that month, it turns out that the off-the-shelf system can't handle something that is central for you — such as joining contacts to data from your website or your order system — that is when a CRM built for you, or your own module bolted onto an off-the-shelf tool, is worth considering; this is part of our custom software development work. For the wider picture, which business applications solve which problem, see our guide to business software.

Where these figures come from

• Share of companies using CRM and ERP — Eurostat, Statistics Explained, "E-business integration", 2025 data, extracted in May 2026; enterprises with at least 10 people in the EU.
• Rules — the GDPR (Regulation (EU) 2016/679), the ePrivacy Directive (2002/58/EC, consolidated text) and Regulation (EU) 2023/2854 (Data Act), read at the source on 22 September 2026.
• Our CRM — the state of the system this website runs on, and notes from our design decisions. We deliberately don't give the number of contacts.