Protecting customer data - 8 tips from Allianz

Authored by Allianz

Data is a valuable corporate resource. Businesses and organisations collect, store and analyse data in order to; understand their customers, tailor products to better suit their needs, improve customer experiences and optimise production so they can sell more efficiently.

However, data collection carries a range of potential risks that businesses must plan for, including data breaches.

According to the 2022 Cyber Security Breaches Survey, carried out by the Department for Digital, Culture, Media & Sport, 39% of UK businesses identified a cyber-security breach in the last 12 months. The most common and most disruptive form of security breach is phishing – employees receiving fraudulent emails or being directed to fraudulent websites1. If a cyber-attack targeting customer data is successful, businesses may lose customers, industry reputation, brand trust, and could even face fines or penalties by the Information Commissioners Office (ICO).

Data protection law sets out what should be done to make sure everyone’s data is used properly and fairly. In the UK, the General Data Protection Regulation (GDPR) summarises how organisations must process and hold personal data, covering areas such as lawfulness, transparency, fairness, consent, and accountability.

Data protection law applies to all workplaces, business ventures, groups, clubs and enterprises of any type. Whether you’re a sole trader or self-employed, work for yourself or if you’re an owner or director, if you hire only a handful of staff or even if you don’t employ any staff at all – the rules are the same. It makes no difference where the error came from, what matters is that people could be harmed2.

We’ve listed 8 things for businesses to consider to help prevent data breaches:

1 Make sure systems are up-to-date: Apply the latest security updates to all systems, including archive servers, as soon as possible. Outline this in the data security policy and ensure it’s followed.

2 Don’t keep data for longer than needed: Only keep the personal data you need for as long as you need it – especially if the data is unencrypted, as data subjects can be easily identified if there’s a breach.

3 Encrypt personal data: Ensure all personal data is encrypted ‘at rest’, i.e. when stored. If there’s a cyber-attack, this lowers the risk to people whose personal data is stolen.

4 Provide employee training: Increase cyber security awareness throughout the business so that employees become more vigilant and understand how and when to report suspicious activity, and how to handle personal data. IT teams need to understand and carefully apply data security policies.

5 Check someone’s identity: The inability to trust information supplied to the right person will hinder any organisation’s efforts to service its customers. But by spending a little extra time successfully checking the claimed identity of a person, a business can be confident that they’re giving the right people the right information.

6 Avoid releasing data into the wrong hands: Identity checks help to ensure that you’re talking to the person they claim to be, protecting the customer and the business from information falling into the wrong hands. Any phone call should include customer verification questions such as – their name, date of birth and address, including postcode. Sometimes a password attached to an account may also be requested and recorded against the customer’s records for added security.