Compliance & securityUpdated 15 July 2026

Is VisaCRM GDPR compliant?

Short answer

GDPR compliance is a property of how a system is operated, not a badge software carries. Visa applications hold passports, addresses, and financial records, so the controls that matter are role-based access, signed time-limited document links, audit logs, retention rules, and deletion on request. VisaCRM provides those; your agency remains the data controller and sets lawful basis and retention policy.

Software provides controls; compliance is the result of how your agency operates them.
Your agency is the data controller — lawful basis, retention periods, and privacy notices are yours to set.
The controls that matter most: role-based access, expiring document links, audit logs, retention rules, export and deletion.

Why can no software be 'GDPR compliant' by itself?

Because GDPR regulates what you do with data, not what a database is capable of. A vendor can give you audit logs; whether you read them is your problem. A vendor can give you retention rules; deciding you keep passport scans for two years and not ten is your decision.

In GDPR terms your agency is the data controller. You decide why the data is collected and how long it is kept. The software vendor is a processor, acting on your instructions. Any vendor claiming their product makes you compliant is describing a relationship that does not exist in the regulation.

So the honest question is not 'is this software compliant' but 'does this software give me the controls I need to be'. That is answerable.

What controls should a visa CRM give you?

Access control by role, so an agent sees their cases and not everyone's — covered in who can see my clients data. Signed, time-limited document links rather than email attachments, so a passport scan is not permanently loose in three inboxes.

Audit logs of every view and download. Under GDPR a client can ask what you hold and who has accessed it; without logs, you are guessing. Retention rules that delete files a set period after a case closes, because data you no longer hold cannot leak. Export and deletion on request, so a subject access request or erasure request is a task rather than a project.

VisaCRM provides these. Document management covers the file-level controls and admin panel covers roles and logs. What remains yours: the privacy notice, the lawful basis, the retention periods, and the staff training.

What does your agency still have to do?

Decide and document your lawful basis for processing. For most visa work that is contract performance for the application itself, but marketing to past applicants is a separate question with a separate answer.

Write retention periods down and configure them. 'We keep everything forever because deleting feels risky' is the most common visa agency policy and it is the opposite of safe: every year of retained passport scans is a year of liability with no operational value.

Get a data processing agreement from every vendor, and know where the data sits — see where visa applicant data is stored. Then handle requests within the deadlines. GDPR and data privacy for visa agencies covers the operational detail. Law firms carry an additional professional-confidentiality layer on top of the regulatory one.