Start with an inventory
You cannot protect what you have not listed. Write down every place customer data lives: the CRM, the accounting system, the shared drive, the email archive, the spreadsheet on someone's laptop, the form tool nobody remembers signing up for.
This exercise takes an afternoon and reliably surprises people. The spreadsheet on the laptop is usually the finding.
Collect less
- Remove form fields you do not use
- Stop copying data into secondary systems “in case”
- Delete the exports people took for a one-off report two years ago
- Question whether you need date of birth, full address or identification documents at all
Every field you do not hold is a field you cannot lose, do not have to secure and do not have to delete on request.
Delete on a schedule
Decide retention per category and implement it rather than intending it. Old customer records, old applications, old CCTV, old email.
Retention that exists only as a policy document is not retention. If nothing deletes automatically, everything is kept forever, which is both a legal exposure and an unnecessary risk.
Restrict who can see what
Not everyone needs access to everything. Sales does not need bank details; support does not need the full customer file. Role-based access in the systems you already use costs nothing but configuration.
Pay particular attention to shared drives, where permissions accumulate silently and nobody reviews them.
Have a plan for requests
Individuals can ask what you hold, ask for a copy, or ask you to delete it. The deadlines are short. Knowing in advance where to look and who does it turns a stressful scramble into an afternoon.
- A named person responsible
- A written list of every system to check — this is where the inventory pays off
- A template response and a way to produce an export
- A record of what was done and when