What customer information should my business keep?

Collect customer information for a defined purpose, give access only to the people who need it and decide how long each kind of record must remain. Start with the fields you ask for today. Remove unnecessary collection at the source, then review existing copies through an authorized retention and disposal process.

“We might need it someday” is an expensive reason to keep asking people for more about themselves. It creates another thing the business must control, explain and protect. Before adding a field, I would want a plain answer to the question: which part of the service cannot happen without it?

Walk through one ordinary order

Choose an ordinary customer journey rather than beginning with a grand privacy statement. Follow the information from the first inquiry through scheduling, payment, delivery, follow-up and any required records. Look at the form, the shared spreadsheet, the employee's notes and the exported copy.

Imagine a fictional mobile bicycle-maintenance business. Its booking form has accumulated thirteen fields: customer name, email, phone, service address, door-access code, date of birth, government ID number, payment-card number, repair description, bicycle model, serial number, appointment time and an open comments field.

No real customer data appears here. The field list is an invented starting point for review, not a claim about what such businesses normally collect.

The crew needs to find the appointment, understand the requested work and reach the customer when necessary. That does not automatically explain why the form asks for an ID number or birth date. Nor does processing a payment explain why a card number should appear in a job sheet.

The point of the walkthrough is to find these questions where they arise. A polished notice at the bottom of the form does not make every field necessary.

Give each field a purpose and a responsible person

The FTC's Start with Security guide advises against collecting personal information that is not needed, retaining it without a legitimate purpose or using real personal data unnecessarily in training. Keep those decisions connected to the actual work rather than collecting broadly and hoping to organize it later.

For each field, ask who uses it, which decision it supports, where it goes and what happens if it is unavailable. A preference can be reasonable without being a condition of service. Tell the customer when a field is optional instead of making every question look mandatory.

Some information is conditional. A home-service address matters when the crew travels to that address. It may not be needed for an inquiry about work the customer will bring to a workshop. A bicycle model can help identify the requested service without necessarily requiring the unique serial number for every booking.

If the team cannot describe a current purpose, investigate before carrying the field into the next version. Do not invent a justification merely because the database already has a column.

An original field-review record

Scroll across to compare the proposed purpose with the next decision. Use the arrow keys when the table area is focused.

Use the record to decide what should change. Confirm retention requirements and the person authorized to act before altering existing records.

Stop creating the next unnecessary copy

The first repair may be prospective. Revise the proposed form so the customer is asked only for the information the service needs through an appropriate process. Check automated emails, exports and connected tools too. Removing a field from the visible form does not remove it from an old integration.

For access to the property, agree an appropriate arrangement with the customer. In this scenario the normal service can be performed by meeting the customer at the agreed time; an unstructured door-code field is not required. A different service arrangement would need its own authorized process rather than a code pasted into a widely shared note.

Make the free-text prompt specific: describe the bicycle issue and requested work, without payment credentials or unrelated personal details. This helps customers supply useful information, but it is not a technical guarantee that nobody will enter something sensitive.

Have a process for handling information received unexpectedly. The person reading a booking should know whom to contact and should avoid spreading it into another message thread. Do not ask an employee to improvise the retention or security decision alone.

Map the copies people forget about

A customer record can travel into a scheduling system, an exported list, a confirmation email, a printed job sheet and a colleague's downloaded file. Those are different locations even when each began with the same booking.

List each approved location, its owner, the information it contains and the people or suppliers with access. Include paper. A record does not become less sensitive because it is on a clipboard.

The fictional business identifies five storage locations and six hundred legacy job records in its current inventory. That is a count of records, not proof of six hundred different customers or six hundred unique copies. Repeat jobs and exported duplicates need to be distinguished.

The first review selects thirty records, six from each location, to understand formats and dependencies. That small practical review cannot certify that all six hundred are correct or safe. If it reveals unexpected copies, update the inventory before declaring the scope finished.

Ask suppliers what information their service receives and what happens to it at the end of the arrangement. A deletion instruction on your own screen may not describe every backup, export or retained record. Get an answer appropriate to the actual service rather than assuming all tools behave alike.

Separate who needs access from what must be retained

The dispatcher may need today's location and customer contact. The mechanic needs the service brief and information required for the assigned visit. The bookkeeper needs appropriate invoice and receipt evidence. None of those statements gives everyone a reason to see every field forever.

The FTC guide supports limiting access to people with a legitimate need. Translate that into specific roles and test them with synthetic records. Ask what an ordinary account can view, export or change, including what happens after someone changes roles or leaves.

A completed job may leave an invoice that must remain while its active dispatch copy no longer needs broad operational access. Retention and everyday visibility are different decisions. Restricting access does not necessarily satisfy an obligation to dispose of a record, and deletion does not satisfy an obligation to retain one.

For tax records, the IRS's recordkeeping guidance explains that the necessary retention depends on the action, expense or event and the need to support reported items. Do not apply one convenient deletion period to invoices, service instructions, legal holds and marketing contacts alike.

Identify the applicable record requirements with the appropriate adviser. Record the approved rule, its reason, any exceptions and who can authorize disposition. An unresolved requirement should remain a named task rather than become “keep everything” by default.

Fund a limited first repair instead of an endless cleanup

The fictional business sets aside $1,400, separately from payroll, accepted jobs and other obligations. Its first stage uses twelve paid staff hours at an all-in $45 an hour: three to inventory the locations, three to check the proposed form and permissions, four to review the thirty selected records and two to train the relevant staff.

Those twelve hours cost $540. Four additional technical-provider hours at $75 cost $300. Two professional-review hours at $125 cost $250, and the defined incremental tool cost is $40. Complete first-stage payments are $1,130, leaving $270.

The rates and scope are invented. All eighteen hours are available without displacing accepted work; provider and professional work do not duplicate the staff allocation. The four-hour record review allows an average eight minutes per selected record. It is a planned resource allowance, not a measured processing speed.

This stage establishes the inventory, proposed collection changes, access checks and requirements needing approval. It does not promise to clean every legacy record or complete disposition across every location. Any larger repair needs its own workload, authority and funding.

Keep ordinary service separate from the exercise. Use made-up records when checking forms and access. Do not copy live customer information into a convenient new testing tool merely to examine how to reduce copies.

Verify what changed before closing the task

Use an authorized safe test to follow a new synthetic booking through the revised process. Check the form, confirmation, job view and export. Does an unnecessary field still reappear? Can a role see information outside its assigned need? Does the ordinary staff member know how to handle an unexpected sensitive entry?

Keep the test pending until somebody has run it and recorded the result. A box labeled “privacy checked” would establish none of those outcomes.

For existing records, execute only the approved disposition process and retain appropriate evidence of what was done and what remains. Do not turn a customer request or an internal cleanup idea into an improvised mass deletion that destroys required records.

If the review reveals a possible incident, preserve relevant evidence and engage the responsible security and legal process. This planning exercise does not determine whether notification is required or how an actual incident must be handled.

The served-customer follow-up guide concerns what feedback represents and whose replies are missing. The payment-instruction guide concerns verification before a payment destination changes. Here, the earlier decision is what information the business should possess and make available at all.

A useful finished record names the purpose, location, access, retention requirement, responsible person and next review for each important category. It makes “we need this” an explanation someone can examine rather than a habit nobody owns.