GDPR-Compliant Salesforce: The Complete Setup Guide for EU Companies

Salesforce is not GDPR-compliant by default — it becomes compliant through configuration. The platform provides every building block (EU data residency, consent objects, field audit, erasure tooling), but a stock implementation uses almost none of them. With GDPR fines reaching 4% of global revenue and EU regulators actively auditing CRM practices, here is the concrete setup checklist we apply on every EU implementation.

1. Data Residency: Choose the Right Home for Your Org

Salesforce Hyperforce lets you run your org on EU infrastructure (including Frankfurt and Paris regions), keeping customer data at rest inside the EU. If your org predates Hyperforce EU or runs in a US instance, migration is possible and often the cleanest answer to the data-transfer question. Where EU residency isn't feasible, you need Standard Contractual Clauses plus a documented transfer impact assessment — workable, but a harder security-questionnaire conversation.

2. Lawful Basis & Consent Management

GDPR requires a lawful basis for every processing activity. In Salesforce terms:

• Use the standard Individual object and Consent Management objects (ContactPointConsent, DataUsePurpose) rather than ad-hoc checkboxes — they're built for exactly this
• Record what was consented to, when, and through which channel; a boolean "opt-in" field fails an audit
• Sync consent bi-directionally with your marketing automation (Marketing Cloud, Pardot/Account Engagement, or third-party tools) so an unsubscribe anywhere is an unsubscribe everywhere
• For B2B prospecting under legitimate interest, document the balancing test and honor objections instantly via automation

3. Data Minimization & Retention

The GDPR principle regulators test most often: keep only what you need, only as long as you need it.

• Audit your fields — most orgs we audit carry dozens of personal-data fields nobody has populated in years. Delete them.
• Define retention periods per record type (e.g., lost leads: 24 months; former customers: legal minimum for invoicing data)
• Automate enforcement with scheduled Flows or batch jobs that anonymize or delete expired records — a retention policy that relies on someone remembering is not a policy

4. Right of Access & Right to Erasure

You have one month to answer a data subject access request (DSAR). Manual fulfilment across Salesforce, Marketing Cloud, and attachments doesn't scale:

• Build a DSAR workflow: intake (web form → Case), identity verification, automated export of all records linked to the individual
• For erasure, decide anonymization vs. hard delete per object — anonymizing preserves your reporting aggregates while removing the personal data
• Don't forget the hiding places: email attachments, Chatter posts, activity history, sandboxes, and backups

5. Security Controls Auditors Ask About

Control	Salesforce feature	Priority
Least-privilege access	Profiles + permission sets, restricted "View All Data"	Mandatory
MFA	Enforced by Salesforce since 2022 — verify no exemptions linger	Mandatory
Field-level audit trail	Field Audit Trail / Field History Tracking on personal-data fields	High
Encryption at rest for sensitive fields	Shield Platform Encryption	Case-by-case
Event monitoring	Shield Event Monitoring or Login Forensics	High for regulated industries

6. Document It (Accountability Principle)

Configuration without documentation fails audits. Maintain: a record of processing activities (ROPA) covering your CRM flows, data-flow diagrams including integrations, your DPA with Salesforce and every connected tool, and DPIA for high-risk processing (scoring, profiling, Agentforce-style AI features). If you deploy AI on customer data, the EU AI Act adds transparency duties on top — design for both now.

Country Nuances Worth Knowing

• France: CNIL is among the most active enforcement authorities in Europe and publishes CRM-specific guidance; French works councils may need consultation for employee-data processing. See our Salesforce France page.
• Germany: DSGVO enforcement is state-by-state and rigorous; works-council approval is standard for CRM rollouts touching employee data. See Salesforce Germany.
• Switzerland: not EU, but the revised nFADP closely mirrors GDPR; EU adequacy makes cross-border flows manageable. See Salesforce Switzerland.
• Luxembourg: financial-sector firms layer CSSF outsourcing circulars on top of GDPR — cloud usage must be notified and governed. See Salesforce Luxembourg.

Frequently Asked Questions

Is Salesforce GDPR-compliant out of the box?

No. Salesforce provides the tools — EU data residency, consent objects, audit trails, erasure capabilities — but compliance depends on how your org is configured and governed. A default implementation is not compliant.

Can Salesforce data be hosted in the EU?

Yes. Salesforce Hyperforce offers EU regions including Frankfurt and Paris, keeping data at rest in the EU. Existing orgs can be migrated.

How do I handle a right-to-be-forgotten request in Salesforce?

Via a documented workflow: verify identity, locate all records for the individual (including attachments, activities, and connected systems), then anonymize or delete per your policy — within one month. Automate the location-and-anonymization steps; manual fulfilment doesn't survive volume.

Do these rules apply to non-EU companies?

Yes, if you offer goods or services to people in the EU or monitor their behavior. A US SaaS company selling into France is in scope, and Quebec's Law 25 imposes similar duties in Canada.

Get a GDPR Gap Assessment of Your Org

Our Salesforce audit includes a GDPR configuration review: residency, consent, retention, access controls, and DSAR readiness, with a prioritized fix list. Book a free strategy call to scope it.