How do you protect customer data?
Protect customer data by collecting only what you need, encrypting it in transit and at rest, limiting access by role, requiring SSO and multi-factor authentication, logging who accessed what, vetting vendors and AI tools for how they store and use data, training staff, deleting data you no longer need, and having a tested incident response plan.
Ten practices
- Minimize what you collect and keep.
- Encrypt data in transit and at rest.
- Control access with roles and least privilege.
- Use SSO and MFA, and automate user provisioning with SCIM.
- Log access and changes, and review the logs.
- Redact sensitive fields such as card numbers in tickets and AI prompts.
- Vet vendors, including AI providers: data retention, training use, certifications.
- Train staff on phishing and data handling.
- Delete on schedule and honor deletion requests.
- Prepare for incidents with a plan, contacts and customer communication templates.
