Protecting customer data: where IT meets Legal
The customer list sits on a shared drive anyone can open. Card details arrived by email and are still in someone's inbox. Staff records live in a desktop folder. An old database was never encrypted. Two former employees still have access to the CRM.
Every business holds personal information, and most hold more than they realise. Protecting it is partly a technology problem and partly a legal one. When IT and Legal work separately, gaps appear between the policy and the practice. When they work together, the business can show it takes customer data seriously, and back that up.
The short version
- Protecting customer data needs two things working together.
- IT secures access, storage, backups and breach response.
- Legal covers privacy policies, contracts with suppliers and notification obligations.
- Start by knowing what personal information you hold and where, limit access to those who need it, secure and back it up, keep your privacy policy accurate and have a plan for what to do if something goes wrong.
- Customers trust businesses that handle their data carefully.
What counts as personal information
Names, contact details, addresses, dates of birth, payment details, health information, employment records, photos and any other information that identifies a person. Many businesses hold it in more places than they realise: CRM, email, spreadsheets, accounting software, booking systems and paper files.
What IT secures
01Access
People access only the data their role needs. Former staff lose access immediately.
02Storage
Data kept in secure, approved systems rather than personal drives and inboxes.
03Encryption
Sensitive data encrypted in storage and in transit.
04Backups
Regular, secure and tested, so data can be recovered.
05Monitoring and response
Suspicious activity detected and a clear response plan if a breach occurs.
What Legal covers
01Privacy policy
An accurate description of what you collect, why, how it is used and how people can access it.
02Supplier agreements
Contracts with software providers and contractors that cover how they handle your customers' data.
03Breach obligations
Understanding when a breach may need to be reported and to whom under Australian privacy law.
04Consent and collection
Collecting only what you need, with appropriate notice and consent.
> I've invested in businesses where the privacy policy promised one thing and the systems did another. Nobody intended it. The policy was written once and the business moved on. Bringing the legal and technical sides together closed the gap and made the policy something they could actually stand behind.
“What I appreciated most was them pushing back when it mattered.”
An illustrative example
Picture a clinic holding patient details across a booking system, email and spreadsheets. A joint review maps where information lives, IT consolidates it into secure systems with role-based access and multi-factor login, removes old accounts and sets up tested backups, and Legal updates the privacy policy, reviews supplier contracts and writes a breach response plan. The clinic can now explain to patients exactly how their information is protected.
Mistakes to avoid
- Don't collect more personal information than you need.
- Don't let your privacy policy drift from what your systems actually do.
- Don't wait for a breach to work out your obligations.
What we handle, and when specialists step in
Much of this is administration NOIZE IT handles for you: turning on multi-factor login, registering and renewing domains and changing DNS records. Alongside the admin, we advise on how protecting customer data fits the wider plan.
For anything requiring specialist expertise or accreditation, we use an appropriately qualified professional. Exactly how that is shared is agreed at the strategy or proposal stage.
It means one point of contact for the whole job, even when a specialist is involved behind the scenes.
Questions to ask about customer data
- What personal information do we collect, and why?
- Where is it stored, including inboxes and spreadsheets?
- Who can access it?
- Is it encrypted and backed up?
- Does our privacy policy match what we actually do?
- Do our software suppliers protect it properly?
- What would we do if it were exposed?
The answers form the starting point for a privacy review.
What good looks like
Personal information is collected only when needed and stored in secure, approved systems. Access is limited by role and removed when people leave. Sensitive data is encrypted and backed up. The privacy policy accurately describes practice. Supplier contracts cover data handling. A breach response plan exists and the team knows it. Customers can be told, clearly and confidently, how their information is protected.
Where to start this week
List every place customer information is stored, including inboxes and spreadsheets. Next to each, note who can access it. Anything open to more people than necessary is your first fix. See it.noize.com.au and legal.noize.com.au.
How IT connects to the rest of NOIZE
The value grows when this department works alongside the rest of the group. NOIZE Digital builds websites, integrations and automations, then hands them to IT to host, secure and support. NOIZE Talent tells IT when people join or leave, so access is ready on day one and removed on the last. NOIZE Legal works with IT on privacy policies and data protection, with an appropriately qualified professional where the law requires it. NOIZE Books and Accounting rely on secure, backed-up financial systems. When IT is part of the same group as the departments it supports, problems are prevented rather than discovered, and nothing falls between build and support.
Related reading
- Keep your people working: the real cost of downtime
- Who has the admin password? IT basics every business should own
Common questions
Does the Privacy Act apply to my small business?
It depends on turnover and the type of business and data. Some businesses are covered regardless of size. NOIZE Legal can advise.
What should a privacy policy include?
What personal information you collect, why, how it is used and stored, who it is shared with and how people can access or correct it.
What is a notifiable data breach?
A breach likely to cause serious harm to individuals, which may need reporting under Australian law.
How do we secure customer data?
Limit access, use secure systems, encrypt sensitive data, back it up and monitor for problems.
Should card details be stored in email?
No. Use secure payment systems and remove card details from email.
What should we do if we have a breach?
Contain it, assess the harm, follow your response plan and get advice on notification obligations.
Do our software suppliers affect our privacy obligations?
Yes. Contracts should cover how suppliers handle your data.
Can NOIZE help with both sides?
Yes. NOIZE IT secures the data and NOIZE Legal covers policies, contracts and obligations.
Does NOIZE handle all of our IT directly?
Most everyday IT work, yes. Where a job needs specialist expertise or accreditation, we make sure an appropriately qualified professional is involved, agreed with you up front.
How long should we keep customer data?
Only as long as it is needed for its purpose or required by law, then securely deleted.
Do you provide on-site support?
Most support is remote, with on-site visits when needed.
Your first strategy conversation is on us.
Have a chatThe brand for business.
