Any business that keeps names, phone numbers, addresses or payment details is handling personal data. The applicable rules depend on where you operate, who your customers are and what the data is used for, but a few practical habits help in almost every case.
Know what you hold
List the kinds of personal data the business collects, where each is stored, and who has access. Many companies discover forgotten spreadsheets, old exports and shared folders when they do this for the first time.
Collect what you use
Ask for the details you need to deliver the service and no more. Data you never collected cannot be lost, leaked or misused, and it does not need to be protected or explained.
Limit who can see it
Give each person access to what their job requires. Use individual accounts rather than shared passwords, and remove access promptly when someone changes role or leaves.
Tell people what you do with their data
A short, plain notice explaining what is collected, why, and who it is shared with is better than a long document nobody reads. Make sure it matches what the business really does.
Look at the suppliers who handle it
Payment providers, marketing tools and cloud services often hold your customers' data on your behalf. Know which ones you use, and check what your agreements with them say about security and about what happens to the data if the relationship ends.
Decide in advance what you will do if something goes wrong
Agree who is told first, who investigates, and who speaks to customers and, where required, to the authorities. Time matters in the first hours, and a plan prepared in calm conditions works better than one improvised.
Requirements differ by country and sector, so check what applies to your business before relying on any general guide, including this one.
This article offers general information only. It is not legal advice, and the right answer depends on the facts of each case.
