No matter how small your business, the likelihood is that you are storing more and more data about your clients and customers.
In the retail and consumer markets, you might only be collecting transaction data. If you have a booking system or you service the product you sell, you might collect the mobile phone numbers and other personal details of your customers. If you’re in professional services, you might actually collect a whole lot more personal data and perhaps some confidential information associated with other businesses.
When you pause to think about it, the drive to improve customer experience has substantially relied on the collection of data to help close the gap between customer need, and product or service provision. There may never have been a specific intention to collect so much data over time, but it has steadily accumulated. And it is now our biggest asset in understanding shifts and trends in consumer behaviour, so that we can respond appropriately.
Why holding all this data is a risk
When a lot of data accumulates in company databases and resources, it can become unwieldy, and the utility of maintaining data declines over time. There may even be a tendency among SMEs to forget the data is there. And the longer that company technologies and databases go without being properly maintained and patched, the greater the risk that customer data will leak out of the system.
This is an enormous problem. Not only might such a leak cause embarrassment to a small business, but it might pose a legal risk to the directors of those companies and expose the identity of customers to misuse.
For decades, small businesses in Australia have been exempt from the personal data protection provisions of the Privacy Act. But that might be changing.
The federal government is currently reviewing the Act, and the Australian Information Industry Association (AIIA) is calling for all SMEs to be responsible for protecting the personal data of their customers, in line with relevant regulation across Europe.
If this happens, argue the AIIA, consumer rights are better protected. Data will need to be more rigorously maintained but the benefit for SMEs will be that insights from the data are likely to be more accurate to support strategic planning, personalised marketing and service provision. But it will also mean that SMEs need to catch up with their customer data systems.
There’s also been recent changes in what is meant by “Consumer Data Rights” (CDR). While most of the recent changes apply to banking and energy sectors, the scope of businesses affected by these changes is vast. And the spirit of consumer data rights protection means it’s likely that small businesses will increasingly find themselves affected by this kind of regulation.
But even beyond these regulatory controls, SMEs could face civil action from customers whose data has been compromised or used without their consent. Any small business that de-prioritises management of its customer data is likely to risk litigation.
What needs to change
For SMEs to get on the front foot in protecting their customer data, they need to think about the tools and resources they are using to collect, as well as store that data.
There are simple ways that SMEs can protect themselves as well as the data of their customers.
Firstly, migrating data to online Software-as-a-Service (SaaS) hosts will mean that the burden of patching database systems will be placed on the service provider, rather than on the SME. With data safely online, and backup systems in place, there’s less pressure about the age and integrity of the technology within the workplace.
Once the data is online, you need to think about how to best protect collection and access to it.
SMEs need to know about customer preferences for orders, bookings and payments. From a data security perspective, SMEs will need to know who has access to this data, and how the data is handled.
“Encryption during computation” is a mechanism that means whenever data is collected, it’s shielded before it even hits an online database. We’ve developed a form of this at IXUP which not only provides protection for customer data but also enables ongoing insights and analysis without ever decrypting the data.
For the SME, this means data cannot be exposed while gaining value and insights from the data being collected. It is safer. It’s practical.
Better small business data protection means better business
Like anything of value, data needs protecting. The IXUP platform enables you to protect your organisation, to uphold the rights and privacy of the people whose data you use and to operate compliantly within legislative frameworks.
The benefits to companies of upgrading their data handling are obvious. Not only are SMEs compliant with existing and emergent regulation, but if they communicate these changes to their customers, there is likely to be an improvement in customer trust and therefore, their reputation. In addition, this approach brings greater cyber resilience against malicious actors (“hacking attacks”). Safe digital spaces make for happier customers whose confidential details are better protected against instances of identity theft, and business fraud, with offers of real interest made to them.
So it’s a win-win for everyone. And in an era of increasing regulation and compliance requirements, there’s never been a better time for small businesses to take care with customer data.
Warren Bradey is Chief Commercial Officer of IXUP Limited. He specialises in innovation, early stage commercialisation, venture capital, business collaboration, strategic planning, Governance and project management of large multi-disciplinary teams.