Email Addresses in a Spreadsheet on a Laptop

How the copy gets made

Always for a sensible reason.

Somebody needed to send a list to a printer, check numbers for a campaign, tidy duplicates, work on a train without a connection, or produce a report the system could not.

So they exported it, worked on the file, finished the task, and moved on.

The file is still there, in a downloads folder or on a desktop, and it is a complete copy of a customer list outside every control you have: no permissions, no logging, no retention, and no deletion.

Multiply that by four people and five years and you have the actual shape of most small business data exposure.

Why this specific thing matters

Because it defeats everything else you do.

Access controls on the system are irrelevant if a full export sits on a laptop anybody can open.

A retention policy deleting old records does not touch a copy made in 2019.

A deletion request handled properly in the main system leaves the person present in three spreadsheets.

And a lost or stolen laptop stops being an inconvenience and becomes a breach involving your entire customer base.

The exports are not a secondary issue. They are frequently where most of your exposure actually sits.

Where they hide

• Downloads folders, which nobody ever empties.
• Desktops, under names like list, final, and copy of.
• Email attachments, sent and received.
• USB drives in a drawer.
• Personal cloud accounts used for convenience.
• Old laptops that were replaced and kept.
• Backups of all of the above.

The third is the largest by volume, because an emailed spreadsheet exists in the sender's sent items, the recipient's inbox, and both of their backups.

The search that finds them

Straightforward and worth doing once properly.

On each machine, search for spreadsheet and data file extensions, sort by date, and look at anything with a name suggesting a list.

Search email for attachments with those extensions, in both sent and received.

Ask each person directly whether they have exported anything in the last two years, because people remember when asked and never volunteer it.

Check the export or download history in your customer system if it has one, which tells you what was taken and by whom.

Most small businesses find between five and thirty files, and are surprised by both the number and the age of the oldest.

A worked example

A firm with four staff searched their machines and found nineteen exports.

The oldest was five years old. Six were on one laptop belonging to somebody who had left eighteen months earlier and whose machine had been kept in a cupboard, unencrypted, still holding a full customer list.

Two had been emailed to a personal address so somebody could work at home.

One was on a memory stick in a van.

They deleted seventeen, kept two that were genuinely in use and moved those to the shared drive with restricted access, wiped and disposed of the old laptop, and set a rule that exports go in one folder and are cleared monthly.

Nothing bad had happened, and their exposure had been considerably larger than the size of the business suggested.

Change what creates them

Deleting the files is the easy half. Preventing the next twenty is the useful one.

Most exports exist because somebody could not do something in the system: filter a view, produce a count, send a mailing, or share with a colleague.

Fixing that removes the reason. Give people the access and the views they need, connect the mailing platform to the system rather than moving lists by hand, and use the reporting the system already has.

Where an export genuinely is required, agree where it lives, that it is deleted when the task ends, and that it is never emailed.

A rule that exports are forbidden will be ignored, because the underlying need is real. A rule about where they go and how long they last will mostly hold.

The person who has left

The most common serious version of this, and it is worth handling specifically.

Accounts get disabled when somebody leaves, and files on their machine, in their personal cloud, or in their email archive frequently do not.

An old machine kept in a cupboard is the classic case, and it is the one that appears in every version of this exercise.

Add to whatever you do when somebody leaves: collect the device, check it for exports, wipe it before storage or disposal, and ask them directly whether they hold any work files elsewhere.

That conversation is easier while somebody is leaving on good terms than a year later.

Reduce what an export contains

A refinement worth applying where exports are unavoidable.

Most tasks need far fewer fields than a full export provides. A printer needs names and addresses, not phone numbers, notes, and order history.

Exporting only the columns required limits what a lost file exposes, and it takes the same effort as exporting everything.

The same applies to date ranges: a campaign to recent customers does not need a list going back nine years.

It is a small habit and it changes the severity of the thing you are trying to prevent.

The counter-case

Exports are legitimate and a business cannot function without occasionally moving data around.

Reconciling records, migrating systems, producing a report a supplier needs, or checking data quality all require a copy, and treating every export as a failure makes people hide them rather than manage them.

There is also a limit to how far this can go in a small business, where one person doing three jobs will occasionally work from a spreadsheet because that is what fits the afternoon.

The realistic target is that exports are deliberate, minimal, kept in a known place, and cleared, rather than that they never happen.

A monthly clear-out of one folder achieves most of the benefit and is a habit people can actually keep.

The clean-up

1. Search every machine for spreadsheet and data files.
2. Search email attachments, sent and received.
3. Ask each person what they have exported.
4. Check old devices and memory sticks.
5. Delete everything nobody is actively using.
6. Fix the reason people were exporting.
7. Agree one folder, cleared monthly, never emailed.

Step four is where the worst finding usually is, and it takes ten minutes to check a cupboard.

Where records end up generally is covered in where customer records ended up.

Frequently asked questions

West Coast Media Solutions Inc. provides web design, web development, hosting, digital marketing, and business consulting to organisations across Canada, drawing on more than twenty-five years in the field.