Securityguide
Customer data protection: a practical guide for marketing and sales teams
What customer data you hold, why it matters, six habits that protect it and what to do in the first hours after a breach.
In this article
Customer data is the raw material of modern marketing and sales: who bought what, who opened which email, who asked for a quote. It is also something customers lend you on trust. If you lose it or misuse it, that trust goes, and it is slow to rebuild.
This guide is written for the people who collect and use customer data every day, not only for IT. It explains what you hold, why it matters, how to protect it and what to do if something goes wrong.
What counts as customer data
- Identifying details: names, email addresses, phone numbers, postal addresses.
- Payment information: card numbers, bank details, billing records.
- Login credentials: usernames, passwords and security answers.
- Behavioural data: browsing history, purchases, clicks and preferences.
- Sensitive data: health information, government ID numbers or anything that could cause real harm if misused. Many laws set stricter rules for this category.
Start by writing down which of these you hold, where each is stored, who can see it and how long you keep it. Customer details often sit in more places than people realise: the CRM, the email platform, spreadsheets, a shared drive, the accounting system and someone’s downloads folder.
Why it matters
- Trust. People share information expecting it to be safe. A breach tells them it wasn’t.
- Law. Data protection laws such as the EU’s GDPR set rules for collecting, storing, using and deleting personal data, with substantial fines for breaches.
- Reputation. A breach is public, and it follows the brand around. Investors, partners and enterprise customers ask about it.
- Cost. Incident response, notification, legal advice and lost business add up, quickly.
Six habits that protect customer data
1. Strong sign-in everywhere
Use long, unique passwords stored in a password manager, and turn on multi-factor authentication for every system that holds customer data. Stolen credentials remain a leading cause of breaches.
2. Encryption
Encrypt data in transit (HTTPS for your website and secure connections for email and apps) and at rest (on laptops, phones, servers and backups). If a device is lost or a file is stolen, encrypted data is unreadable without the key.
3. Keep software updated
Attackers exploit known flaws in out-of-date software, including website plug-ins. Switch on automatic updates and keep a list of what you run.
4. Limit access
Give each person access only to the customer data they need for their job. A designer doesn’t need the customer database, and an intern doesn’t need export rights. Review access regularly and remove it when people leave.
5. Back up, and test
Keep copies of important data separately from your main systems so that ransomware or accidental deletion can’t destroy everything. Test that you can restore from them.
6. Train your team
A single click on a phishing email can expose a database. Brief sessions on spotting suspicious messages, handling customer data properly and reporting problems go a long way. Our guide to running a phishing simulation shows one way to test and teach.
Marketing-specific points
- Collect only what you need. Every extra field is something you must protect and, in many places, justify.
- Get and record consent for marketing, make it easy to withdraw, and honour opt-outs promptly.
- Check your tools. Every analytics, advertising and email platform that receives customer data is a supplier you should know about. Read where they store the data and what they do with it.
- Be careful with exports. Spreadsheets of customer lists emailed between people are a common source of leaks. Share from a controlled system instead.
- Use AI tools carefully. Don’t paste customer details into services your company hasn’t approved. Our guide to AI in marketing covers privacy checks.
What happens if you don’t
The consequences usually come in this order: the disruption of dealing with the incident, regulatory attention and possible fines, customers leaving or complaining, and a lasting dent in your reputation. Some customers will also take legal action. Preparation is much cheaper.
If a breach happens
Even well-run companies suffer incidents. What matters is how you respond.
- Have a plan ready. Write down who leads, who to call, how to contain the problem and who has to be told.
- Contain and investigate. Isolate affected systems, change credentials and find out what was exposed.
- Report on time. Under GDPR, a breach that puts people’s rights at risk must generally be reported to the regulator within 72 hours of discovery, and affected individuals told without undue delay if the risk is high. Other places have their own rules, so check the ones that apply to you.
- Tell customers plainly. Say what happened, what data was involved, what you’ve done and what they should do. Prompt, honest messages protect trust better than silence.
- Offer practical help, such as advice on changing passwords or watching for fraud, and where appropriate a service to monitor identity theft.
- Learn from it. Review how it happened and fix the cause.
Where to start
Begin with the inventory: what you hold, where, who sees it and how long you keep it. Then fix the biggest gaps, usually sign-in, access and backups. Our guides to basic cybersecurity practices and common threats set out the next steps, and you can talk to us about a review of how you handle customer data.
Questions
What counts as customer data?
Anything about an identifiable person: names, email addresses, phone numbers, addresses, payment details, login credentials, purchase history and browsing behaviour, along with sensitive information such as health records or ID numbers.
How do we protect customer data on our website?
Serve every page over HTTPS, use a trusted payment provider instead of handling card numbers yourself, require strong passwords and multi-factor sign-in for accounts, and keep your website software and plug-ins updated.
What happens if we fail to protect it?
Regulators can fine you, customers can claim compensation, and the loss of trust often costs more than either. The effects depend on the rules that apply to the people whose data you hold.
What are the main legal requirements?
Tell people plainly what you collect and why, collect only what you need, keep it secure, let people see, correct and delete their data where the law gives them that right, and report certain breaches to the regulator and to those affected.
Do we need a written policy?
Yes. A short document covering what data you hold, who can access it, how long you keep it and what to do in a breach. It helps staff, and it is the first thing regulators and many customers ask for.
