Customer-data protection

Protecting customer information builds trust. This lesson applies the same principle to three distinct stages of business.

Why it matters: Illustrative example: a business keeps photos of identity documents in a shared chat. It should first ask whether those documents are necessary and who can access them.

Risk grows when every team member can access everything: shared passwords, customer documents in chat and unprotected spreadsheets. Use multifactor authentication, avoid password reuse, restrict access to those who need it and review privileges when staff leave. Never promise absolute security; establish processes you can verify.

Decision scenario: an employee leaves but still has access to business email and customer records. The owner should revoke access, rotate shared credentials if any, document the issue and assess obligations under applicable law. Rehearse what happens if a work phone is lost: who responds, how accounts are secured, how backups are restored and whether notices are required. FTC: https://www.ftc.gov/business-guidance/small-businesses/cybersecurity .

Practical steps: 1. IDEA: decide which information is truly necessary to answer an inquiry. 2. STARTING: enable multifactor authentication, restrict access, update software and protect backups. 3. ESTABLISHED: audit former employees' access, data retention, deletion practices and incident response. 4. PRACTICE — Create a five-column inventory: data type, purpose, access, storage location and deletion date. Question anything without a clear purpose. 5. REFLECT — What decision would you change today, and what real information do you still need before spending money?

An important note: FTC official cybersecurity guidance: https://www.ftc.gov/business-guidance/small-businesses/cybersecurity . Applicable legal duties depend on jurisdiction and context.