Your customer list is now your biggest liability
Most Hong Kong SMEs did not set out to become data custodians. You collected names, phone numbers, delivery addresses and order histories because you needed them to run the business. Then you added a CRM, a WhatsApp Business account, a booking plugin and maybe an AI assistant. Each addition made life easier and quietly widened the surface area for a leak, a misuse or a scam.
Regulators and customers are both less forgiving than they were five years ago. The practical question is not whether you have a formal privacy programme, but whether a small team can answer three things: what data you hold, who can reach it, and what happens when something goes wrong.
Step 1: Map what you actually hold
Before buying any tool, spend one afternoon writing a list. For each system, note the data type, where it lives, who has admin access and whether it is backed up.
- Website forms, checkout and newsletter sign-ups
- WhatsApp Business, email inboxes and shared drives
- Accounting, POS and delivery platforms
- Any AI chatbot, transcription or summarisation tool that touches customer messages
If you cannot name the owner of a system, that is your first gap. A shared spreadsheet of customer details sitting in a personal Google account is a common and serious finding.
Step 2: Cut the data you do not need
Privacy risk scales with volume. Hong Kong's Personal Data (Privacy) Ordinance expects data to be collected for a purpose and not kept longer than necessary, so deletion is a control, not housekeeping.
- Delete customer records that have been inactive for a defined period, for example 24 months, unless there is a legal or accounting reason to keep them.
- Stop collecting fields you never use. Date of birth and full address are frequent offenders.
- Remove customer exports from laptops and personal phones after a campaign ends.
- Turn off default form fields added by plugins you did not configure.
Step 3: Lock down access
Most SME breaches are not sophisticated attacks. They are shared passwords, ex-staff accounts that were never closed and admin rights handed out too freely.
- Use a password manager and give every person their own login.
- Turn on two-factor authentication on email, hosting, domain registrar and any tool holding customer data. Email is the master key to everything else.
- Review admin lists quarterly and remove departed staff the same day.
- Give agencies and freelancers the narrowest access that works, and revoke it when the project ends.
If you work with a web partner, ask how they handle access to your site and database. A studio that can explain its own access model is usually the safer choice; you can see how we approach this on our pricing page.
Step 4: Treat AI tools as data transfers
AI assistants are useful, but pasting a customer complaint into a public chatbot is effectively a disclosure. Before adopting any AI tool, ask where the data is processed, whether inputs are used for model training, and how long they are retained.
Rule of thumb: if you would not email the content to a stranger, do not paste it into a free AI tool.
Practical habits that cost nothing:
- Remove names, phone numbers and ID numbers before using AI to draft replies or summarise threads.
- Prefer business tiers with no-training commitments for anything customer-facing.
- Keep a short internal note listing which AI tools are approved and for what.
Step 5: Make the website itself boringly secure
Your website is the front door. Basic hygiene prevents the majority of incidents:
- Force HTTPS everywhere and renew certificates automatically.
- Keep the CMS, plugins and themes updated, and delete plugins you no longer use.
- Limit login attempts and rename or protect the admin URL.
- Take automated off-site backups and test a restore once.
- Collect only the consent you can evidence, and publish a privacy policy that matches what you actually do.
If you are unsure whether your current setup meets these basics, a short technical review is cheaper than a cleanup after an incident. Our team can walk through it with you via the contact page.
Step 6: Train staff on scam patterns, not theory
Scams targeting SMEs usually arrive as something plausible: a supplier asking to change bank details, a fake customer complaining about an order, a "director" messaging on WhatsApp for an urgent transfer, or a phishing page that mimics your hosting login.
Run a fifteen-minute monthly briefing using real examples. Agree three rules: verify payment changes by calling a known number, never share one-time codes, and report suspected phishing internally without blame. Write down who handles a suspected breach and how customers would be told.
Summary
For an SME holding customer data, privacy and security come down to six repeatable actions: map your systems, delete what you do not need, give people individual access with two-factor authentication, treat AI tools as data transfers, keep the website patched and backed up, and rehearse scam scenarios with staff. None of this requires a large budget. It requires someone to own the list and review it quarterly.