Is Automated Lead Scoring in Your CRM Legal Under GDPR? A Plain Guide for EU Small Businesses

Yes. Automated lead scoring in your CRM is legal under GDPR, and for most small businesses it does not trigger the strict rule people worry about, Article 22. Ranking a prospect for your own internal prioritization is profiling that does not by itself produce a legal or similarly significant effect on that person.

The restriction bites in one specific case: a purely automated score, with no meaningful human involvement, that drives a decision which materially changes someone's situation, such as an automatic rejection, denied access, or personalized pricing. An EU small business stays on the right side of the line by keeping a human review gate on high-stakes decisions, documenting a lawful basis (usually legitimate interest with a written assessment), and disclosing the profiling in its privacy notice. This is general guidance, so confirm the details against your own use of scoring.

Is automated lead scoring allowed under GDPR?

It is. Article 22(1) gives a person the right "not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning him or her or similarly significantly affects him or her." Two conditions have to be true at the same time before the rule applies. The decision has to be (a) solely automated and (b) produce a legal or similarly significant effect. A CRM that scores your inbound leads so your sales team calls the hot ones first meets neither condition. Nobody is denied anything. A human still decides who to contact and what to offer.

When does a lead score cross the line into a decision GDPR restricts?

It crosses the line when the score itself decides the outcome. The clearest authority is the Court of Justice of the EU in the SCHUFA case (C-634/21, 7 December 2023). The Court held that a probability score is itself an automated individual decision under Article 22(1) when a third party "draws strongly" on that value to establish, implement, or terminate a contract. In that case a bank effectively refused credit because of a credit-scoring number. The Court also confirmed Article 22(1) is "a prohibition in principle," so it applies even when the person has not asked to invoke it.

Marketing profiling usually stays below the "similarly significant" bar. It can rise above it. The WP29 guidelines endorsed by the EDPB give examples: differential pricing that stops someone obtaining goods or a service, or repeatedly targeting a person known to be in financial difficulty with gambling ads. What matters is the intrusiveness of the profiling, the individual's reasonable expectations, how the ad reaches them, and whether the people targeted are vulnerable. A lead score that merely sorts your call list is nowhere near this. A score that automatically sets a higher price for one prospect could be.

Does AI lead scoring need human review under Article 22?

Only when the score alone drives a decision with legal or significant effects. When that is the case, the fix is a human review gate, and the standard for that human is real. The WP29 guidance, endorsed by the EDPB, says oversight must be "meaningful, rather than just a token gesture, and should be carried out by someone who has the authority and competence to change the decision." It explicitly rejects "human employees rubber-stamping automatically generated profiles" as a way to escape Article 22. A salesperson who genuinely weighs the score alongside other information, and can override it, keeps the process out of "solely automated" territory. A person who clicks approve on whatever the model says does not.

What lawful basis do I use, and what must I write down?

For most CRM lead scoring the basis is legitimate interest under Article 6(1)(f). That basis is available for profiling, and it requires a documented three-part assessment: a purpose test, a necessity test, and a balancing test. The EDPB's 2024 guidelines on legitimate interest are strict about the purpose. Vague aims like "improving our services" or "business development" fail. The interest has to be "lawful, precisely articulated and present." Write down the specific reason you score leads, confirm scoring is actually necessary to achieve it, and balance it against the prospect's rights. Keep that assessment on file.

If your scoring ever becomes a solely automated decision with significant effects, legitimate interest is no longer enough. Article 22(2) allows such a decision on only three grounds: it is necessary for a contract, it is authorised by EU or member-state law, or it is based on explicit consent. Ordinary marketing legitimate interest is absent from that list. That gap is the practical reason to keep a human in the loop rather than chase explicit consent for every prospect.

Do I have to tell prospects my CRM scores them?

Yes. Articles 13 and 14 require you to disclose the existence of automated decision-making, including profiling, and to give "meaningful information about how decisions are made, the significance and the consequences of processing," as the Irish Data Protection Commission puts it. In plain terms: if you profile prospects, say so in your privacy notice, and explain in understandable language what the scoring does and why it matters. Because marketing profiling usually relies on legitimate interest, the person can also object at any time, and for direct marketing you must then stop. Flag that right to object clearly at the first point of contact.

The minimum compliance checklist for an EU small business

Five things cover the common case. First, keep a human with real authority reviewing any high-stakes call the score touches, such as pricing, rejection, or access, so the decision is not solely automated. Second, write and file a legitimate interests assessment with a precise purpose. Third, disclose the profiling and its logic in your privacy notice, and make objecting easy. Fourth, run a Data Protection Impact Assessment if you reach large scale. Article 35(3)(a) makes a DPIA mandatory before systematic and extensive automated evaluation on which decisions with legal or similarly significant effects are based, and skipping a required DPIA is fineable up to EUR 10 million or 2 percent of global turnover. Small internal lead scoring usually sits below this trigger. Fifth, honour objections to marketing profiling promptly.

Common questions

Does routine AI lead scoring need a formal human review gate?

No. A formal gate is only required when the score alone drives a decision with legal or similarly significant effects. Routine scoring that reprioritizes your outreach list is not a decision Article 22 restricts, so it needs no formal human gate. When a high-stakes call is involved, put a person with real authority to change the outcome on it, and the process is no longer solely automated.

Do I have to tell prospects my CRM scores them with AI?

Yes. Articles 13 and 14 require you to disclose the existence of profiling and give meaningful information about how the scoring works and its significance, normally in your privacy notice. You must also make it easy to object, since marketing profiling usually relies on legitimate interest.

What lawful basis covers lead scoring in a CRM?

Usually legitimate interest under Article 6(1)(f), backed by a written legitimate interests assessment covering purpose, necessity, and balancing. If your scoring becomes a solely automated decision with significant effects, legitimate interest is no longer enough, and you need explicit consent or contract necessity under Article 22(2).

The principle underneath all of this is simple. GDPR does not object to a machine helping you sort your leads. It objects to a machine deciding someone's fate with no accountable human able to say otherwise. Keep a competent person able to change the outcome, write down why you score, and tell people you do. Do those three things and automated lead scoring is ordinary, compliant practice.

• GDPR Article 22 full text, The verbatim rule on solely automated decisions, the three permitted lawful bases, and the required safeguards.
• GDPR Article 35 full text, When a Data Protection Impact Assessment is mandatory for systematic automated evaluation.
• EDPB Automated decision-making and profiling guidelines, Official EDPB page endorsing the WP29 guidance on profiling and meaningful human involvement.
• EDPB Guidelines 1/2024 on legitimate interest, The three-part legitimate interests assessment and the requirement for a precisely articulated purpose.
• CJEU SCHUFA judgment C-634/21 (A&O Shearman analysis), The ruling that a credit score can itself be automated decision-making when a third party draws strongly on it.
• Irish Data Protection Commission on the right to be informed, Transparency duties under Articles 13 and 14, including disclosing automated decision-making and its logic.
• IAPP summary of WP29 profiling guidelines, Source for the standard that human review be meaningful rather than a token gesture, plus the rubber-stamping warning.
• Mondaq on WP29 guidance for behavioural advertising, Examples of marketing that can reach the similarly significant threshold, including differential pricing and gambling ads.