Data protection starts by knowing where information lives and who uses it. Customer records may be in CRM, spreadsheet copies on laptops and documents in an external service. One tool cannot cover these situations without a data map, ownership and clear rules.
Locate data and establish its value
List categories such as customer information, contracts, finance, personnel and technical secrets. Identify owners, systems, copies and external transfers. Do not limit review to the central database; exports and backups may also contain sensitive information.
Agree what is required for operations and what is no longer needed. Fewer unnecessary copies mean fewer places to control. The relevant specialist determines legal grounds and retention; the technical team implements agreed rules rather than inventing one universal policy.
Separate use from administration
Grant access by role and work requirement. Viewing, editing, exporting and bulk deletion may need different permissions. Shared logins make it difficult to establish who transferred a file or changed a record, so review individual access and logging.
For example, a manager may need assigned customers without a full database export. Hiding a button is insufficient; check server permissions and alternative retrieval paths. Temporary rights need expiry or periodic review with the data owner.
Match encryption to the threat
Disk encryption may help after physical device loss but does not stop someone already authorised to access open data. Choose the appropriate protection layer, key management and recovery. Losing a key alongside a backup may make data inaccessible.
For transfers, check secure channels, shared-link permissions and external service access. User passwords need specialised secure storage rather than reversible encryption for later reading. Use supported mechanisms instead of inventing cryptographic algorithms.
Test loss, revocation and recovery
Test agreed scenarios: a lost laptop, accidentally public link, role change and mistaken deletion. Verify revocation and restoring required data without exposing it. Incidents need a contact and a clear procedure.
After implementation, hand over the data map, rules and test evidence. CRM changes or new external services require flow review. Protection remains an operating process rather than installing software once with a promise to prevent every leak.
Sources and further reading
