Data privacy basics for your website, forms, and customer records

Most small business websites collect personal information without anyone really thinking about it. A contact form asks for a name and mobile number. A booking page stores email addresses. An order form records home addresses for delivery. Inquiries pile up in an inbox, a spreadsheet, or a shared chat. None of this is unusual, but it does come with responsibility. In the Philippines, the Data Privacy Act of 2012 sets rules for how personal information is collected and handled, and the National Privacy Commission oversees it. This article isn't legal advice, but it covers practical habits that help any small business treat customer data with care.

Know what you're collecting

Start with a simple inventory. List every place your business collects personal information online and offline, and what you collect in each one. You may be surprised how many there are:

• Contact and inquiry forms on your website.
• Booking, order, and checkout pages.
• Messenger, Viber, or email conversations with customers.
• Newsletter or promo sign-up lists.
• Spreadsheets of past orders, deliveries, or appointments.
• Staff records, if your systems also handle employee information.

For each one, note where the information ends up, who can see it, and how long it stays there. This list becomes the foundation for every other step.

Ask only for what you need

The easiest data to protect is data you never collected. Look at each form and ask whether every field is truly necessary. A simple inquiry form may only need a name, a way to reply, and the message itself. A birthday, full address, or ID number usually isn't needed unless the service requires it. Shorter forms are also easier for customers to fill out on a phone, so this habit helps both privacy and conversions.

Tell people what you'll do with it

Customers should know why you're asking for their information and how you'll use it. A clear privacy notice on your website, written in plain language, is a good place to explain this. Near each form, a short line such as "We'll use your details only to reply to your inquiry" sets expectations. If you want to send promotions, ask for that separately instead of assuming everyone who inquires wants marketing messages. Since the details depend on your business, it's worth getting proper guidance when writing your notice.

If you wouldn't be comfortable explaining how you use a customer's data to their face, change how you use it.

Keep it secure and limit access

Good security for a small business is mostly about consistent basics, not expensive tools:

• Make sure your website uses HTTPS, so form submissions are encrypted in transit.
• Use strong, unique passwords and turn on two-factor authentication for admin and email accounts.
• Give staff access only to the records they need for their role.
• Avoid passing customer lists around in group chats or personal devices.
• Remove access promptly when someone leaves the team.
• Keep your website, plugins, and systems updated, and back them up regularly.

Don't keep data forever

Old inquiries and order records tend to stay around simply because nobody deletes them. Decide how long you actually need each kind of record, for example to handle warranties, follow up with customers, or meet record-keeping requirements, and clean out what you no longer need on a regular schedule. Less stored data means less to protect and less to worry about if something goes wrong. It's also wise to agree on what your team should do if data is lost, leaked, or accessed by the wrong person, so nobody has to figure it out in a panic.

The takeaway

This week, open your website and go through every form as if you were a customer. Write down what each one collects, where that information goes, and who can see it. Remove any field you don't need, add a short line explaining how the details will be used, and check that only the right people have access. Small, steady habits like these protect your customers and build the kind of trust that keeps them coming back.