FlowConsent
How it worksPricingComparisonsBlogDocumentationLog inTry FlowConsent
Try FlowConsent
Marketing

Salesforce

MarketingOfficial website

Salesforce is the world's leading CRM platform, providing Sales Cloud, Marketing Cloud, Service Cloud, Commerce Cloud, Pardot (now Marketing Cloud Account Engagement), and Einstein Analytics. GDPR compliance for Salesforce is complex because different products require different legal bases and compliance approaches. EU data residency options exist in Germany. Salesforce provides comprehensive GDPR DPAs across its product suite and offers GDPR-specific features including data subject request management.

Block Salesforce until consentScan my site
Overview

What does Salesforce do?

What is Salesforce?

Salesforce is the world's largest CRM and enterprise software company. Its product portfolio spans Sales Cloud (CRM and pipeline management), Marketing Cloud (email, SMS, social marketing automation), Service Cloud (customer service), Commerce Cloud (e-commerce), Pardot/Marketing Cloud Account Engagement (B2B marketing automation), Tableau (analytics), Slack (collaboration), MuleSoft (integration), and Einstein AI across all products. Each product processes personal data differently and requires its own GDPR assessment.

GDPR complexity: multiple products, multiple legal bases

Salesforce's breadth means GDPR compliance is not a single exercise but a portfolio of assessments. Sales Cloud CRM contacts: legitimate interest or contract performance. Marketing Cloud email campaigns: consent for marketing. Pardot web tracking: consent for cookies. Service Cloud support tickets: contract performance or legitimate interest. Tableau analytics: depends on data analysed. Each cloud requires its own DPA annexe, legal basis documentation, and data subject rights workflow.

EU data residency

Salesforce offers EU data residency in Germany for certain products and plans. When configured, primary CRM and Marketing Cloud data remains within the EU. Not all Salesforce products support EU residency. Verify per product with your Salesforce account team. For standard deployments, the Salesforce DPA and SCCs cover EU-US data transfers.

Pardot and B2B marketing compliance

Pardot (Marketing Cloud Account Engagement) tracks individual prospect behaviour across websites using cookies and form submissions. This requires consent for cookie-based tracking and a documented legal basis for prospect profiling. Pardot's lead scoring and grading constitutes automated processing that may need disclosure. Implement Pardot cookie consent and integrate with your CMP.

Practical compliance steps

Sign Salesforce DPA covering all products in use. Request EU data residency for applicable products. Implement legal basis fields in Salesforce for each contact. Configure Marketing Cloud consent management for email. Block Pardot tracking cookies via CMP. Deploy Salesforce's data subject request management tools. Conduct a DPIA covering the full Salesforce deployment. Add Salesforce to your privacy policy per product.

Compliance

Salesforce and the GDPR

Salesforce is classified as “Marketing”. On a site that targets European visitors, it must only load after the visitor consents, and it must be listed in your cookie policy.

Legal basis
Multiple legal bases across Salesforce products. CRM contact management: legitimate interest or contract performance. Marketing Cloud email campaigns: consent. Pardot tracking and lead scoring: consent for cookies, legitimate interest assessment for B2B prospect data. Analytics and reporting: varies by data category.
Risk level
high
Applicable regulations
GDPR, ePrivacy Directive, SCCs for US transfers. Salesforce spans many products each requiring individual GDPR assessment.

Impact assessment (DPIA)

A DPIA is strongly recommended for large-scale Salesforce deployments spanning multiple clouds and processing comprehensive EU customer profiles. The breadth and depth of personal data processed across the Salesforce platform warrants thorough documented assessment.

Sample text for your banner

Your contact information is managed in our Salesforce CRM system. We process this data to manage our relationship with you, provide services, and where you have consented, to send marketing communications. See our privacy policy for full details and to exercise your rights.
Cookies and trackers

What Salesforce sets and contacts

Tracking method
CRM platform, Marketing Cloud tracking pixels, Pardot forms and cookies, Einstein Analytics, Sales Cloud data processing, Service Cloud communications
Server location
United States with EU data residency options (Germany)
Data transferred outside the EU
Salesforce is a US-based CRM platform. EU data residency options are available in Germany for certain Salesforce products. Standard deployments transfer EU personal data to US infrastructure requiring SCCs. Salesforce provides comprehensive GDPR DPAs across its product suite.

Cookies set (2)

NameTypeDurationPurpose
visitor_idpersistent2 yearsSalesforce Pardot visitor identifier for website behaviour tracking and lead scoring
_mkto_trkpersistent2 yearsSalesforce Marketing Cloud / Marketo visitor tracking cookie for email and web analytics

Third-party domains contacted (3)

  • salesforce.com
  • pardot.com
  • exacttarget.com
Questions

Frequently asked questions about Salesforce

Can't find your question? Write to us, we answer fast.

Is Salesforce GDPR compliant?

Yes. Salesforce provides comprehensive GDPR DPAs across its product suite, EU data residency options, and GDPR-specific features including data subject request management. Compliance requires proper configuration and legal basis documentation for each Salesforce product in use.

What legal basis applies to Salesforce CRM contacts?

Depends on the contact relationship. Existing customers and contracted parties: contract performance or legitimate interest. Marketing consent records: consent. B2B prospects: legitimate interest with a documented LIA and opt-out mechanism. Use Salesforce's Lead Source and custom compliance fields to document the basis per contact.

Does Salesforce offer EU data residency?

Yes, for certain products on specific plans (Germany). Sales Cloud and Service Cloud data can be configured for EU residency. Marketing Cloud EU hosting is available separately. Contact your Salesforce account executive to configure EU data residency for your organisation.

Does Pardot require consent?

Yes. Pardot's website tracking cookie (visitor_id) requires consent under the ePrivacy Directive. Block the Pardot tracking code via your CMP until analytics consent is given. Form submissions and tracked email clicks also constitute personal data processing requiring disclosure.

Do I need a DPIA for Salesforce?

Strongly recommended for large-scale deployments spanning multiple Salesforce clouds. The combination of CRM profiling, marketing automation, and AI-driven lead scoring across many EU contacts warrants thorough documented assessment.

How do I handle data subject requests in Salesforce?

Salesforce provides the Privacy Center add-on for managing data subject requests. For access requests: use data export tools. For erasure: delete Contact and Lead records, remove from Marketing Cloud subscriber lists. Ensure deletion propagates across all connected Salesforce products.

Do I need a DPA with Salesforce?

Yes. Sign the Salesforce Data Processing Addendum covering all Salesforce products in use. The DPA is available via Salesforce's trust site or via your account team. Ensure the DPA covers both your primary CRM and any Marketing Cloud, Commerce Cloud, or other products you use.

Is there a GDPR-compliant alternative to Salesforce CRM?

EU-based CRM alternatives include HubSpot with EU hosting (US company, but EU hosting available), Brevo CRM (France), and Zoho CRM (EU data centre options). For enterprise scale, SAP CRM and Microsoft Dynamics 365 (with EU data residency) are alternatives with strong GDPR frameworks.

Same category

More services: Marketing

See the whole category

MailerLite Website Builder

MailerLite Website Builder is an analytics and measurement platform providing deep insights into digital ecosystem performance. It tracks user interactions, measures campaign effectiveness, and identifies optimization opportunities across web and mobile. MailerLite Website Builder offers customizable dashboards, automated alerts, and data export capabilities. By transforming raw data into actionable intelligence, MailerLite Website Builder empowers organizations to optimize strategy and maximize return.

Analytics

Act-On

Act-On is a marketing platform that equips businesses with tools to amplify their digital presence and drive customer acquisition. It supports audience segmentation, campaign automation, and cross-channel engagement. Act-On provides real-time analytics and reporting dashboards for performance measurement and strategy optimization. By combining data intelligence with marketing execution, Act-On helps deliver the right message to the right audience at the right time.

Marketing

Salespype

Salespype is a marketing platform that equips businesses with tools to amplify their digital presence and drive customer acquisition. It supports audience segmentation, campaign automation, and cross-channel engagement. Salespype provides real-time analytics and reporting dashboards for performance measurement and strategy optimization. By combining data intelligence with marketing execution, Salespype helps deliver the right message to the right audience at the right time.

Marketing

SprintHub

SprintHub is a marketing platform that equips businesses with tools to amplify their digital presence and drive customer acquisition. It supports audience segmentation, campaign automation, and cross-channel engagement. SprintHub provides real-time analytics and reporting dashboards for performance measurement and strategy optimization. By combining data intelligence with marketing execution, SprintHub helps deliver the right message to the right audience at the right time.

Marketing

Flipping Pro CRM

Flipping Pro CRM is a customer relationship management (CRM) platform that helps businesses organize, track, and nurture customer interactions across the entire lifecycle. It provides contact management, sales pipeline tracking, and automated workflows. Flipping Pro CRM centralizes customer data from multiple touchpoints, enabling personalized experiences, faster deal closing, and improved retention. With reporting dashboards and integrations, Flipping Pro CRM empowers data-driven relationship management.

Marketing

SendX

SendX is a marketing platform that equips businesses with tools to amplify their digital presence and drive customer acquisition. It supports audience segmentation, campaign automation, and cross-channel engagement. SendX provides real-time analytics and reporting dashboards for performance measurement and strategy optimization. By combining data intelligence with marketing execution, SendX helps deliver the right message to the right audience at the right time.

Marketing

Make your site compliant today.

Free up to 25,000 sessions a month. No credit card, no commitment.

Create my bannerScan my site