Spreadsheet or CRM? Fix first, then decide whether to change tool

"Do we need a CRM?" can be several smaller questions in one. Take each problem in turn, try a fix with the tools you already have, and buy only the capability you still lack. Fixes still take staff time, so they aren't free, but they can be quicker to try than a move.

This guide is for owners and office leads at small UK service businesses who track enquiries, customers or jobs in a shared spreadsheet and keep hearing that they need a CRM (customer relationship management system). It shows you how to test fixes symptom by symptom, what to ask a CRM provider if you do decide to move, and who should be responsible for what during a move. It includes blank records and a hypothetical worked example.

It doesn't recommend any product, and it doesn't assume a CRM is the answer.

1. What a shared spreadsheet can do for a small team

A shared spreadsheet is familiar, flexible and quick to change. For a small team with clear rules about who updates what, it can do the job well.

The trouble starts when the rules aren't there, or when the sheet is asked to do things it wasn't set up for. Our guide to managing customer enquiries lists signs that a spreadsheet may be straining. This guide starts where that list ends: what to try before you buy, and what to do if you move.

2. Go symptom by symptom

Pick the problem that's causing the most trouble, try a fix inside your current sheet or routine, and give it a fair trial. If it works, keep the sheet. If it doesn't, write down what's still missing.

These are illustrative examples, not universal thresholds:

How to read it: if the fix works, keep the sheet. If it fails and the missing capability matters to how you work, that capability becomes your buying criterion, not a brand name.

3. Editing and viewing are different controls

One symptom needs more care than the others. Stopping people changing information isn't the same as stopping them seeing it.

• Editing. Restricting who can edit protects the sheet from accidental changes. That's an integrity measure.
• Viewing. If some people mustn't see certain information, keep it in a separate file or location with its own access permissions. Alternatively, use a viewing control your tool documents as supported, and check that it works.

Moving, hiding or protecting a tab or column doesn't stop people with access to the file from reading it. Google's help on protecting sheets and ranges says protection "shouldn't be used as a security measure", and that viewers can still access content in hidden sheets. Microsoft's guidance on protection and security in Excel says worksheet-level protection "is not intended as a security feature".

To check, sign in as a representative restricted user, or ask someone with that level of access, and confirm what they can and can't see and edit. If your current set-up can't control who sees each record or field, that's a genuine missing capability.

4. Record what you tried

Use one card for each symptom. Fill it in when you start a fix, and again when you've given it a fair trial.

1. Copy the blank card into a document or a tab of your sheet.
2. Describe the symptom in plain words, with an example.
3. Record the fix and the date you started it.
4. After an agreed period, record whether it worked.
5. If it didn't, name the missing capability. That's the input for any buying decision.

5. Fix the process before the tool

A tool can't decide who owns an enquiry or what happens next. If the process isn't agreed, a new tool can carry the same confusion onto a different screen.

Our guide to mapping your enquiry-to-delivery process shows how to agree the route and choose one change before choosing software. Our guide on what to automate first covers checking what the tools you already have can do.

6. Questions to ask any CRM provider before you buy

If your fixes have shown a genuine missing capability, ask each provider about the things that matter after you've signed up, not just the features:

• Getting your data in and out. Can you import your current records cleanly? Can you export everything later, in a format you can use elsewhere?
• Permissions. Can you control who can view, edit and export each record or field? Can you see who did what?
• History. Does each record keep a reliable history of changes and contact?
• Written terms. If the provider holds your customers' personal data on your behalf, there should be a written contract covering how it handles that data. Under Article 28 of the UK GDPR, that contract must set out, among other things, that at the end of the service the provider deletes or returns all the personal data, at your choice, and deletes existing copies unless domestic law requires the data to be stored. Read those terms before you sign. This isn't legal advice, and it doesn't mean any particular provider's terms are adequate.
• Cost of seats. Who needs a login, and what will it cost as the team changes?
• Leaving. What happens to your data if you stop paying or switch later?

7. The same data duties apply in either tool

The law doesn't say which tool to use. The same duties apply whether customer details live in a spreadsheet or a CRM:

• Accuracy and keeping data no longer than needed. Article 5 of the UK GDPR says personal data must be accurate and, where necessary, kept up to date, and kept in identifiable form for no longer than is necessary for the purposes. It doesn't set periods: those are your decision, and you should be able to justify them.
• Security appropriate to the risk. Article 32 requires measures appropriate to the risk, and a process for regularly testing their effectiveness. Checking permissions as a restricted user, as in section 3, is one practical way to do that.

Neither a spreadsheet nor a CRM is secure or compliant by default. It depends on how you set it up and look after it.

8. If you move: name who is responsible for what

A move is a good moment to decide what not to bring. For each set of data, decide whether to move, archive or delete it, and name who's responsible.

1. List each data set, such as current customers, open quotes, old enquiries and export files.
2. Decide: move, archive, or delete. Write the reason.
3. Name the owner who checks accuracy before the move.
4. Decide who can view, edit and export the data after the move.
5. Record when old copies are removed.
6. Check the provider's terms on returning or deleting data at the end.

Hypothetical example

Hypothetical example only: an invented three-person cleaning company. It is not a ScalePass client, not data and not legal advice. The periods and decisions are this business's own choices, not recommendations.

The company tried the owner and reminder fixes from section 2. They didn't hold, because assignment notifications and automatic reminders were the missing capabilities. So it decided to move to a CRM.

9. After the move: check permissions and old copies

• Check access as a restricted user. Confirm what each role can see, edit and export.
• Remove old copies. The old sheet, exports on laptops and email attachments are copies too. Delete them on the agreed date and record it.
• Keep the rules. Owners, next actions and regular reviews still matter in a new tool.

Common questions

Is a spreadsheet allowed for customer data?

The law doesn't specify a tool. The same duties apply: keep data accurate, keep it no longer than needed, and protect it in a way that suits the risk. A spreadsheet can meet those duties if it's set up and looked after well. So can a CRM, and neither does automatically.

Will a CRM fix our follow-ups?

Only if the cause is something a CRM adds, such as automatic reminders. If nobody owns each enquiry or agrees the next action, the same gaps can appear in a new tool. Try the owner and next-action fixes first.

What should we not move?

Anything you no longer need for the purpose you collected it for, records you can't explain the source of, and duplicate copies. Decide these before the move rather than carrying them across.

Who keeps the records accurate?

Name an owner for each data set. In a small business it may be the same person for several, but writing it down means someone checks.

What happens to the old sheet?

Decide in advance. You might make it read-only while you check the move, then delete it on an agreed date. Record when it was removed, and remember exports and attachments too.

ScalePass helps service businesses connect the forms, inboxes and records they already use, and improve them one agreed step at a time. If you'd like help fixing your current set-up or planning a move, see how we approach connected systems.

In short

Treat "do we need a CRM?" as several smaller problems. For each one, try a fix inside your current sheet and record the result. Restrict editing for integrity, but control viewing through separate permissions, because hiding or protecting a tab isn't confidentiality. If a fix fails, the missing capability is your buying criterion. If you move, decide what to move, archive or delete, name who's responsible, check the provider's written terms on returning or deleting data, and remove old copies.