Common Mistakes and Official Sources
CRM mistakes small businesses make, and the official Canadian sources to check
The common patterns behind failed small-business CRM projects in Canada, how to prevent each one, and the regulators and portals for CASL, DNCL, privacy, language and tax.
Small-business CRM projects rarely fail because the software is bad. They fail in a handful of predictable ways: buying from a demo instead of a process map, importing messy data, skipping integration tests, leaving nobody in charge, discovering CASL or privacy gaps after the first campaign, and signing an auto-renewing contract without a tested exit. Each mistake has a cheap prevention step. This guide lists the patterns, describes them generically (no companies named), and gathers the official Canadian sources you should check before and after you buy.
This is the pillar of the common mistakes and official sources section. It is general information, not legal advice.
Ten common patterns and how to prevent them
| # | Pattern | What it looks like | Prevention | Guide |
|---|---|---|---|---|
| 1 | Demo-led choice | Bought the product with the best demo; it does not fit the sales process | Map the process and write must-haves first | Selection method |
| 2 | Wrong tier | Key feature (quotes, automation) was in a higher tier | Price the lowest tier that meets every must-have | Pricing models |
| 3 | Dirty import | Duplicates, old addresses, no consent data | Clean before importing; map consent fields | Migration |
| 4 | Broken sync | Email, accounting or form integrations fail silently | Test each integration in the trial | Integrations |
| 5 | No owner | Fields multiply; reports stop matching | Name an internal owner with protected time | Adoption |
| 6 | CASL gaps | Everyone imported as "subscribed"; unsubscribes not synced | Record consent type and date; sync unsubscribes | CASL |
| 7 | Calling without scrubbing | Promotions phoned to numbers on the National DNCL | Scrub monthly; keep an internal list | DNCL |
| 8 | Privacy surprises | Data hosted abroad without notice or, in Quebec, without a PIA | Ask about hosting; do the assessment first | PIPEDA and Law 25, data residency |
| 9 | Language gaps | English-only interface and templates for Quebec staff and customers | Check French support in the trial | French in Quebec |
| 10 | Locked in | Auto-renewal missed; export incomplete | Test export; diarise notice dates | Contract terms |
Three patterns in more detail
The spreadsheet that never died
A typical scenario: a team of five moves to a CRM, but two salespeople keep their personal spreadsheets because they trust them more. Within three months the CRM pipeline is incomplete, so the owner stops using its reports, which tells everyone the CRM is optional. The fix is not more features but a rule: pipeline meetings use only the CRM, and leads are assigned only through it. Plan this before go-live.
The newsletter that broke CASL
Another common pattern: an owner imports 4,000 email addresses collected over ten years from invoices, trade shows and a purchased list, and sends a promotional newsletter to all of them. Many of those people never gave express consent, and the implied consent from old purchases ended two years after each purchase. The cost is not only complaints; it is also a higher marketing-contact tier. A consent review before import would have reduced the list and the risk.
The renewal nobody noticed
A third pattern: an annual plan bought with a first-year discount renews automatically at list price because the 60-day notice window passed during a busy season. The business is committed for another year, with seats for two people who have left. A calendar reminder 90 days before renewal and a seat review would have prevented it. See annual vs monthly billing.
Official sources to check
| Topic | Official source | What to check there |
|---|---|---|
| Commercial email and texts (CASL) | CRTC | Consent rules, unsubscribe requirements, enforcement decisions |
| CASL text | Justice Laws Website | S.C. 2010, c. 23 and its regulations |
| Telemarketing | National Do Not Call List | Telemarketer registration, subscriptions, list downloads |
| Federal privacy (PIPEDA) | Office of the Privacy Commissioner of Canada | Consent guidelines, service providers, cross-border processing, breach reporting |
| Quebec privacy (Law 25) | Commission d'accès à l'information du Québec | Person in charge, PIAs, incidents, consent |
| Alberta and BC private-sector privacy | OIPC Alberta, OIPC BC | Provincial PIPA rules |
| French language in Quebec | Office québécois de la langue française | Software, commercial documents, francization |
| Federal bills | LEGISinfo, Parliament of Canada | Status of Bill C-36 and other privacy bills |
| GST/HST | Canada Revenue Agency | Rates, Notice 322, input tax credits |
| QST | Revenu Québec | QST and specified registration |
| Misleading advertising | Competition Bureau Canada | Price claims, drip pricing, misleading electronic messages |
| Cyber security | Canadian Centre for Cyber Security | Small-business security guidance for cloud services |
The 2026 legal picture in brief
- CASL has been in force since 2014. Unsubscribes must be honoured within 10 business days; maximum penalties are $1 million per violation for individuals and $10 million for others.
- The Unsolicited Telecommunications Rules and the National DNCL continue to apply to telemarketing.
- PIPEDA remains the federal private-sector privacy law. Bill C-27, which would have replaced it, died when Parliament was prorogued in January 2025. A new bill, C-36, was introduced in June 2026 and, as of October 2026, is still before Parliament and not law. Check LEGISinfo for its progress.
- Quebec's Law 25 is fully in force; its final stage, the right to data portability, took effect in September 2024.
- Bill 96 strengthened Quebec's Charter of the French Language, with requirements phased in since 2022.
When to get professional advice
Talk to a lawyer if you send high volumes of consumer marketing, buy or share contact lists, handle health or financial information, sign a multi-year or high-value CRM contract, or operate substantially in Quebec. Talk to an accountant about sales tax on foreign vendors and about loaded staff costs for your payback calculation.
FAQ
What is the most expensive CRM mistake?
Usually low adoption: you pay for every seat while the team works around the system. It is also the one most within your control.
Can I report a vendor that misled me about features?
Misleading representations in advertising can be reported to the Competition Bureau. Contract disputes are a matter for the contract and, if needed, a lawyer or small-claims court.
How do I check if a CRM vendor collects GST/HST properly?
Check the vendor's registration number on its invoice and use the CRA's GST/HST registry search tool if needed.
Where do I complain about spam?
Complaints about spam and other CASL violations go to the Spam Reporting Centre, which the CRTC's site links to.
Sources
- Canadian Radio-television and Telecommunications Commission — CASL and telemarketing rules
- Office of the Privacy Commissioner of Canada — PIPEDA guidance
- Commission d'accès à l'information du Québec — Law 25
- LEGISinfo — status of federal bills
- Canadian Centre for Cyber Security — cloud security guidance for small organisations
