Relationships deserve better infrastructure.

Private client work runs on relationships: who knows whom, who made an introduction, who asked not to be contacted. Much of that knowledge lives in inboxes, phones and memory. Moving it into a system brings order. It also creates a file of personal data about people who may never have met the firm.

Personal data, and a basis for each purpose

Law No. 1.565 defines personal data as any information relating to an identified or identifiable person. A CRM entry, a note after a dinner, an introducer’s comment and a pipeline stage all qualify. Under article 3, the law applies to controllers established in Monaco wherever the processing runs, and to firms abroad that offer goods or services to people in Monaco or monitor their behaviour.

Article 5 lists six lawful bases. Three recur in relationship work: steps taken at the person’s request before a contract, legitimate interest weighed against the person’s rights and freedoms, and consent. The APDP’s consent factsheet restates the definition: free, specific, informed and unambiguous, given by a statement or a clear positive act. Record the basis for each purpose. Client service and new business development are different purposes and may rest on different bases.

Tell people, and honour objections

Article 11 sets out what people must be told, including their right to object to use or disclosure of their data for prospecting. Article 17 lets a person object at any time to processing for prospecting, including profiling linked to it. A good CRM turns that objection into a hard stop: a flag that blocks outreach, sharing and enrichment, and that survives imports and merges.

Email outreach has its own rule

Monaco’s digital economy law adds a channel rule. Article 11 of Law No. 1.383 prohibits direct prospecting by automated call, fax or email using the details of a consumer who has not given prior consent. A narrow exception covers details collected from the consumer during a sale or service, for similar products or services from the same supplier, with a simple, free way to object at collection and in every message. Every prospecting message must give a valid address for stopping contact. The text speaks of consumers. How it applies to professional contacts is worth confirming with counsel before any campaign.

Introductions with provenance

An introduction is often the most valuable entry in the system. Record:

• who made the introduction, and when;
• what the introduced person agreed to;
• the source and date of each fact held;
• any limit the introducer set.

Source diligence matters. Draw on what the person or the introducer provided, and on lawful public sources relevant to the purpose. Avoid scraping, lists of unclear origin, and enrichment that builds a profile the person would not expect. Article 4 requires data to be adequate, relevant and limited to the purpose.

A human hand on every message

AI can draft a follow-up, summarise a thread or suggest a next step. A person reads, edits and sends. Article 19 protects people from decisions with legal or similarly significant effects taken solely by automated means. Keep the model in a drafting role, keep people out of automated exclusion lists, and log who approved each message.

Discretion inside the firm

A pipeline reveals intent: a family preparing a sale, a principal weighing a move. Limit visibility by role and by relationship. Keep sensitive matters out of firm-wide views, and log access. The APDP’s obligations summary requires security matched to the risk, and a file of private individuals and their plans deserves a careful assessment. If a pipeline leaks, article 32 applies: notify the APDP without undue delay and, where possible, within 72 hours, unless the breach is unlikely to create a risk to people’s rights and freedoms. The APDP has reminded controllers that pending investigations do not justify a late notice.

Set review dates, too. A prospect who never engaged should not stay in the file indefinitely. When someone objects or asks for erasure, act across the CRM, the mail archive and any search or AI index built from them. The Sovereign Ordinance No. 11.327 sets how identity is checked for rights requests, and treats a request left unanswered past the deadline as rejected.

Limits of this note

This piece sets out design choices. It is not legal advice. Outreach across borders may also engage the GDPR or other regimes, depending on where recipients are and who sends the message. Review channel rules, lawful bases and notices with counsel before launching a programme. Good infrastructure records every decision. People still make them.