Websites & online business
How to keep customer data in your CRM safe and tidy
A CRM often becomes the most complete record of your customers you have: names, contact details, purchase history, notes from every call. That makes it valuable to your business and to anyone who wants to misuse it. Protecting it is mostly about who can see what, and not keeping more than you need.
The short version
The basics
- Everyone has their own login with MFA.
- Give access by role, and limit who can export.
- Review connected apps and integrations.
- Collect only what you need, and delete what you no longer use.
Access
Individual logins with MFA
Every person, including part-timers and contractors, gets their own account with two-step verification. No shared logins.
Roles, not favours
Use the CRM’s roles so people see what their job needs. Sales may need contact details. Few people need every record, every report and admin settings.
Limit exports
Bulk exports are how customer lists leave a business, sometimes innocently, sometimes not. Restrict export rights to a small number of people, and check whether your CRM can log exports.
Remove leavers on their last day
Include the CRM in your offboarding checklist.
Integrations
CRMs connect to email, websites, forms, accounting and marketing tools. Each connection can read or write customer data.
- Review connected apps every few months and remove ones you no longer use.
- Use the minimum permissions each integration needs.
- Ask suppliers the right security questions before connecting a new tool.
Collect less, keep less
The Australian Privacy Principles encourage organisations to collect only the personal information they need and to destroy or de-identify it when it’s no longer needed. Even if your business isn’t covered by the Privacy Act, it’s good practice: data you don’t hold can’t be breached.
- Don’t add fields “just in case”.
- Avoid storing sensitive details like ID numbers, health information or full card numbers in free-text notes.
- Set a retention rule, such as removing inactive leads after a set period.
- Delete old imports and spreadsheets once data is in the CRM.
Notes are the hidden risk
Free-text notes often contain far more personal detail than anyone intended, like family situations, health issues and complaints. Remind staff to write notes as if the customer might ask to read them, because they can.
Customer requests
Under the Privacy Act, people covered by it can ask to access or correct their personal information. Know how to find everything you hold about a person in your CRM, and how to export or update it.
If something goes wrong
- Lock affected accounts and reset passwords.
- Check the CRM’s audit log for exports and unusual activity.
- Work out what information was involved and whose it was.
- Check whether it’s a notifiable data breach. See reporting data breaches.
Common questions
Is cloud CRM data safe?
Reputable CRM providers protect their platforms well. Most incidents come from stolen logins, excessive access or careless exports, which are under your control.
Do we need consent to store contacts in our CRM?
It depends on how you collected the information and whether you’re covered by the Privacy Act. Your privacy policy should explain what you collect and why. Marketing emails also need consent under the Spam Act.
How long should we keep old customer records?
Keep what you need for legal, tax and business reasons, then remove the rest. Your accountant or legal adviser can help with specific retention periods.
Sources
This guide is general information, not legal or financial advice. If you think you’ve lost money or personal information, contact your bank and the services named above straight away.
Keep reading
Related help
Talk to NovaSoft
Want a hand with this at work?
These guides are free to use. If your business wants help putting the checks, accounts and devices in place, our team can do it with you.