Find out what you hold and where, keep only what you need for a reason you could state, and be able to answer if somebody asks what you have about them.

What counts as personal information

Broader than people assume, and it does not require anything sensitive.

A name with a phone number is personal information. So is an address, an email, a photograph of somebody's property with the number visible, and a note about what work was done at their house.

Most small businesses hold a considerable amount, accumulated over years, without ever having decided to.

Which is fine and ordinary. The obligations that come with it are proportionate, and the first one is simply knowing what you have.

Where it actually is

The first is the one businesses overlook entirely. A decade of correspondence is a decade of personal information, held indefinitely, searchable by anybody with access to that account.

A worked example

A small firm asked by a customer what information they held about her.

They assumed it was straightforward: her record in their accounting system.

The actual answer, once somebody looked, was that record, four years of email correspondence, her details in a spreadsheet used for a mailing in 2017, photographs of her property in two people's phones, a paper file, and her details in a booking system they had trialled and stopped using.

Assembling it took most of a day.

The customer was not difficult about it and the exercise was genuinely useful, because it revealed a service still holding customer data eighteen months after they stopped using it.

They closed that account, which nobody had thought to do.

The principle worth applying

Keep what you need for a reason you could state out loud, and not more.

A customer's address is needed to attend the job and to invoice. Their date of birth almost certainly is not, unless there is a specific reason.

Notes about the job are reasonable. Notes about the person are frequently not, and they read badly if the customer ever sees them.

The test is whether you would be comfortable explaining why you hold a particular piece of information. If the answer is that it came with something else, it probably should not still be there.

How long to keep it

Longer than a year and shorter than forever, and the answer depends on why you have it.

Records supporting invoices and tax have their own retention periods, generally several years.

Job records supporting a warranty should last as long as the warranty and a bit beyond.

Marketing contacts are different, and holding somebody indefinitely because they enquired once in 2014 is difficult to justify.

Setting a rough policy is worth an hour: what you keep, for how long, and when you review it. Nobody expects a formal document from a small business, and having thought about it at all is what matters.

The counter-case

Where keeping more is right.

Anything with a safety or compliance dimension: certificates, inspections, work on gas or electrical systems. Those should be kept well beyond any minimum, because the question arrives years later.

Records of work that carries a long liability, where being able to show what was done protects you.

And anything subject to an ongoing dispute or claim, which must be retained until it is resolved regardless of any policy.

The distinction is whether the record protects somebody, in which case keep it, or whether it accumulated because deleting was harder than not, in which case it should go.

Third-party services

The category that grows quietly and is easiest to forget.

Every service you sign up for that touches customer information holds a copy: an email platform, a booking system, a review tool, a quoting app, cloud storage.

Each one you stop using still holds it unless you close the account and ask for deletion.

Which means a business that has trialled six tools over five years may have customer data in four services it no longer uses and no longer thinks about.

Listing them and closing the dormant ones is straightforward and almost nobody does it.

What a privacy policy should say

Most small business privacy policies were copied from somewhere and describe practices the business does not have.

Which is worse than a short honest one, because a policy claiming things you do not do is a statement you cannot support.

What a useful one says: what you collect, why, who else sees it, how long you keep it, and how somebody can ask about theirs.

For most trades that is four short paragraphs describing what actually happens, which takes an hour to write once you have done the audit above.

And it should name a real contact rather than a generic address nobody monitors, since the point of it is that somebody can get in touch.

A copied policy mentioning cookies you do not set and analytics you do not run is a common and avoidable inaccuracy.

If somebody asks

People have a right to ask what you hold about them, and to have mistakes corrected.

The request is usually reasonable and rarely hostile. Somebody asking is normally curious or tidying up, not preparing a complaint.

Answer it properly and within a sensible time. Say what you hold, why, and how long you will keep it.

Being unable to answer is the position to avoid, and it is the one a business without any idea where its records live is in.

Handling one request well is also a good test of whether you actually know what you hold.

The afternoon that covers it

  1. List everywhere customer information exists.
  2. Include email, phones and paper, which get missed.
  3. List every service holding a copy.
  4. Close the ones you no longer use, and ask for deletion.
  5. Write down roughly what you keep and for how long.
  6. Check who can reach each store.

The sixth connects this to access, because information you hold responsibly in a system three former contractors can still reach is not held responsibly.

That question is covered in who still has access after they left.

Frequently asked questions

What counts as personal information?

Broader than people assume. A name with a phone number, an address, a photograph showing a house number, or a note about work done at somebody's home.

Where is it actually stored?

Email is usually the largest store by far, then phones, spreadsheets, accounting software, website form submissions, third-party services, and paper.

What principle should I apply?

Keep what you need for a reason you could state out loud. If the answer is that it came with something else, it probably should not still be there.

How long should I keep records?

Depends why you have them. Invoice and tax records have their own periods; warranty records last as long as the warranty; marketing contacts are harder to justify indefinitely.

What about services I stopped using?

They still hold a copy unless you close the account and ask for deletion. A business that trialled six tools may have data in four it no longer thinks about.

What if somebody asks what I hold?

Answer properly and within a sensible time. Being unable to answer is the position to avoid, and it is where a business without any idea finds itself.

West Coast Media Solutions Inc. provides web design, web development, hosting, digital marketing, and business consulting to organisations across Canada, drawing on more than twenty-five years in the field.

Not sure where your customer records actually are?

An afternoon listing it usually turns up a service still holding data after you stopped using it.

Start a Conversation