Customer data & GDPR

From inside a business, data protection looks like a collection of prohibitions. The reverse question is more useful, and it is the same in every market: what purpose are you holding this detail for, how long do you need it for that, and what happens afterwards? Anyone who can answer that per field has most of the work behind them — the rest is documentation.

The practical way in is therefore an inventory rather than a checklist. What is actually held: name and phone number, yes — but also the note about the last treatment, the photo, the allergy, the remark about an ex-partner. Health-related details, and anything someone would rather not see written down, are the sensitive category, and they arise in passing during the working day, not in the form.

Two situations turn theory into a real case. A subject access request — someone wants to know what you hold about them — can only be answered calmly if you know everywhere something sits: in the system, the calendar, the inbox, a colleague's phone. And a deletion policy is not a statement but a rule per data type, one that applies even when nobody remembers it.

As soon as a service provider processes data on your behalf — the software, the newsletter tool, the bookkeeper — an agreement comes into it. When one is needed and when it is not is a manageable question with a clear answer. The articles in this section work through the four topics one at a time; where a rule is named, it says which market it applies to.