Data Securuty Guide:Securing Personal Data — Start with the Basics

Customers expect that every business — large or small — that collects their personal information will protect it. Beyond customer expectations, there’s the law. Depending on your type of business and the states in which your customers reside, you may be legally required to protect the personal information you collect.

Getting Started

First, determine what makes sense for your type of business. This will be based on the type of data that you collect and store, and the kind of resources you have managing that data.
If your small business keeps information about customers and employees in several formats (e.g., on paper, on computers, and in the cloud), you should sit down with a team of your employees — an IT person, office manager, etc. — and discuss these issues together to make sure you consider all viewpoints.

1. Inventory the TYPES of data you collect, store and/or transmit.
2. Inventory HOW you store your data.
3. Inventory WHERE you store your data for each type and format of customer information.
4. Inventory HOW DATA IS MOVED and WHO HAS ACCESS to it. Take into consideration your type of business, and the stationary and portable tools your employees use to do their jobs. This is a very important part of the inventory process, as it will help you begin to identify the potential ways that personal data could be inadvertently disclosed. If you think you need outside help to identify potential leak points, consider consulting with an IT security expert and/or the bank or processor that provides your merchant account services.
5. Inventory the DATA CONTROLS YOU HAVE IN PLACE.
6. Evaluate COSTS versus BENEFITS of different security methods. Brainstorm different types of security procedures and think about whether they make sense for the type of information you maintain, the format in which it is maintained, the likelihood that someone might try to obtain the information, and the harm that would result if the information was improperly obtained.
7. Write it down. Type up the checklists you’ve just created, the security measures you are taking, and an explanation on why these security measures make sense.
   
   

   Checklists

   1. Inventory the TYPES of data you collect, store and/or transmit.
      • Names
      • Physical addresses
      • Residential phone numbers
      • Mobile phone numbers
      • Email addresses
      • Payment card information
      • Account numbers
      • Invoice numbers
      • Social Security numbers
      • Drivers license numbers
      • Business identification numbers
      • Types and amounts of transactions
8. Inventory HOW you store your data.
   • Paper invoices
   • Paper mailing lists
   • Paper customer files
   • Paper order requests
   • Email
   • Databases
   • Spreadsheets
   • Contracts
   • Business plans
   • Financial reports
9. Inventory WHERE you store your data for each type and format of customer information.

   Physical storage sites

   • Desk drawers
   • Filing cabinets
   • Mail room
   • Home offices

   Electronic storage sites

• Desktop computers
• Laptop computers
• Servers
• Smartphones
• Tablets
• USB/thumb drives
• CDs, DVDs
• Online hosts/cloud providers
10. Inventory HOW DATA IS MOVED and WHO HAS ACCESS to it. Take into consideration your type of business and the desktop and mobile tools your employees use to do their jobs. This is an important part of the inventory process, as it will help you begin to identify the potential ways that sensitive data could be inadvertently disclosed. If you think you need outside help to identify potential leak points, consider consulting with an IT security expert and/or the bank or processor that provides your merchant account services.