Customer data and the GDPR: what you actually have to do

Record what you use, not what you might one day use

This is the principle that goes wrong most often in practice, and it’s called data minimisation: you collect no more than you need for the purpose.

A name, a work email address, a phone number and what was agreed — you need those. A date of birth "in case we ever do something with birthdays" you don’t. And notes about someone’s health, religion or political views are special category data under Article 9, with a stricter test of their own; they have no place in a sales system.

A test for a notes field: would you say it out loud if the customer were reading over your shoulder? They can ask for a copy of what you hold, so that chance is real.

Two retention rules, pointing opposite ways

Two words get used interchangeably here, and the difference decides what you do.

Revenue sets a minimum. If you run a business you keep records for tax purposes whether anyone asks or not, and Revenue is blunt about the period: you must keep the original of those documents for six years. That covers anything used to work out your Income Tax, Corporation Tax or Capital Gains Tax. One number, whatever your legal form, and an accountant keeping the records for you doesn’t move the responsibility off you.

Nor is it a merely administrative wish. Revenue’s own guide to self-assessment says that failure to keep proper records, or to keep them for the necessary six years where you are chargeable to tax, is a Revenue offence, and that a conviction can mean a heavy fine, imprisonment, or both. On the VAT side there is a separate fixed penalty of €4,000 for failure to keep proper books and records.

The GDPR sets a maximum. You keep personal data no longer than you need it for the purpose. There’s no number in the Regulation; you decide a period and explain why it’s reasonable.

So two regimes run side by side. Your invoices stay for the Revenue period because they must; your notes about a prospect who never became a customer go sooner, because there’s no longer a reason to hold them. There’s a longer piece on doing that tidy-up.

What your customer can ask for

Four rights that genuinely come up in a small business:

• Access. Under Article 15 they can ask what data you hold about them. You tell them whether you’re processing it, hand over a copy and explain the processing — free of charge, without undue delay and in any event within one month. Two further months are available only where the request is complex or they’ve sent several, and even then you have to say so inside the first month.
• Rectification. If something’s wrong, you correct it.
• Erasure. Allowed, except where a retention obligation applies. So you can delete a customer record and keep the invoices.
• Objecting to marketing. If they don’t want mailings any more, you stop, and it has to be easy — one click, no login screen. For direct marketing the right is absolute. What a marketing email itself must contain sits in different law, the 2011 electronic communications regulations, and that is in can you send that email.

When you need a processor contract

If you use someone else’s software to hold customer data — a CRM, an email platform, an accounts package — that supplier is a processor and you are the controller. Whenever a controller engages a processor there must be a legally binding contract, and it isn’t optional.

The DPC sets out what Article 28 requires in it: the subject matter, duration, nature and purpose of the processing, the type of personal data, the categories of people involved, and your obligations as controller. Plus terms binding the processor to work only on your documented instructions, keep the data confidential and secure, take on a sub-processor only with your authorisation, help you answer individuals’ requests, and delete or return the data at the end.

Where the supplier keeps the data matters too, though less than people fear: inside the EEA no extra instrument is needed, and outside it you need an adequacy decision for that country or an appropriate safeguard, in practice the European Commission’s standard contractual clauses.

A decent supplier has all of this ready and doesn’t need to negotiate it. If you have to ask and the answer is vague, that’s a signal in itself.

What you can do today

You don’t have to make a project of this. Three things remove most of the risk:

1. Go through your notes fields and take out what you don’t use, especially old notes that have quietly become personal.
2. Write down how long you keep what, and why — with the six-year floor for your business records in there as a floor and not as a habit.
3. Make sure you can delete a customer record without the invoices going with it, and that you can find everything about one person inside a month. If your system can’t do either, that’s a real problem, not a theoretical one.

If it goes wrong, there are two separate doors

The first is the one everybody knows: your customer complains to the Data Protection Commission, which handles the complaint and can use its corrective powers against you.

The second is rarely mentioned to small businesses, and it is why that one-month deadline matters. Section 117 of the Data Protection Act 2018 lets a person bring a data protection action against a controller or processor directly, without waiting for the regulator. The Act deems it an action founded on tort, the Circuit Court is competent alongside the High Court, and compensation covers non-material damage as well as material — all of it in the circuit where the person habitually resides, which may be their county rather than yours.

A warning about pieces like this one

This is an explanation, not legal advice, and it’s written by a software supplier — we have an interest in you not finding this complicated. If you’re dealing with sensitive data, large volumes, or something you’re genuinely unsure about, read the DPC’s own guidance or ask a solicitor.

For a free starting point that isn’t us: the DPC publishes a self-assessment checklist covering exactly this ground — which categories of personal data you hold, where each came from, the purpose, the lawful basis for it, and the retention period per category. That one table answers most of what this article asks you to explain.