Trace a record from collection to removal
Choose one customer interaction, such as requesting a design quote. List every field collected, the system receiving it, the person reading it and any later export. Include the form, confirmation message, support ticket, analytics event and downloaded spreadsheet. This exercise often reveals more destinations than the database diagram shows.
Next to each field, write its business purpose. If nobody can explain why a quote request needs a date of birth, remove that field from the proposed process. When a field is necessary only later, consider collecting it at that later step. Smaller records are easier to understand, control and maintain. The data minimization guide covers collection choices in more detail; the next steps here address access, copies and removal.
Use a field review instead of collecting everything
Consider an illustrative design agency that needs a project category, a short brief and a way to send a proposal. Its team should make each collection decision deliberately. Information a customer volunteers may still need handling rules; free-text fields and attachments deserve attention alongside structured fields.
| Proposed field | Business question | Possible decision |
|---|---|---|
| Project category | Does this route the request? | Keep a short list of choices |
| Full identity document | Why is this needed for a design quote? | Exclude from this workflow |
| Project brief | What detail does the designer need? | Explain what to include and avoid |
| Contact details | How will the proposal reach the customer? | Collect only the chosen contact route |
Separate seeing a record from controlling it
A salesperson may need to read a request. A designer may need the brief. A manager may approve a refund. These are different permissions. Avoid treating successful login as permission to perform every action or view every record. OWASP’s authorization guidance distinguishes identity checks from access decisions.
Build an access worksheet with actions as well as roles: view, change, export, delete and approve. Then test representative situations using non-production records. Can one customer open another customer’s request? Can an ordinary employee change an approved amount? A hidden button is a presentation choice; the actual permission must be checked where the action is enforced.
Use hosted data without recreating a local customer database
Gammal Tech’s login integration does not disclose underlying account contact details or identity documents to the application. The application can store supported per-user data separately.
Keep your own collection choices explicit. If a business asks a customer for a delivery address or proposal contact, it has created an additional data-handling responsibility. A hosted login does not make that separately collected information disappear.
Also consider the viewing stage. Information returned to a page may be visible to code running there, and staff can create copies after access. Moving the original record changes where it is stored; the remaining journey still needs deliberate design.
Give exports, logs and support their own rules
Before enabling a full export, identify who needs it, where it may be stored and when it should be removed. Prefer a limited report when the task only needs totals or a small subset. For support, create a way to describe a problem using a reference and time rather than a complete customer record.
OWASP’s logging guidance identifies tokens and sensitive personal information as data requiring exclusion or protective treatment. An error report should help diagnose a failure without becoming another repository of customer secrets.
In the agency example, a screenshot of a layout problem can use a test brief. Sending the real customer’s attachment to several contractors creates an avoidable sharing problem.
Set a useful end to the record’s life
Define a retention decision for each workflow. A rejected enquiry, an active order and a completed support case may have different business needs. Record who authorizes removal and which systems must be considered, including exports and supplier-held copies. Establish any applicable retention obligations with qualified advice where needed.
Ask hosted providers how deletion, export and recovery actually work for the service you use. Do not promise customers a process your team has not confirmed. Test the agreed process using a sample record and document the outcome. When staff cannot explain where a copy went, improve the workflow before collecting more information through it.
Common questions
Does hosted storage eliminate the risk of a customer data leak?
It can reduce exposure from data stored on your own server. Data returned to your website, downloaded by employees or sent to other tools still needs protection.
Can we collect information that the login provider does not share?
Your application may have its own collection process. Decide what is needed, explain its use and manage access, copies and retention for the information you collect.