The Personal Information You Did Not Realise You Held

The mental model that misleads

Asked what personal information they hold, most small businesses name their customer database or their accounting system.

Those are the tidy, managed places, and they are usually a minority of the total.

The rest sits in inboxes, on phones, in notebooks, in photographs, in message threads, and in third-party services nobody thinks of as storage.

Which matters because obligations attach to information rather than to systems, and because you cannot secure, retain, or delete something you have not noticed you have.

What follows is a general description rather than legal advice, and specific obligations depend on where you operate and what sector you are in.

Where it actually is

• Email: years of correspondence with names, addresses, and details.
• Staff phones: contacts, photographs, and message threads.
• Photographs of jobs, including properties and sometimes people.
• Paper: job sheets, quotes, delivery notes, and a diary.
• Third-party services: booking, invoicing, mailing, and forms.
• The website: form submissions, accounts, and analytics.
• Backups, which hold copies of everything above.

The second and third are the ones almost nobody counts, and they are frequently the least controlled.

Email is usually the largest store

Worth treating as a system rather than as correspondence.

A business inbox with eight years of history contains names, addresses, phone numbers, photographs of properties, occasionally financial details, and sometimes information about people's health or circumstances that arrived incidentally.

It is searchable, it is rarely subject to any retention rule, and it is frequently accessible from several devices.

It is also where a request to see what you hold about somebody would have to be answered from, which is the practical reason to think about it.

Nobody needs to empty their inbox. Knowing that it is your largest store changes how seriously you treat access to it.

Photographs carry more than intended

The category most often overlooked in trades and services.

A photograph of completed work may show a house number, a street, a vehicle registration, the inside of somebody's home, documents on a surface, or a person in the background.

Many also carry location data recorded automatically by the phone, which is present in the file even when nothing in the image identifies the place.

These are usually held on personal phones, backed up to personal accounts, and shared through message threads, none of which is under business control.

The practical remedies are ordinary: photograph the work rather than the setting, check what is in the frame before publishing, and think about where images are stored rather than only about where they are published.

Staff phones are the hardest case

And the most common arrangement in small businesses.

Customer numbers in a personal contacts list, job photographs in a personal camera roll, and arrangements made over personal message threads.

When somebody leaves, that information leaves with them, and there is usually no mechanism to retrieve or remove it.

The proportionate response is not to buy everybody a work phone. It is to be clear about what should go through business systems: bookings recorded in the system rather than a text thread, job photographs uploaded and then removed from the phone, and customer contact details kept in a shared place.

That is a working practice rather than a policy document, and it also solves the operational problem where nobody else can find out what was agreed.

A worked example

A small firm listed everywhere they held customer information, expecting three or four places.

They found eleven.

The accounting system and the booking tool were expected. So was the website form archive.

Less expected were two shared inboxes with nine years of history, a spreadsheet of past customers on a shared drive, four staff phones with contacts and photographs, a paper diary, a mailing list on a third-party service nobody had logged into for two years, a folder of scanned job sheets, and a messaging group used to coordinate work.

Nothing was being misused and none of it was secured deliberately.

The most useful outcomes were mundane: the dormant mailing list was closed, the shared drive spreadsheet was deleted as a duplicate, and staff photographs began being uploaded and cleared monthly.

Third-party services count

A category that gets missed because the information is not on your premises.

A booking tool, an invoicing service, a mailing platform, a form provider, a chat widget, and a cloud drive each hold information you are responsible for even though somebody else operates the system.

List them, note what each holds, and check that somebody at your business still has access to each account.

Dormant services are the risk: a tool trialled two years ago, still holding a customer list, on an account nobody monitors and whose password is unchanged.

Closing those properly, which means deleting the data rather than abandoning the account, is one of the cheapest improvements available.

Why the inventory is the useful step

Because everything else depends on it.

You cannot write an accurate privacy policy without knowing what you collect and where it goes.

You cannot answer somebody asking what you hold about them.

You cannot apply a retention period to information you have not located.

And you cannot assess what a breach would involve without knowing what exists.

An afternoon spent listing locations is the foundation for all of it, and it is more useful than any document produced without it.

The counter-case

Proportion matters and this can be overdone.

A sole trader with a phone, an inbox, and an invoicing app does not need a formal data map, and producing one is administration that helps nobody.

There is also a difference between an inventory and an exercise in anxiety. The purpose is to know where things are so they can be handled sensibly, not to catalogue every message.

Keep it at the level of locations rather than records: eleven places, what each broadly holds, who has access, and roughly how old the oldest material is.

That fits on a page and is genuinely useful. A forty-page data map for a nine-person business is not.

The inventory

1. List every place customer information sits.
2. Include phones, paper, and photographs.
3. List every third-party service holding data.
4. Note who has access to each.
5. Note how old the oldest material is.
6. Close dormant services and delete the data.
7. Agree what goes through business systems in future.

Step two is where the surprises are, and step six is usually the first thing worth acting on.

Analytics and privacy are covered in installing analytics without breaking privacy rules.

Frequently asked questions

West Coast Media Solutions Inc. provides web design, web development, hosting, digital marketing, and business consulting to organisations across Canada, drawing on more than twenty-five years in the field.