Customer Data, Consent and Privacy in a Nepali CRM

The moment you store customer phone numbers, addresses and call notes in a CRM, you become responsible for protecting them. This is not only a legal matter. In a country where everyone knows someone, a leaked customer list or a salesperson who takes your contacts to a competitor can damage trust very quickly. This article covers practical habits for record keeping. It is not legal advice, so confirm your obligations with a lawyer or the relevant government office.

Know what you actually store

Start by listing the categories of personal information your sales process collects. For most Nepali businesses this includes:

• Name, mobile number, email and address
• Citizenship, PAN or company registration details, when needed for invoices
• Budget, family situation or purchase plans mentioned in conversation
• Copies of documents sent over WhatsApp
• Call notes and a history of messages

Some of this is sensitive. A note such as "needs loan because of medical expenses" should probably not be in the system at all. Train staff to record what is needed to serve the customer, not every personal story.

Consent and purpose in plain language

Nepal has privacy provisions in its constitution and a law on individual privacy, and rules can change. For the exact obligations that apply to your business, check the current text or ask a legal adviser. In practical terms, good habits are the same in most places:

1. Collect only what you need for the purpose you stated.
2. Tell people why you are taking their details, for example "to send your quotation and call you about it".
3. Use their number for that purpose. If you want to send promotions, ask separately.
4. Let them opt out, and keep a record of who opted out.
5. Delete or anonymise old records you no longer need.

A simple tick box on your website enquiry form and a line in your WhatsApp first reply, such as "reply STOP if you do not want updates", costs nothing and protects both sides.

Who can see and export what

The biggest practical risk is internal. A salesperson who can export the full customer list can walk away with it. Good CRM configuration reduces this:

Role	Sensible access
Salesperson	Own assigned leads and customers, no bulk export
Team lead	Team records, reassign leads, limited export
Owner or manager	All records, reports, user management, full export
Accounts	Invoices and payment status only

Give each person their own login. Shared logins make it impossible to know who changed or viewed a record. If your system supports an activity log, review it occasionally, especially around staff resignations.

When a staff member leaves

Have a short exit routine in writing:

• Disable the user account the same day.
• Reassign their open leads to named colleagues with a handover call note.
• Remove them from shared WhatsApp groups and change shared passwords.
• Ask them to confirm in writing that they hold no copies of customer data.

Customers saved only in a staff member's personal phone are the hardest to recover. This is one of the strongest reasons to log leads in a shared system from day one, like the one on our CRM software page, instead of trusting individual phones.

Hosting, backups and passwords

Ask where the data is hosted, who has server access and how often backups are taken and tested. Use strong, unique passwords, and consider two-step verification for the owner account where available. Keep software and server updates current. Do not send customer lists as spreadsheet attachments over WhatsApp or email unless necessary, and never to personal accounts.

If you later add messaging campaigns, read the consent guidance in our piece on bulk SMS and WhatsApp software, because marketing messages need a stricter standard than service replies.

A short privacy checklist

• Written list of the data you collect and why
• Consent line on forms and first messages
• Opt-out process that staff actually follow
• Separate login for every user, with role-based access
• Export limited to managers
• Exit routine for departing staff
• Backups tested at least occasionally

Handling customer requests and mistakes

Sooner or later a customer will ask you to stop calling, to correct a wrong number or to tell them what you hold about them. Decide in advance who answers such requests and how fast. A simple rule works well: the manager replies within a few days, the record is corrected or removed, and a short note says what was done. Do not argue with a customer who wants out. A polite removal keeps your name clean, while an angry reply travels quickly through family and friends.

Plan for mistakes too. If a staff member sends a quotation to the wrong WhatsApp number, or a spreadsheet goes to a wrong group, tell the affected person honestly, ask them to delete it and note the incident so the habit changes. Small, calm corrections are normal in any business. Hiding them is what turns a small error into a reputation problem.

Photos, documents and IDs

Customers often send citizenship copies, PAN certificates, land papers or bank slips on WhatsApp. These documents are far more sensitive than a phone number. Store them only where access is controlled, attach them to the customer record when you truly need them, and delete them when the transaction is over and the law does not require you to keep them. Ask your accountant how long business records should be retained, and keep ID copies out of casual group chats.

Your next step

Review who currently holds your customer contacts: shared Excel files, personal phones, chat groups. Move them into one controlled system and set the roles above. If you want help configuring a CRM with sensible access levels, message WebsNP on WhatsApp at +977 9846280400 and describe your team.

Get a demo and quote for CRM Software

Tell us about your business and we will reply the same working day with a demo and a clear quote. No obligation.

Chat on WhatsApp

Or call / WhatsApp +977 9846280400

Your name Phone / WhatsApp Email (optional) Business / organisation What do you need?

Request demo

More guides on CRM Software