How to Migrate CRM Data Securely: A Checklist for the Export File

A CRM migration puts your whole customer database into a file. That file is usually a spreadsheet, sits on someone’s laptop, and is not covered by any of the permissions that protected the data inside the CRM. Most migration security problems come from this one object, not from the new platform.

This checklist follows the file from the moment it is created to the day it is deleted. It is operational, not legal advice: which rules apply to you depends on where your customers are and what you hold. For the migration method itself, see the CRM migration guide.

Why is the export file the biggest security risk in a CRM migration?

Inside the CRM, access is controlled by user roles, audit logs and visibility rules. When you export, that structure disappears. A CSV has no permissions, no audit trail and no expiry of its own. Anyone who opens it sees every column for every row, and it can be copied, attached to an email or synced to a cloud drive without anyone deciding to do that.

Vendors do build some limits into the export step. They are worth knowing, because they decide what the file contains and how long the vendor-hosted copy exists.

Platform	What the vendor documents	What it means for you
HubSpot	“Export permissions are required to export records”; download links expire after 30 days; exporting all contacts includes unsubscribes (HubSpot Knowledge Base, checked October 12, 2026)	Give export permission to one or two named people for the project, and expect opted-out contacts in the file
Pipedrive	Exports include only the records the user can see; exported files are available for 28 days; activities, notes and files are exported separately (Pipedrive Knowledge Base, checked October 12, 2026)	A user with narrow visibility produces an incomplete file, so run the export as someone with the right scope, deliberately

Link expiry removes the vendor’s copy. It does not delete the copy you downloaded.

What is the checklist for migrating CRM data securely?

Work through it in this order.

Before the export

• Name the people. One person owns the export, one owns the import, one signs off. Everyone else gets no access to the files.
• Grant export permission narrowly and temporarily. Remove it when the project ends.
• Decide the scope. Export only the objects and fields the new system needs. A field you do not migrate is a field you do not have to protect in transit.
• Check the contract. Your agreements with the old vendor, the new vendor and any migration partner should cover how personal data is processed and returned or deleted. If you use a partner, a written data processing agreement is the normal way to do this.
• Decide where files live. One access-controlled location, with named users, not personal drives or inboxes.

During the move

• Move the file over an encrypted channel. The UK ICO says you should use encryption for personal information in transit electronically, stored on devices like laptops and phones, and on removable media (ICO, checked October 12, 2026). It also says the UK GDPR does not specifically require encryption, so treat this as strong guidance, not a statutory rule.
• Do not email the file. Share a link to the controlled location instead.
• Keep the encryption key separate from the file. The ICO’s guidance points to proper key management. A password sent in the same email as the file is not protection.
• Test with masked data where you can. Replace names, emails and phone numbers in the test set and keep the structure, so edge cases are still tested. If real data must be used for a rehearsal, hold the test environment to the same controls as production.
• Log it. Who exported, when, which file, where stored, who imported.

Consent and opt-outs

• Carry unsubscribe and do-not-contact status with each contact. HubSpot states that exporting all contacts includes unsubscribes. The import has to preserve that status.
• Map the channels separately. Email opt-out, SMS opt-out and call restrictions are different fields in different systems. Decide how each maps.
• Test with a seed list that includes opted-out contacts before the first send from the new system.

After the import

• Reconcile counts by object, and check a sample of records end to end, including owners and consent flags.
• Switch off the old integrations and API keys that pointed at the old system.
• Remove old users and sessions from the old CRM, and keep it read-only for the agreed window.
• Delete every copy of the export on the date you set. That includes downloads folders, email attachments, cloud sync folders and the partner’s working copies. Record the deletion.
• Revoke the temporary permissions you granted for the project.

Does encryption take the data out of GDPR scope?

No. The ICO says that if you encrypt personal data, the encrypted data is still personal information in your hands, and that if you can access both the data and the key you can re-identify people. Encryption lowers the risk of exposure. It does not change what the data is or whether the law applies. The ICO also warns against sharing encrypted data without assessing the receiving organisation’s technical or contractual ability to protect it, which is the reason to check any migration partner’s arrangements before sending them a file.

What do you do when the data is regulated?

If the CRM holds health, financial or other regulated data, the questions above come first and the tooling second. Check whether each system and each partner can lawfully hold the data, whether a business associate or processor agreement is needed, and where the data is stored. The rules differ by country and by sector, so involve your compliance lead or counsel early. Our note on whether GoHighLevel is HIPAA compliant shows what a platform-specific answer looks like.

What is the quick version?

Stage	The one thing to get right
Export	One named person with temporary permission pulls the minimum fields
Storage	One access-controlled location, no personal drives, no email attachments
Transfer	Encrypted channel, key sent separately
Test	Masked data where possible, real data only under production controls
Import	Consent and unsubscribe flags carried across and tested
Cleanup	Every copy deleted on a written date, logged

If you would rather hand the file handling to a team with a written process, aibrevo scopes migrations from your data and agrees how files are shared and deleted before anything is exported. Book a 30-minute call and bring your export plan.

Sources

All checked October 12, 2026.

• UK Information Commissioner’s Office, Encryption and data protection: encryption not specifically required; should be used in transit, on devices and removable media; encrypted data is still personal data.
• UK Information Commissioner’s Office, A guide to data security: the wider security duties.
• HubSpot Knowledge Base, Export your records: export permissions, 30-day link expiry.
• HubSpot Knowledge Base, Export your content and data: exporting all contacts includes unsubscribes.
• Pipedrive Knowledge Base, Exporting data from Pipedrive: visibility limits, separate export of activities, notes and files, 28-day availability.