Handling customer data responsibly: a practical starting point.

Start with a simple data map

List the customer data you collect, where it is stored and why. Include the obvious places, such as your website database and online store, and the less obvious ones: spreadsheets, shared drives, WhatsApp chats, email inboxes and old exports on someone’s laptop.

For each item, ask whether you really need it. If a form asks for a date of birth or an ID number you never use, remove the field. Data you never collect cannot leak.

Limit who can see what

Give each person access only to what their job needs. A delivery driver needs an address and a phone number, not a purchase history. Use individual accounts rather than shared logins, so you can see who accessed what and remove access when someone leaves.

Protect the accounts that hold the most data with strong passwords and two-factor authentication, and ask your software providers how data is encrypted and backed up.

Decide how long to keep it

Keeping data forever feels safe, but it makes any breach worse. Set a retention period for each kind of data, based on what the business needs and what the law requires, such as accounting records. Then actually delete or anonymise the data when that period ends.

Make it easy for customers to ask what you hold about them, to correct it or to have it deleted. Under the GDPR these are rights, and handling such requests well builds trust in every market.

Ask for consent clearly, when you need it

Marketing messages and non-essential cookies usually need clear consent: an unticked box or a real choice in a cookie banner, not a hidden default. Write your privacy notice in plain language. In Lebanon, Law No. 81 of 2018 on electronic transactions and personal data also sets rules, so check your obligations with a lawyer for each market you serve.