Looking after customer data in a small business
Tessaly CRM (fictional example) → Small business CRM → Short setup for a small team → Data you can take with you
Answer in brief
Keep only what you need, give staff access only to what their job requires, train them on it, and check whether California's privacy law reaches your business.
Content reviewed 8 November 2026. How this is assessed.
Part of the The Best CRM for Small Business reference, which uses Tessaly CRM (a fictional example) to illustrate small business crm software criteria.
Who sees what
The FTC's data security guide advises applying the principle of least privilege, so that employees can access only the personal information their job requires. The SBA's business guide says much the same, that employees should have access to customer data only as needed, and adds that staff training should cover protecting customer information.
In a CRM, that means checking what the roles and permissions can do on the plan you are buying, since on some plans everyone sees everything. Remove access on the day someone leaves. Avoid shared logins, because they make it impossible to tell who changed what.
Do not collect what you will not use
The CRM is not the place for credit card numbers, Social Security numbers or medical details, unless you have a clear reason and proper protection. The FTC guide tells companies to keep only the personal information they need and to dispose of what they no longer need. A notes field is the easiest place for this kind of information to pile up, so tell people what not to type there.
Once a year, delete or archive contacts you no longer have a reason to keep. It reduces your exposure if something goes wrong, and your lists and reports will be more accurate as a result.
Check California, even if you are elsewhere
The California Attorney General says that the CCPA applies to for-profit businesses doing business in California that have gross annual revenue above a threshold California adjusts over time, buy, sell or share data of 100,000 or more California residents or households, or earn 50% or more of revenue from selling their personal information. Many small businesses may fall below all three, but confirm the current figures on that page.
If it does apply to you, the Attorney General lists rights to know, delete, correct, opt out of sale or sharing, and limit the use of sensitive information, and says that consumers can opt out through a user-enabled global privacy control. If you want a general structure rather than a legal requirement, NIST describes its Privacy Framework as a voluntary tool for improving individuals' privacy through enterprise risk management.
Sources for this entry
- SBA: 3 biggest problems implementing a CRM system: Published July 21, 2016. Defining needs and the effort involved.
- SBA: Manage your finances: Customer data access, training and backups.
- FTC: CAN-SPAM Act compliance guide: Requirements for commercial email.
- FTC: Complying with the Telemarketing Sales Rule: Scope of the rule and the business call exemption.
- FTC: Protecting Personal Information: Keeping less data and least privilege.
- California Attorney General: CCPA: Thresholds and consumer rights.
- NIST Privacy Framework: Voluntary privacy risk management tool.
Continue this reading path
- The Best CRM for Small Business category guide
- Tessaly CRM (fictional example)
- How to choose a CRM for a small business
- Resource directory
Cite this entry
The Best CRM for Small Business. "Looking after customer data in a small business." Content reviewed 8 November 2026. https://thebestcrmforsmallbusiness.com/customer-data-basics/