Data protection.

Why this is a marketing issue, not just an IT one

Protecting customer data looks like a technical topic, but it shows up directly in revenue. People hand over their phone number, address and payment details only to those they trust, and the decision to trust is made on outward signs.

The flip side is more obvious. A leaked database or a hacked website hits a company twice: first with the cost of recovery, then with a loss of reputation that has to be rebuilt from scratch.

For a small company this is not an abstract risk. Automated attacks do not pick their victims by size: everything that is reachable gets scanned, and weak protection is found most often precisely on small websites.

What actually needs protecting

Start with an audit, not with buying solutions. In most companies customer data lives in more places than it seems.

• Website and forms - everything a person enters and everything that gets stored on the server.
• CRM and spreadsheets - contacts, enquiry history, deal amounts.
• Staff e-mail and messengers - contracts, scans and bank details pile up there.
• Third-party services - mailing tools, analytics, call tracking, contractors.
• Backups - the least protected of all, yet they contain exactly the same data.

A useful rule: the less you collect, the less you can lose. An unnecessary form field or a database nobody uses is risk without benefit.

Basic protection measures

Encryption. Data must be transmitted and stored in protected form - this applies to the website as a whole and, separately, to payment and personal details.

Multi-factor login. A password plus a second factor - a code or an app - closes the most common hacking scenario: a guessed or leaked password. Switch it on everywhere there is access to customer data.

Updates. An outdated content management system, old modules and plugins are the main reason small websites get hacked. Updates need to be regular, not “when it breaks”.

Access management. Every employee has exactly the rights they need for their work and no more. When someone leaves, their access is closed the same day.

Backups. Regular, stored separately from the website and, above all, tested by restoring them. A copy that has never been restored does not count as a copy.

The weak link is people

Technology is broken into less often than employees are deceived. An e-mail “from the bank”, a call “from support”, an urgent request to pay an invoice on behalf of the director - this is how most successful attacks on small companies get through.

Training here costs less than any technical tool. A few simple rules that everyone knows are enough: do not click links in unexpected e-mails, verify requests to transfer money through a second channel, do not send databases via personal messengers, report anything suspicious without fear of looking foolish.

The last point matters more than the rest. In companies where mistakes are punished, employees hide incidents, and the investigation takes weeks instead of hours.

How to show it to customers

Security needs not only to be provided but also to be made visible - otherwise it has no effect on trust.

Simple things work: a secure connection on the website, a clear privacy policy written in plain language rather than copied, an honest explanation of why you ask for each field in a form, and a working option to unsubscribe and delete one's data.

Behaviour during an incident is a separate matter. If something has happened, an honest and prompt notification to customers preserves more trust than an attempt to keep quiet. Silence almost always comes out, and then the conversation is no longer about the leak but about the cover-up.

The legal side

Processing of personal data in Russia is regulated by a dedicated law. The basic requirements come down to a few points: the person's consent, a specific purpose for collection, collecting only what is necessary, protection in storage and the ability to withdraw consent.

In practice this means a working consent form, a genuine privacy policy, notification about data collection and a clear unsubscribe procedure. Requirements and notification rules change, so before launching any new data collection the wording is worth checking with a lawyer.

Frequently asked questions

We are a small company - does this really apply to us?

It does. Legal requirements do not depend on the size of the business, and automated attacks do not care how many employees you have.

Where to start if nothing has been done?

With three things: a secure connection on the website, updating the content management system, and two-factor login for e-mail and CRM. That closes most of the typical scenarios.

Do we need to hire a dedicated specialist?

For a small company - usually not. A responsible employee with a set of procedures and a contractor who keeps the website updated is enough.

What to do in the event of a breach?

Close off access, record exactly what was leaked, change passwords and keys, notify those whose data is affected and investigate the cause. Hiding it is the worst option.

What to do next

Write down every place where your customers' data lives and, next to each, who has access to it. The list almost always turns out longer than expected, and half of the unnecessary access can be closed the same day.

We are responsible for how a company looks online - that is reputation management. Next, these guides will come in handy: the ethics of working with data in marketing and how to work with customer reviews.