---
title: "360-Degree Customer View and GDPR: What You May Merge"
description: "Merging POS, web and social data into one customer profile? What GDPR asks, with a decision table by source, purpose, legal basis and risk."
url: "https://staging.khoi.co.uk/en/blog/nhin-khach-360-do-gdpr"
lang: en-GB
author: "Lê Quốc Khôi"
date: 2026-11-03
updated: 2026-11-03
topics: ["Ethics & corporate governance"]
tags: ["360-degree customer view", "GDPR", "Data privacy", "Consent", "Personalisation"]
---

# The 360-degree customer view: where GDPR draws the line

## Key takeaways

- Merging data is an operation GDPR names: Article 4(2) lists "alignment or combination" beside collection and storage (European Parliament and Council, 2016). Wedel and Kannan (2016) describe a "mosaic effect": combining datasets can reveal information about consumers that should stay private (Wedel and Kannan, 2016).
- GDPR can reach a seller outside the EU that offers goods or services to people in the EU, or monitors their behaviour there (Article 3(2)); a website merely reachable from the EU is not enough (Recital 23) (European Parliament and Council, 2016). This post does not cover Vietnamese law.
- Consent must be freely given, specific, informed and unambiguous (Article 4(11)); people may object to direct marketing, profiling included (Article 21(2)). The ceiling for breaching these rules is EUR 20 million or 4 per cent of worldwide turnover (Article 83(5)) (European Parliament and Council, 2016).
- Martin and Murphy's (2017) review links open collection, real control and trust to better personalisation results; covert collection leaves customers feeling vulnerable. It does not mention GDPR (Martin and Murphy, 2017).
- The "Trà Sông Mát" tea chain is invented: 5,100 customers matched across POS and web, 1,900 of them consenting to email (37 per cent).

Your tea chain has six shops, an online ordering page, a Facebook page and a loyalty card keyed to a phone number. The owner wants one screen per customer: what they buy at the counter, what they browse online, what they click on social media. Hundreds of web customers already take delivery in Germany or the UK. Once the records are joined, what may the merged profile be used for?

## What does a 360-degree customer view merge?

The library defines the [360-degree customer view](https://staging.khoi.co.uk/en/glossary#customer-360-view) as a complete picture of one customer assembled from web, purchases, social media and devices. Wedel and Kannan write that companies have been collecting data from multiple sources and fusing them to build better customer profiles (Wedel and Kannan, 2016). The [Customer journey mapped to data signals](https://staging.khoi.co.uk/en/framework/data-driven-customer-journey) framework shows which signal each stage leaves behind.

> **Figure:** [Customer journey mapped to data signals](https://staging.khoi.co.uk/en/framework/data-driven-customer-journey) The five customer stages and their data signals (the library's framework, from Lemon and Verhoef, 2016).

I read the five columns differently: almost every signal arrives with an identifier such as a cookie, an account or a phone number. Article 4(1) names an "online identifier" and location data in its definition of personal data, and Recital 30 says traces left behind, combined with unique identifiers, can be used to profile and identify a person (European Parliament and Council, 2016). A click attached to a customer is personal data.

## Does GDPR apply to a shop in Vietnam?

It can, when Article 3(2) is met: a controller outside the EU offers goods or services to people in the EU, paid or not, or monitors their behaviour there (European Parliament and Council, 2016). Recital 23 says that a website reachable from the EU, an email address, or a language common in your own country is not enough. Using a language or currency of a Member State, with the option to order in it, or mentioning customers in the EU, may show intent. Recital 24 treats tracking people on the internet, profiling included, as monitoring (European Parliament and Council, 2016).

This post does not cover Vietnamese or UK law, because it uses no source on them, and it does not say which side of the line your shop falls on.

## What does personalisation buy, and how do customers react to being tracked?

Martin and Murphy (2017) review privacy research in marketing. Personalisation, they write, has mixed effects: customers get value but must release more information (Martin and Murphy, 2017). Four points for a CRM team, all as the review summarises them:

- Open beats covert. Aguirre and colleagues (2015) found personalisation earns more click-through when collection is overt, while covert collection, once noticed, makes customers feel more vulnerable. Miyazaki (2008) found trust and purchase intent fell when cookie use was hidden (Martin and Murphy, 2017).
- Control helps, if it is real. Tucker (2014) found people responded better to personalised ads when they could adjust their privacy settings; Wedel and Kannan say click-through doubled. Yet Brandimarte and colleagues (2012) found a feeling of control made people disclose more (Martin and Murphy, 2017; Wedel and Kannan, 2016).
- Too close feels creepy. Martin and Murphy report that Target once predicted a teenager's pregnancy before she had told anyone, and now mixes its personalised ads among less prominent ones. They cite Duhigg (2012), a source this post has not checked (Martin and Murphy, 2017).
- Limits have a price. After the EU's privacy and electronic communications directive, online ad effectiveness, measured by stated purchase intent, fell substantially in the EU and did not change elsewhere (Goldfarb and Tucker, 2011) (Martin and Murphy, 2017).

Neither source mentions GDPR, so they show only how customers react.

## What does GDPR ask when two sources are joined?

First, what is the join for? Article 5(1)(b) says data is collected for specified, explicit and legitimate purposes and not further processed in a way incompatible with them. Article 5(1)(c) wants data "limited to what is necessary". For a new purpose not based on consent or on a qualifying law, Article 6(4) points to the link with the original purpose, the context of collection, the nature of the data, the consequences for the person and safeguards (European Parliament and Council, 2016).

Second, on what basis? Article 6(1) offers six, including consent, contract and legitimate interests. Recital 47 says direct marketing "may be regarded" as a legitimate interest, but the controller must also ask whether people could reasonably expect it (European Parliament and Council, 2016). [Consent](https://staging.khoi.co.uk/en/glossary#valid-consent) under Article 4(11) must be freely given, specific, informed and unambiguous; you must be able to show it (Article 7(1)); people can withdraw at any time, as easily as they gave it (Article 7(3)). Recital 43 presumes consent is not freely given if separate operations cannot be consented to separately where that is appropriate (European Parliament and Council, 2016). One "I agree to everything" box covering loyalty points and ad matching would struggle against that test.

Third, what are people told, and how do they say no? Article 13(1)(c) requires the purposes and legal basis at collection, and Article 13(3) requires notice before data is used for another purpose; data from another source, such as social media, falls under Article 14, which adds the source. Article 21(2) and (3) let people object to direct marketing at any time, profiling related to it included, and after an objection the data may no longer be processed for that purpose (European Parliament and Council, 2016).

## What happens with an invented tea chain: which source, which purpose, which basis?

**Hypothetical example.** The chain "Trà Sông Mát", six shops in Cần Thơ, and every figure below are my invention. POS holds 42,000 loyalty members keyed by phone number; the web shop holds 9,500 accounts; matching on phone number joins 5,100 people. Of the web customers, 640 take delivery in the EU or the UK, and the site shows prices in euro. The table is my reading, not legal advice.

| Source | Original purpose | Basis or consent needed | Risk when combined |
|:--|:--|:--|:--|
| POS receipts, phone number | Loyalty points | Contract for the points (Article 6(1)(b)); advertising is a separate purpose | Sending purchase history to social-media ads is a new purpose (Article 6(4)) |
| Web account | Delivering orders | Contract; marketing email needs consent or legitimate interest (email-specific rules are outside this post) | Joining to POS adds offline behaviour customers did not expect |
| Cookies, pixel | Measurement, retargeting | Online identifiers are personal data (Article 4(1)); cookie rules are separate and outside this post | Covert collection erodes trust (Martin and Murphy, 2017) |
| Facebook page: comments, follower names | Community care | Not obtained from the person: Article 14 requires source and purpose | Pulling account names into the CRM turns public chat into a profile |
| Staff notes ("shellfish allergy"); inferred "poor sleeper" group | Service | Health data: Article 9(1); explicit consent or another ground (Article 9(2)) | Whether herbal-tea purchases imply health data is a lawyer's question |

Article 4(15) defines data concerning health as data on physical or mental health that reveals health status (European Parliament and Council, 2016); on my reading an allergy note belongs there.

Now price one campaign. Of the 5,100 matched people, 1,900 consented to marketing email, which is 37 per cent. Suppose a personalised offer lifts coupon use from 4 to 6 per cent (also invented): that is 38 extra redemptions across 1,900 people, or 102 across all 5,100. In this scenario, using only the consented list gives up 64 redemptions. The invented numbers cannot price trust: Martin and Murphy link transparency and control to better outcomes, but give no figure to plug in (Martin and Murphy, 2017).

## Where should the merging stop?

It suits you if every join key, such as phone or email, has a written purpose; customers have been told; and a marketing-block flag reaches every channel, since Article 21(3) bars direct-marketing use of an objector's data. It does not suit you if the aim is to collect everything in case it is useful, which Article 5(1)(c) cuts against, or if an inferred segment touches health without explicit consent.

Wedel and Kannan advise keeping sensitive information in separate systems, restricting who inside the company can see it, and having a breach response plan (Wedel and Kannan, 2016). Martin and Murphy write that privacy efforts lacking authenticity will be easily identified by customers (Martin and Murphy, 2017). See also the earlier post on [personalisation or customisation](https://staging.khoi.co.uk/en/blog/ca-nhan-hoa-hay-tuy-bien).

## Going deeper: how were the sources used?

Martin and Murphy (2017) is used as an online-first manuscript PDF posted on a third-party site, with no print page numbers, so the post gives none. Its European passages concern the earlier EU directives, not GDPR.

Wedel and Kannan (2016) is used through the abstract, the authors' five classroom slides on the American Marketing Association's site, and the 13 May 2016 preprint as re-uploaded to SlideShare by someone else (sections 1, 2, the start of 3, 4.1.1, 4.2 and 4.3), not the final print version. The phrase "360" does not appear in it. Lemon and Verhoef (2016), the framework's origin, is not used; the signal-by-stage table is the library's.

GDPR (Regulation (EU) 2016/679, applicable from 25 May 2018): the post relies on Articles 3, 4, 5, 6, 7, 9, 13, 14, 21 and 83 and Recitals 23, 24, 30, 43 and 47 on an unofficial copy, gdpr-info.eu, because EUR-Lex blocked automated access. It does not cover UK data protection law, Directive 2002/58/EC on cookies and email marketing, EDPB guidance, case law or Vietnamese law, and it does not track amendments or guidance issued after this text.

## Frequently asked questions

### If I hash or pseudonymise customer names in the CRM, am I outside GDPR?

On my reading, no. Article 4(5) defines pseudonymisation as processing so that data can no longer be attributed to a person without additional information, which must be kept separately under technical and organisational measures (European Parliament and Council, 2016). Article 6(4)(e) then lists encryption or pseudonymisation as a safeguard to weigh when you want a new purpose, so it lowers risk rather than taking data out of scope (European Parliament and Council, 2016).

### What is the maximum GDPR fine, and should a small Vietnamese shop worry?

Article 83(5) sets a ceiling of EUR 20 million or 4 per cent of total worldwide annual turnover of the preceding year, whichever is higher, for breaches of the principles in Articles 5, 6, 7 and 9 and of the data subject's rights in Articles 12 to 22 (European Parliament and Council, 2016). It is a ceiling, not a typical fine: Article 83(2) tells authorities to weigh the nature, gravity and duration of the breach, the number of people affected and other factors (European Parliament and Council, 2016). The post examines no enforcement decision against a small non-EU shop, so it cannot say what happens in practice.

### A customer objects to marketing. Must I delete their whole record?

Article 21(2) and (3) say that once someone objects, their data may no longer be processed for direct marketing, profiling related to it included (European Parliament and Council, 2016). The text does not say everything must be erased; a delivered order may still be needed for accounts or warranty. My practical reading is that you need a marketing-block flag that every channel reads. Erasure under Article 17 is outside this post.

### Does this post cover Vietnamese or UK data protection law?

No. The post uses no source on Vietnamese or UK rules, so it claims nothing about them. Ask a lawyer which rules apply to your business.

## References

- European Parliament and Council (2016) *Regulation (EU) 2016/679 (General Data Protection Regulation)*. Official Journal of the European Union. Available at: https://eur-lex.europa.eu/eli/reg/2016/679/oj.
- Martin, K.D. and Murphy, P.E. (2017) ‘The role of data privacy in marketing’, *Journal of the Academy of Marketing Science*, 45(2), pp. 135–155. https://doi.org/10.1007/s11747-016-0495-4
- Wedel, M. and Kannan, P.K. (2016) ‘Marketing analytics for data-rich environments’, *Journal of Marketing*, 80(6), pp. 97–121. https://doi.org/10.1509/jm.15.0413

---

Canonical HTML version: https://staging.khoi.co.uk/en/blog/nhin-khach-360-do-gdpr