Protecting customer data: 10 practical steps

Your customers rely on you to keep their data secure. If customer identities, credit card numbers or other sensitive information are exposed, people can be harmed and your business can face legal and financial consequences.

For coverage options that address electronic data loss, consider Data Breach (Cyber Liability Insurance).

Steps to achieve data security

1. Perform a security audit. Evaluate the type and amount of data you store and where it is stored before implementing controls.

2. Know your industry's regulations. Different industries have specific legal requirements for protecting customer data—research applicable guidelines and comply with them.

3. Store only essential data. Keep the minimum information you need and securely delete data you no longer require.

4. Store customer data separately. Keep customer information on a separate network and restrict access to sensitive records.

5. Improve your security. Use strong passwords, enable two-step authentication for system access, enforce firewall passcodes and use encryption where appropriate.

6. Clean and maintain systems. Run updated antivirus and anti‑malware software, apply patches promptly, monitor system logs and deactivate access for former employees immediately.

7. Use a shredder for paper records. Shred sensitive documents with a cross-cut shredder rather than throwing them away.

8. Turn off machines. Power down copiers, printers and other devices with internal storage when not in use, since they can hold sensitive data.

9. Train employees. Educate staff on guarding data, protecting mobile devices and portable storage, and on safe email and payment handling practices.

10. Create and enforce a data protection policy. Maintain a written policy that explains procedures and responsibilities and update it as your security improves.

For risks related to alarms, cameras, and other protective equipment, see Security Systems Services Insurance.

If you want coverage options reviewed for your business, talk to an agent who can help match policies to your needs.

Frequently Asked Questions

How often should I audit my data security?

Perform a formal audit at least annually and after major changes to systems or staff; more frequent checks are advisable for high-risk data.

What is the safest way to handle employee departures?

Immediately deactivate former employees’ accounts and retrieve company devices and removable storage to prevent unauthorized access.

Should I encrypt customer data?

Yes—encrypting sensitive data both in transit and at rest is a key protection that reduces risk if systems are breached.

What should a basic data protection policy include?

It should define data classification, access controls, device and password rules, incident response steps and employee training requirements.

HR That Works has an extensive report and checklist about what's known as the "contingent workforce." This includes temporary employees, leased employees, and other non‑permanent arrangements. Use the checklist to guide contract review and operational decisions.

For insurance and vendor liability considerations, see Outsourcer (Vendor Liability / Outsourcing Coverage).

Questions to consider

• Who is responsible for what? -- Study the contract carefully. For example, if an employee isn't working out, who is responsible for firing them? Consider every aspect of managing personnel from hiring through performance management and retention to termination.
• How much are you paying to outsource various HR functions? -- Whether you're outsourcing because you don't have the time, expertise, or desire to do the job in house, you'll have to pay for someone else to do it. What's the competitive rate? What about the provider's experience and results? Do your homework and interview at least a couple of providers and their clients before you choose one.
• What is the provider's hiring process? -- They should be able to show it to you in writing. If they can't, pick someone else. Make sure that the provider does proper skill testing, character assessments, background checks, extensive interviews, immigration checks and pre‑hire physicals.
• What references can the provider offer? -- Don't just ask for references; get the names of companies who have used the vendor during the past year. See if the vendor is willing to share this information and allow you to interview those companies. Ask what those companies will tell you, then do online research to check for additional comments.
• What's the knowledge on board at the vendor? -- How long has the person who does the hiring and staffing been doing their job? What are their credentials? Is there expertise on board to help you with any compliance concerns?
• Does the agent carry the right insurance? -- Depending on whose payroll is involved, employers are generally required to provide workers' compensation benefits and withhold employment taxes. If a temp or leasing agency treats workers as independent contractors incorrectly, you could face liability.
• Does the agency provide employee benefits? -- Remember, if a worker walks and talks like your employee, they may be considered your employee for benefits and other employment purposes. If a worker receives no benefits from the provider, you could face claims later.
• What about union activities? -- To what extent has the agency been faced with unionization efforts? Your temporary workforce might be considered part of an existing bargaining unit and thus covered by a union contract.

For broader vendor and outsourcing insurance options, review Outsourcing (Vendor Liability) Insurance to understand common coverages and policy considerations.

Frequently Asked Questions

What is a contingent workforce?

A contingent workforce includes temporary, leased, contract, and other non‑permanent workers who are hired to meet short‑term or specialized needs.

Who is responsible for payroll taxes and workers' compensation?

Responsibility depends on the contractual arrangement and payroll ownership; verify the provider's insurance and payroll practices before engaging workers.

What checks should a staffing vendor perform?

A reliable vendor should perform skill testing, background checks, immigration verification, and reference checks, and document their hiring process.

How can I verify a vendor's track record?

Ask for recent client references, interview those clients when possible, and search for independent comments or reviews online.