Business records
Keep customer records useful and private
A customer record should help you serve the customer and account for the sale. Keeping more information than you need creates more material to protect, correct and eventually remove.
Decide what each detail is for
Keep the contact, order, acceptance, delivery and payment details needed for the transaction. Before requesting an extra document, ask who will use it and why. A copy stored “just in case” can be difficult to justify or keep up to date.
Explain the purpose of a check to the customer. If a payment provider needs identity verification, use its approved process. Do not ask staff to collect private bank passwords, PINs or one-time codes.
Give people their own access
Shared passwords make it hard to tell who changed a record and harder to remove access when someone leaves. Use individual accounts and the permissions needed for the work. Someone selecting a customer for a sale does not automatically need access to every financial report.
Review access after a role change. Removing someone from a chat group does not remove their account access to a business application.
Plan for a lost phone
Keep the authoritative business record in the agreed system, rather than only in a personal chat history. Know how to end a lost device’s session and how the account owner can recover access.
A backup is useful only if it can be restored. Test recovery using non-sensitive sample records and document who can perform it. Avoid creating uncontrolled exports on several employees’ laptops in the name of backup.
Correct and retain deliberately
Give customers a way to report an incorrect detail. Keep financial corrections traceable, and use the business’s retention process when deciding what can be deleted. Some records may need to be retained for a particular obligation or dispute; do not guess a universal retention period from a blog article.
Nigeria’s data-protection rules include purpose limitation and data minimisation. Check your actual duties with the NDPC or an appropriate adviser. This guide describes working habits, not a complete compliance assessment.
Questions people ask
Frequently asked questions
Can staff send customer documents through a group chat?
Use the approved document channel and restrict access to people who need the record. A broad group chat makes access and later removal difficult to control.
Does deleting an account mean every sale record disappears?
Not necessarily. Account access and record retention are separate decisions. Explain the applicable retention process and handle the request through it.
Further reading
- NDPC: resourcesOfficial data-protection materials for checking the duties that apply to your business.