Every list of customer names, numbers and addresses is valuable to criminals. The FTC’s advice boils down to five plain steps.
Quick summary
- Know what customer information you have, where it is and who can access it.
- Keep only what you need, for only as long as you need it.
- Protect it with strong passwords, two-factor authentication and limited access.
- Dispose of it securely and have a plan for a breach; every state has breach notification laws.
Customer lists, order histories, phone numbers and addresses help you run your business. In the wrong hands, they’re tools for fraud. The Federal Trade Commission’s guide for businesses, “Protecting Personal Information,” sets out five principles that work at any size.
1. Take stock
Know what personal information you hold and where: your CRM, email, spreadsheets, paper files, point-of-sale system, phones and backups. Note who can access each one.
2. Scale down
Keep only what you need. If you don’t need it, don’t collect it. Don’t use Social Security numbers as customer IDs, and don’t keep card numbers you don’t need. Write down how long you keep each kind of record.
3. Lock it
- Use long, unique passwords and turn on multi-factor authentication.
- Give staff access only to what their job requires.
- Keep devices and software updated.
- Lock paper files and secure laptops and phones.
- Check that vendors who handle your customer data protect it too.
Careful
Tell staff that no real IT person or vendor will ever ask for their password. Many breaches start with a convincing phone call or email.
4. Pitch it
When you no longer need information, dispose of it so it can’t be read or reconstructed. Shred paper records. Use tools that overwrite old computers and drives completely before getting rid of them, because simply deleting files usually isn’t enough.
5. Plan ahead
Decide now who will lead the response if something goes wrong, who your outside help will be and how you’ll contact affected customers. All 50 states have laws requiring businesses to notify people when certain personal information is breached, and the rules differ, so ask a lawyer what applies to you.
From experience
Keep the plan short and printed. In a real incident, people need a one-page checklist, not a binder.
Where customer data lives
Your CRM or spreadsheet is often the biggest store of customer information, and loyalty programs can add more. Review both against these five steps once a year.
Owners often ask
Do small businesses really get targeted?
Yes. Small businesses often have less protection, and criminals use phishing, stolen passwords and lost devices to get at customer data.
Should I store customers’ card numbers?
Generally no. Let your payment processor handle card data. Keeping card numbers increases your risk and your obligations under payment card industry security standards.
What should I do first if I suspect a breach?
Take affected devices offline, preserve evidence, change passwords and contact your IT help and, where appropriate, a lawyer about notification duties.
This guide is general information for U.S. small businesses, not legal advice. Rules on texting, privacy and consumer protection vary by state and change over time; check with your state attorney general’s office or a lawyer for your situation.