Why tidiness is a privacy issue
Most small businesses collect more customer information than they realise, and keep it longer than they need. Old quote spreadsheets with phone numbers and addresses, scanned driver licences from years ago, email attachments containing bank details, customer lists exported for a mail-out and never deleted. Each copy is another place information can leak from.
The Privacy Act 2020 sets out principles about collecting, storing, using, sharing and disposing of personal information. Among them: collect only what you need for a lawful purpose, keep it secure, let people access and correct it, and don't keep it longer than necessary. Tidy data makes those obligations much easier to meet, and limits the harm if a mailbox or laptop is compromised.
Find out where customer data lives
Start by mapping where customer information is held. The obvious places are the CRM, accounting system and job or practice management software. The less obvious ones are email mailboxes, shared drives, personal OneDrive folders, spreadsheets on desktops, paper files, phones, old backups, and third-party services such as online forms, booking tools and marketing platforms. Ask each team what customer information they handle and where they keep it. You'll usually find duplicates and forgotten exports. Note what type of information is involved, as some categories, such as health details, identity documents and financial information, carry higher risk and deserve closer protection.
Keep only what you need
For each type of customer information, ask why you collect it and how long you need it. Some records have legal retention periods; for example, tax and accounting records generally need to be kept for several years, and some industries have specific rules. Check the requirements that apply to you rather than guessing. Outside those requirements, information you no longer need should be securely deleted.
Stop collecting what you don't use. If your enquiry form asks for date of birth but you never use it, remove the field. If staff photocopy driver licences 'just in case', check whether you actually need to. Collecting less is the simplest way to reduce risk, and it also makes forms quicker for customers to fill in, which tends to lift the number of enquiries that actually get completed.
Limit access and protect it
Customer information should be visible only to people who need it for their job. Set permissions in SharePoint, shared drives and business systems by role, and review them when staff change roles or leave. Avoid keeping customer data in personal mailboxes or local folders where access can't be managed. Protect it with the basics: multi-factor authentication on every account, encryption on laptops and phones, endpoint protection, regular backups and email filtering. Be careful with email: sending customer files to a personal address, or to the wrong recipient, is one of the most common causes of privacy breaches. Data loss prevention settings in Microsoft 365 can warn staff before they send sensitive information outside the business.
Delete properly
When information is no longer needed, delete it properly. Remove files from SharePoint and empty the recycle bins, purge old exports, clean up mailboxes, and shred paper records. When computers, phones, printers or drives are retired, wipe them securely or have them destroyed, and keep a record. Printers and copiers often store copies of scanned documents on internal drives. Retention settings in Microsoft 365 can help automate this, deleting or reviewing content after a set period. Set them carefully, because over-aggressive deletion can remove records you're legally required to keep. Your IT provider can configure retention to match a schedule you approve.
Be ready to respond
People have the right to ask what information you hold about them and to request corrections. Knowing where data lives makes these requests manageable. Similarly, if a breach occurs, a clear picture of what was held and where helps you assess the harm quickly, rather than spending the first days of an incident working out which spreadsheets might have been in the affected mailbox. Under the Privacy Act, a breach that has caused or is likely to cause serious harm must be notified to the Privacy Commissioner and affected individuals.
Review your customer data map once a year and refresh it when you add a new system. If you'd like help, Office IT can run a privacy-focused review of where customer data sits in your Microsoft 365 or Google environment. The aim is a business that knows what it holds, keeps only what it needs, and can explain both clearly.
In short
- Map every place customer information is stored, including forgotten exports.
- Collect and keep only what you need, for as long as you need it.
- Limit access by role and protect data with MFA, encryption and backups.
- Delete securely, including on retired devices and printers.
- Know your breach notification duties under the Privacy Act 2020.