Customer database data in sales and service is a valuable asset for companies. It contains personal information such as names, addresses, contact details and purchase histories, which can be used for targeted customer contact and individual support. However, there are considerable data protection risks involved in handling this data. Violations of the General Data Protection Regulation (GDPR) or other national regulations can lead to high fines and damage to your image. We show you how you can avoid typical data protection risks. The linked checklist makes it easier to analyze the risks associated with personal data.
Insufficient consent
A frequent source of error is the lack of valid consent for the processing of customer data. Especially in the case of direct marketing measures such as email advertising, telephone acquisition or personalized offers, explicit consent is required in accordance with Art. 6 para. 1 lit. a GDPR.
In practice, there is often uncertainty about how to obtain effective consent. The GDPR requires consent to be voluntary, informed and unambiguous. This means that customers must actively consent (e.g. by ticking a box) and be clearly informed about what their data will be used for. Consent must also be revocable at any time.
Particular care should be taken with pre-ticked checkboxes: According to the current case law of the European Court of Justice (ECJ), these do not constitute effective consent. A general consent clause in general terms and conditions is also not sufficient.
Recommendation:
- Companies should formulate transparent declarations of consent that specifically address the purpose of processing and are easy to understand.
- Every consent obtained should be documented and retrievable for verification purposes.
- Implement user-friendly withdrawal options, e.g. through a clearly marked unsubscribe link in emails or a simple withdrawal form on your website.
- Train your sales staff specifically in dealing with consent so that they can inform customers correctly and obtain consent properly. A frequent source of error is the lack of valid consent for the processing of customer data. Explicit consent is required in accordance with Art. 6 para. 1 lit. a GDPR, especially for direct marketing measures such as email advertising or personalized offers.
Misuse of customer database data
Purpose limitation is a central principle of the GDPR and plays a particularly important role in the handling of customer data. According to Art. 5 para. 1 lit. b GDPR, personal data may only be collected for specified, explicit and legitimate purposes and may not be further processed in a manner incompatible with those purposes.
In practice, it often happens that customer data that was originally collected for a specific purpose is later used for other purposes without renewed consent. This represents a considerable risk. For example, the use of service data for advertising measures or the transfer of customer data to partner companies without prior consent can lead to considerable fines and a loss of trust.
Practical examples of misappropriation:
- Use of support requests to create personalized advertising campaigns. Customers do not expect their service requests to be used for advertising purposes.
- Collection of location data to improve services and their subsequent use for targeted advertising. Such a change of purpose is not permitted without explicit consent.
- Storage of payment data beyond the billing process to carry out market analyses. Separate consent is required here.
Another risk is the incorrect assumption that general consent to data processing permits any type of data use. This is not the case. Consent must always relate specifically to the respective purpose.
Recommendation:
- Companies should set out clear purposes in their privacy policies that are transparent and easy to understand for data subjects.
- In the event of planned changes of purpose, renewed consent must be obtained before the data is used for any other purpose.
- Companies should keep an internal data inventory that provides information on which data is processed for which purpose and when renewed consent is required.
Missing or inadequate safety measures
Mobile working methods (e.g. field service, remote access) are particularly widespread in sales and service. This significantly increases the risk of data leaks and unauthorized access. There are also risks from improperly secured IT systems, insecure networks and inadequately trained employees.
The most common security vulnerabilities include:
- Unencrypted end devices: Employees often use laptops, smartphones or tablets to access customer data. Without suitable encryption measures, these devices can become a risk in the event of theft or loss.
- Insufficient access controls: A lack of role and rights concepts means that employees can access data that is not required for their work.
- Outdated software and systems: Security gaps in non-updated software can be exploited by attackers and put sensitive customer data at risk.
- Lack of employee awareness: Social engineering attacks such as phishing emails are often targeted at untrained employees and can lead to data leakage or unauthorized disclosure of customer information.
Recommendation: Companies should implement technical and organizational measures (TOMs), including
- Encryption of end devices: All mobile and stationary end devices should be encrypted to ensure the security of customer data in the event of theft or loss.
- Access rights according to the principle of the lowest possible assignment of rights: Employees should only have access to the data they need to perform their tasks.
- Two-factor authentication (2FA): The use of 2FA for critical systems and sensitive data access offers additional protection against unauthorized access.
- Regular security updates: IT systems and software should be continuously updated to close known security gaps.
- Implementation of security guidelines: Companies should define clear security guidelines for handling mobile devices, remote access and external storage media and enforce them consistently.
- Regular employee training: To avoid phishing attacks, social engineering and data breaches, employees should be regularly informed about current threats and rules of conduct.
A proactive approach to IT security and the protection of customer data through technical measures is crucial to avoid data breaches and fines.
Reading tip: Manipulated invoice via hacked email - those who don't encrypt are left holding the bag
Violation of information obligations
Another key risk area in the processing of customer data concerns the violation of information obligations pursuant to Art. 13 and 14 GDPR. Companies are obliged to provide data subjects with comprehensive information about the personal data they collect, the purpose for which it is used and the rights to which the data subjects are entitled.
This obligation to provide information applies both when data is collected directly (Art. 13 GDPR) and when data is obtained indirectly from third parties (Art. 14 GDPR). In practice, problems often arise because these obligations are not consistently complied with, especially in sales and service, where data is often collected by telephone, via digital forms or through personal interactions.
Companies sometimes neglect to provide information when customer data is collected through business cards, trade fair contacts or informal conversations. However, there is a clear obligation to provide the data subject with comprehensive information retrospectively. Similarly, companies often fail to explicitly inform customers of their rights, such as the right to information, the right to rectification and the right to object.
Another risk arises from unclear or difficult-to-understand data protection notices. Incomprehensible technical terms, unclear structures or a lack of references to specific communication channels for requests for information can impair legal certainty and lead to complaints to data protection authorities.
Recommendation:
- Companies should establish processes for providing information that cover all contact points such as websites, telephone calls and personal conversations.
- The information should be written in clear and understandable language to enable easy access to the relevant data protection information even for laypersons.
- It is advisable to offer training to sales and service staff so that they can provide correct and complete information in direct contact with customers.
- In addition, companies should ensure that their data protection notices are prominently accessible and easy to find, for example through links in emails, offers and contracts.
Improper storage and deletion of data
The GDPR requires that personal data is only stored for as long as is necessary for the respective purpose. As soon as storage is no longer necessary, the data must either be deleted or anonymized. A breach of this regulation entails considerable risks of fines and can also lead to reputational damage.
One particular risk is that companies often do not have clear guidelines in place for the retention and deletion of data. This often leads to obsolete or no longer required customer data being stored unnecessarily. This is not only a violation of the GDPR, but also increases the risk of data breaches, for example through hacker attacks on databases that are no longer used but are still accessible.
Another problem arises when legal retention periods are not adhered to correctly. Various legal provisions, for example from tax law, commercial law or industry-specific regulations, define different retention periods that companies must take into account. Violations of these deadlines can also have legal consequences.
The transition from paper-based to digital archiving systems also poses challenges. It is often the case that analog data is not transferred correctly to the digital system or is stored redundantly. This makes it difficult to comply with deletion deadlines and increases the complexity of data management.
Recommendation:
- Implement a comprehensive data inventory that documents all personal data and records its purpose as well as the applicable retention periods.
- Develop a structured deletion concept that provides clear rules for the identification and timely removal of data that is no longer required. This should also take into account the requirements for the secure destruction of physical and digital data.
- Automated deletion routines and control mechanisms help to remove data in a timely manner and ensure compliance with the GDPR.
- Train your employees regularly in dealing with deletion concepts and familiarize them with the legal requirements in order to avoid mistakes and liability risks.
Checklist for handling customer inventory data
Responsible handling of customer data is crucial to minimize data protection risks and secure customer trust.
The Federal Commissioner for Data Protection and Freedom of Information offers a checklist to help with the handling of customer data. This is actually aimed at telecommunications companies, but most of the points apply to almost all companies. The checklist is intended to make it easier to analyze the risks associated with personal data. It is worth taking a look at it.
Source: Checklist customer base data for sales and service of telecommunications companies
Our tip: Keep an overview and automate the majority of your processes. It's easy with Ailance. Make an appointment with us and we will introduce you to our Integrated Risk Management.
English 
German 
Italian 
French