Having a lawful reason to hold customer data

Aug 29
3 min read

Introduction

A business holds customer records, sends marketing emails, keeps enquiry details indefinitely and stores everything on the basis that it seems reasonable and nobody has objected.

Data protection frameworks generally do not work that way. Processing personal data requires a lawful basis, identified for each purpose, before the processing begins. Most small businesses have never carried out that exercise, which means every downstream question — what the privacy notice says, how long to keep things, whether marketing is permitted — has been answered without a foundation. Which is why those answers tend not to survive being examined.

1. Having a lawful reason to hold customer data is required for each purpose separately

The structure most people miss.

You do not have one basis for holding customer data. You have a basis for fulfilling an order, a different one for keeping accounting records, and another for sending marketing. Each purpose needs its own.

2. Know what the available bases are

A short list in most frameworks.

Typically: performing a contract, complying with a legal obligation, protecting vital interests, a public task, legitimate interests, and consent. The specifics vary by jurisdiction and the shape is broadly common.

3. Do not default to consent

The most common error.

Consent is one basis among several and it is the most fragile: it must be freely given, specific and withdrawable, and processing must stop if it is withdrawn. Where you have a contract or a legal obligation, that is usually the stronger basis.

4. Use contract for what you need to deliver

Straightforward and frequently applicable.

Taking an order, arranging delivery, providing the service and handling the payment. This covers a large part of what most businesses do with customer data and requires no consent at all.

5. Use legal obligation where records are required

Also straightforward.

Accounting and tax records, employment records, and anything a regulator requires you to keep. This basis also justifies retaining data after a relationship ends, which is frequently the question people struggle with.

6. Understand legitimate interests properly

Useful and requiring an assessment.

Where processing is genuinely necessary for a business purpose and not overridden by the individual's rights. Most frameworks expect a documented balancing assessment, which is a short written exercise rather than a formality.

7. Treat marketing as its own question

Governed by additional rules.

Electronic marketing is frequently subject to separate legislation with its own consent and opt-out requirements, over and above general data protection law. Establish that position specifically rather than assuming your general basis covers it.

8. Record the basis for each purpose

The documentation that makes it real.

A simple table listing purpose, data, basis and reasoning. This is what allows you to answer a query from a customer or a regulator, and it takes an hour to produce.

9. Tell people what basis you rely on

A transparency requirement.

Most frameworks require the lawful basis to be stated in the privacy notice. This is also why the exercise has to happen before the notice is written rather than afterwards.

Review it when you start doing something new with data you already hold. Using customer records for a purpose they were not collected for is a common and easily made error, and the question is whether the new use is compatible with the original one.

Conclusion

Identify a basis for each purpose rather than for the data as a whole.

Learn the bases available in your jurisdiction, avoid defaulting to consent because it is the most fragile option, rely on contract for what you need to do to deliver, rely on legal obligation for records you are required to keep, document a balancing assessment where you rely on legitimate interests, treat electronic marketing as a separate question with its own rules, record purpose, basis and reasoning in a simple table, state the basis in your privacy notice, and reassess whenever you use existing data for something new.