Customer database data in sales and service is a valuable asset for companies. It contains personal information such as names, addresses, contact details and purchase histories, which can be used for targeted customer contact and individual support. However, there are considerable data protection risks involved in handling this data. Violations of the General Data Protection Regulation (GDPR) or other national regulations can lead to high fines and damage to your image. We will show you how you can avoid typical data protection risks. The linked checklist makes it easier to analyze the risks associated with personal data.
Insufficient consent
A frequent source of error is the lack of a valid Consent to the Processing of customer data. Particularly in the case of direct marketing measures such as e-mail advertising, telephone acquisition or personalized offers, explicit consent pursuant to Art. 6 para. 1 lit. a GDPR required.
In practice, uncertainties often arise here as to how an effective Consent is to be obtained. The GDPR demands that the Consent is given voluntarily, informed and unambiguously. This means that customers must actively consent (e.g. by ticking a box) and be clearly informed about what their data will be used for. The Consent be revocable at any time.
Particular care should be taken with pre-ticked checkboxes: According to the current case law of the European Court of Justice (ECJ), these are not considered effective Consent. Likewise, a general consent clause in general terms and conditions is not sufficient.
Recommendation:
- Companies should formulate transparent declarations of consent that specifically address the purpose of processing and are easy to understand.
- Each collected Consent should be documented and retrievable for verification.
- Implement user-friendly withdrawal options, e.g. through a clearly marked unsubscribe link in emails or a simple withdrawal form on your website.
- Train your sales staff specifically in dealing with consent so that they can inform customers correctly and obtain consent properly. A frequent source of error is the lack of a valid Consent to the Processing of customer data. Particularly in the case of direct marketing measures such as email advertising or personalized offers, explicit consent pursuant to Art. 6 para. 1 lit. a GDPR required.
Misuse of customer database data
The Earmarking is a central principle of the GDPR and plays a particularly important role in the handling of customer data. According to Art. 5 para. 1 lit. b GDPR may personal data collected only for specified, explicit and legitimate purposes and not further processed in a manner incompatible with those purposes.
In practice, it is often the case that customer data that was originally collected for a specific purpose is later deleted without being reused. Consent be used for other purposes. This represents a considerable risk. For example, the use of service data for advertising measures or the disclosure of customer data to partner companies without prior consent can lead to considerable fines and a loss of trust.
Practical examples of misappropriation:
- Use of support requests to create personalized advertising campaigns. Customers do not expect their service requests to be used for advertising purposes.
- Collection of location data to improve services and their subsequent use for targeted Advertising. Such a change of purpose is not permitted without explicit consent.
- Storage of payment data beyond the billing process to carry out market analyses. Here is a separate Consent required.
Another risk is the incorrect assumption that general consent to data processing permits any type of data use. This is not the case. The Consent must always refer specifically to the respective purpose.
Recommendation:
- In their data protection declarations, companies should clearly define the purposes that apply to affected are transparent and easy to understand.
- In the case of planned changes of purpose, a new Consent before the data is used for any other purpose.
- Companies should keep an internal data inventory that provides information on what data is processed for what purpose and when it is necessary to repeat it. Consent is required.
Missing or inadequate safety measures
Mobile working methods (e.g. field service, remote access) are particularly widespread in sales and service. This significantly increases the risk of data leaks and unauthorized access. In addition, there are risks from improperly secured IT systems, insecure Networks and inadequately trained employees.
The most common security vulnerabilities include:
- Unencrypted end devices: Employees often use laptops, smartphones or tablets to access customer data. Without suitable encryption measures, these devices can become a risk in the event of theft or loss.
- Insufficient access controls: A lack of role and rights concepts means that employees can access data that is not required for their work.
- Outdated software and systems: Security gaps in non-updated software can be exploited by attackers and put sensitive customer data at risk.
- Lack of employee awareness: Social engineering attacks such as phishing emails are often targeted at untrained employees and can lead to data leakage or unauthorized disclosure of customer information.
Recommendation: Companies should Technical and organizational measures (TOMs), including:
- Encryption of end devices: All mobile and stationary end devices should be encrypted to ensure the security of customer data in the event of theft or loss.
- Access rights according to the principle of the lowest possible assignment of rights: Employees should only have access to the data they need to perform their tasks.
- Two-factor authentication (2FA): The use of 2FA for critical systems and sensitive data access offers additional protection against unauthorized access.
- Regular security updates: IT systems and software should be continuously updated to close known security gaps.
- Implementation of security guidelines: Companies should define clear security guidelines for handling mobile devices, remote access and external storage media and enforce them consistently.
- Regular employee training: To phishing attacks, Social engineering and data breaches, employees should be regularly informed about current threats and rules of conduct.
A forward-looking approach to IT security and the protection of customer data through technical measures is crucial to avoid data breaches and fines.
Reading tip: Manipulated invoice via hacked email - those who don't encrypt are left holding the bag
Violation of information obligations
Another key risk area for the Processing of customer inventory data concerns the violation of Duty to inform in accordance with Art. 13 and 14 GDPR. Companies are obliged, affected inform persons comprehensively about what personal data they collect, for what purpose it is used and what rights the data subjects are entitled to.
This obligation to provide information applies both to the direct collection of data (Art. 13 GDPR) as well as when the data is obtained indirectly from third parties (Art. 14 GDPR). In practice, problems often arise because these obligations are not consistently complied with, especially in sales and service, where data is often collected by telephone, via digital forms or through personal interactions.
Companies sometimes neglect to provide information when customer data is collected through business cards, trade fair contacts or informal conversations. However, there is a clear obligation here to affected person is subsequently informed comprehensively. Similarly, there is often a failure to explicitly inform customers of their rights, such as the Right to informationright of rectification and right of objection.
Another risk arises from unclear or difficult-to-understand data protection notices. Incomprehensible technical terms, unclear structures or a lack of references to specific communication channels for requests for information can impair legal certainty and lead to complaints to data protection authorities.
Recommendation:
- Companies should establish processes for providing information that cover all contact points such as websites, telephone calls and personal conversations.
- The information should be written in clear and understandable language to enable easy access to the relevant data protection information even for laypersons.
- It is advisable to offer training to sales and service staff so that they can provide correct and complete information in direct contact with customers.
- In addition, companies should ensure that their data protection notices are prominently accessible and easy to find, for example through links in emails, offers and contracts.
Improper storage and deletion of data
The GDPR requires that personal data are only stored for as long as is necessary for the respective purpose. As soon as storage is no longer necessary, the data must either be deleted or anonymized. A Infringement violating this regulation entails considerable risks of fines and can also lead to reputational damage.
One particular risk is that companies often do not have clear guidelines on the Storage and Deletion of data. This often leads to obsolete or no longer required customer data being stored unnecessarily. This is not only a Infringement against the GDPRbut also increases the risk of data protection breaches, for example through hacker attacks on databases that are no longer used but are still accessible.
Another problem arises if statutory retention periods are not adhered to correctly. Various legal provisions, for example from tax law, commercial law or industry-specific regulations, define different retention periods that companies must take into account. Violations of these deadlines can also have legal consequences.
The transition from paper-based to digital archiving systems also poses challenges. It is often the case that analog data is not transferred correctly to the digital system or is stored redundantly. This makes it difficult to comply with deletion deadlines and increases the complexity of data management.
Recommendation:
- Implement a comprehensive data inventory that documents all personal data and records its purpose as well as the applicable retention periods.
- Develop a structured Deletion conceptwhich provides clear rules for the identification and timely removal of data that is no longer required. This should also take into account the requirements for the secure destruction of physical and digital data.
- Automated deletion routines and control mechanisms help to remove data in a timely manner and ensure compliance with the GDPR ensure.
- Train your employees regularly in dealing with deletion concepts and familiarize them with the legal requirements in order to avoid mistakes and liability risks.
Checklist for handling customer inventory data
Responsible handling of customer data is crucial to minimize data protection risks and secure customer trust.
The Federal Commissioner for the Data protection and Freedom of Information offers a checklist to help with the handling of customer data. This is actually aimed at telecommunications companies, but most of the points apply to almost all companies. The checklist is intended to help analyze the risks in relation to personal data facilitate. It's worth taking a look.
Source: Checklist customer base data for sales and service of telecommunications companies
Our tip: Keep an overview and automate the majority of your processes. It's easy with Ailance. Make an appointment with us and we will introduce you to our Integrated Risk Management.
German 
English 
Italian 
French