Your customer data lives in more places than you think.

Ask a business where its customer data lives and the answer comes quickly: the CRM, or the booking system, or the practice-management tool. It is the right answer to a different question. That is where customer data starts.

From there it travels. Someone exports a list to plan a campaign. A spreadsheet is emailed to the accountant. A report is saved to a shared drive “for now”. A new tool is trialled with real records. Every copy was made for a good reason, and every copy is still there.

How data spreads

Nobody decides to scatter customer data. It happens one reasonable step at a time:

• Exports. The fastest way to work with data is to pull it out of the system that protects it.
• Inboxes. Attachments sent between colleagues, suppliers and advisers, kept for years.
• Shared drives. Folders created for one project, readable by everyone, never tidied.
• Software you subscribe to. Every tool that syncs with your CRM or your mailbox holds its own copy.
• Backups. Faithful copies of everything above, including what you meant to delete.
• AI assistants. Anything pasted into one has left the systems you control.

Why it matters on the worst day

The map matters most on the day something goes wrong. When a mailbox is compromised or a laptop is stolen, the first question is not technical. It is: whose data was in there?

The clock starts quickly. Under Florida’s Information Protection Act, affected individuals must generally be told within 30 days, and the state’s Department of Legal Affairs as well when 500 or more Floridians are involved. Under the GDPR, the regulator expects to hear within 72 hours. Other states and countries have their own rules, and your lawyer will know which apply to you.

None of those deadlines can be met by a business that first has to discover where its data was. With a map, the answer takes an afternoon. Without one, it takes weeks — and the notice that goes out is vaguer, wider and more expensive than it needed to be.

A map in two weeks

You don’t need a tool to start, and the map doesn’t need to be perfect to be useful.

Week one: find the places. Start with what you pay for: your card statements and invoices list every service that might hold data. Then ask each team lead one question — where do you keep customer details, including the copies? — and search the shared drives for exports. Write every answer down.

Week two: describe each one. For every place on the list, record four things:

1. Owner — the person who answers for it.
2. Contents — what kinds of data: contact details, payment details, identity numbers, health information.
3. Access — who can reach it, and whether that is still right.
4. Retention — how long it is kept, and whether anyone decided that.

At the end of the fortnight you will have a list that is incomplete, and far better than the one in anyone’s head.

Shrink it before you protect it

The map always shows data that shouldn’t exist: exports from three years ago, a folder of scanned IDs from a process that changed, the trial tool nobody cancelled. Delete it. The safest data is the data you no longer keep, and every copy removed is one you never have to protect, notify about or explain.

Keep the map true

A map drawn once goes stale in a season. Two habits keep it true: a short review every quarter with the owners, and one rule for anything new — a tool goes on the map before it is given real data, not after.

A business that knows where its data lives can answer a customer’s question, an auditor’s request or a breach in the same way: quickly, precisely and without guessing. That is what managing data means. Everything else is storage.