How to onboard a contractor with customer data

A contractor who needs customer data should receive a defined task, limited access and a planned exit. “Temporary” access often remains long after work ends if nobody owns the account. Before work starts, document what information is needed, who approves access and how completion will be checked.

What is the minimum access for the task?

For an illustrative freelancer cleaning duplicate CRM records, allow access to the fields needed for matching and correction, not automatically to payment data or every historic note. This freelancer is fictional. Describe the permitted operations, records to change, quality sample and deadline. Ask whether a test set with altered data can be used first. PDPC's data-protection obligations provide the official framework for organisational handling of personal data. A business should assess its precise duties and not assume a contractor agreement alone makes access safe.

Use named accounts with the least permissions the system allows. Record who can export, delete or invite other users. Avoid sharing an owner's login because it hides who performed a change. If the contractor needs remote access, agree the devices and storage locations permitted. PDPC's guide to data-processing clauses helps frame contract questions about confidentiality, subcontracting, security, incidents and return or deletion. The arrangement must match the real workflow, not a generic template.

What should a supplier quote include?

Give providers the same record volume, system, error type and acceptance test. Ask for preparation, tool licence, staff time, correction passes, exception handling, audit trail, security terms and exit support. A fictional Provider A might quote per record but bill exceptions separately; Provider B might quote a fixed project with a defined error threshold. Compare the likely total and how disputes over a corrected record are resolved. Our CRM comparison helps define export and field ownership; the SOP guide helps document a repeatable handoff.

How should work be reviewed?

Start with a sample. Check whether the contractor makes the changes intended and flags ambiguous duplicates instead of merging them silently. Keep a reversible backup and a change log when the system supports it. Agree who approves a production-wide action. If a mistake is found, pause, identify affected records and follow the agreed correction and incident route. Do not wait for the final invoice to inspect all work. The business-continuity plan helps prepare for unavailable data or systems during the project.

At exit, export the deliverables and exception list, check ownership of scripts or outputs, remove accounts and confirm deletion or return of copies. Schedule a later spot check for lingering access. You can send Methodology an access-checklist question for editorial guidance. We do not perform data-cleaning work or promise a contractor introduction.

If the contractor needs to use its own tool, ask exactly which records leave the company system and whether the tool uses them for any other purpose. A provider may use several subcontracted services behind one interface. Put the approved tools in the scope and require notice before a material change.

Record the approved subcontractors and ask how their access will be removed at the same exit date.

Check that the final invoice identifies work accepted, unresolved exceptions and any retained support period.

Common questions