Data ethics.

What data we are talking about

Big data in marketing means accumulated information about people’s behaviour: what they viewed, what they bought, where they came from, how often they return, what they were interested in before buying.

Companies use it to hit the need more precisely: to show relevant offers, not advertise what has already been bought, suggest complementary items, pick the right moment for an email.

In itself this is neither good nor bad. The question is where the data came from, whether the person knows about it and what happens to it next. This is where the difference begins between normal work and what makes customers recoil.

Where the line lies

A simple benchmark: if a customer found out how you obtained information about them and was unpleasantly surprised, the line has already been crossed.

Fine: analysing purchase history in your own shop, taking into account which pages a person viewed on your website, segmenting subscribers by their own actions in your newsletter.

Questionable: merging data from different sources to build a profile of a person that they never shared with you; buying contact databases; inferring sensitive information — health, income, marital status — and building messages on it.

A special case is overly precise personalisation. Advertising that reveals more than the person told you is unsettling, even if everything is formally legal. What works here is not the law but the feeling.

What the law requires

In Russia, work with personal data is governed by a dedicated law, and its basic requirements are straightforward.

• Consent — the person must explicitly agree to processing, not “agree by default”.
• A defined purpose — data is collected for a specific task and not used for another.
• Minimisation — only what is needed for that purpose is collected.
• Protection — access is restricted, storage is secured.
• The option to opt out — withdrawing consent and unsubscribing must be as easy as subscribing.

In practice this means: a working consent form, a genuine privacy policy, a data collection notice on the website, a working unsubscribe button in every email. Requirements for platforms and the form of consent change, so before launching any new data collection the wording should be checked with a lawyer.

How to set this up inside the company

For rules to be followed, they have to be written down. A short document is enough, answering a few questions: what data we collect, why, where we store it, who has access, how long we keep it and when we delete it.

Contractors and services deserve a separate check. Customer data often ends up in email platforms, analytics, call tracking and at the agency. You are the one responsible for what happens to it there.

A useful rule is not to collect just in case. Every unnecessary field in a form and every database nobody uses is risk without benefit. The less is collected, the less there is to lose.

Why this affects the money

Transparency builds trust, and trust builds sales. Companies that clearly explain why they need data get more consents, not fewer.

The flip side is more visible. A leaked customer database or intrusive advertising built on data the person never shared hits reputation harder than any advertising campaign can lift it. Recovery takes years.

There is a direct benefit in good order too: when you know where which data sits, it is easier to use. Companies with their data in order launch campaigns faster and measure results more accurately.

Frequently asked questions

Is consent needed for ordinary web analytics?

Visitors must be notified about data collection and told which services are used. Separately, recording of fields with personal information should be switched off in session replay services.

Can we buy databases for mailings?

No. People in such a database never gave you consent, the emails will go to spam, and the company gets both legal risk and a damaged sender reputation.

How long should customer data be kept?

As long as needed for the stated purpose, and no longer. The period should be fixed in an internal document and data genuinely deleted according to it.

We are a small company — does this apply to us?

It does. The law’s requirements do not depend on the size of the business, and a dissatisfied customer with a complaint is equally available to a large company and a small one.

What to do next

Write down every place where you hold customer data: CRM, spreadsheets, email service, analytics, managers’ correspondence. The list almost always turns out longer than expected — and that is the first step towards order.

We set up data collection and its use in advertising — that is advertising setup. Next, you may find useful our pieces on why analytics matters in digital marketing and how to work with customer reviews.