You cannot protect what you have never listed
Most Hong Kong SME owners can tell you roughly where their customer data lives. Very few can produce a list. That gap is where problems start, because a breach is rarely a single dramatic hack. More often it is a spreadsheet in a personal cloud drive, an old contact form still emailing a former staff member, or a chatbot transcript sitting in a vendor dashboard nobody has opened in months.
This article is not about buying a security product. It is about one afternoon of paperwork that makes every later decision, from vendor contracts to staff rules, far easier to get right.
Step 1: List your data types, not your systems
Start with what you hold, in plain language. For most SMEs the list is short:
- Names, phone numbers and email addresses from enquiries
- Delivery addresses and order history
- Payment records and receipts
- Identity document copies, if you handle rentals, recruitment or regulated services
- Conversation records: WhatsApp threads, email, chatbot transcripts, call notes
- Staff records, including MPF and payroll details
Mark each one as low, medium or high sensitivity. Identity documents and payment data are high. A newsletter email list is low but still not public.
Step 2: Trace where each type actually goes
Now walk the journey. Take one data type and follow it end to end. A typical enquiry might travel: website form, hosting provider's database, notification email to a shared inbox, a spreadsheet export, a CRM, and possibly a WhatsApp reply from a staff member's personal phone.
Write down every stop. Include the boring ones, especially backups and exports. The stops that surprise you are the ones worth fixing first.
Watch for the AI layer specifically
If you use an AI assistant, chatbot or transcription tool, add it to the map. Ask three questions about each tool:
- Does it store what we send it, and for how long?
- Does the vendor use our data to train or improve its models?
- Who inside our company can read the history, and can a departing staff member take it with them?
If you cannot answer from the vendor's own documentation, treat the answer as unfavourable and stop sending sensitive records to that tool until you can.
Step 3: Find the orphaned copies
Orphaned copies are the quiet risk. They include:
- Exports downloaded for a one-off mailout and never deleted
- Old website forms still forwarding to an address that no longer exists
- Test or staging sites holding real customer records
- Free-tier AI accounts created by staff with a personal login
- Shared folders with link access switched on by default
Each orphan is a copy you are not tracking and probably not deleting. A short sweep of your hosting file manager, your cloud drive's shared links and your form plugin settings will usually surface several.
Step 4: Set a retention rule you can actually follow
Data you no longer need is pure liability. Pick simple rules and write them down:
- Enquiries that never became customers: delete after 12 months
- Completed orders: keep the minimum required for accounting and warranty, then delete the rest
- Chatbot transcripts: 90 days unless there is an open complaint
- CVs from unsuccessful applicants: 6 months
The exact periods are your call, but they must be written, communicated and applied. A rule nobody follows is worse than no rule, because it creates a false sense of compliance.
Step 5: Turn the map into three concrete actions
Finish by choosing no more than three fixes, each with an owner and a date. Good candidates:
- Move shared inboxes and form notifications off personal accounts onto company-owned ones with two-factor authentication.
- Turn off public link sharing on the folder that holds customer records, and check who still has access.
- Add a single line to your AI tool onboarding: no identity documents or full payment details pasted into any assistant.
If your website forms or hosting are part of the problem and you are not sure who set them up, it is worth having someone look at the setup with you. You can talk to us about a review rather than guessing, and if you are planning a rebuild anyway, it helps to understand what a proper build includes before you compare quotes.
Step 6: Repeat it twice a year
A data map is a snapshot, not a certificate. Tools change, staff leave, new forms get added. Put a recurring reminder in the calendar for a half-day review every six months, and rerun steps 2 and 3. The second pass takes a fraction of the time because you already have the list.
Summary
Privacy risk for a Hong Kong SME is usually not a sophisticated attack. It is unlisted copies of customer data in places nobody is watching. Listing your data types, tracing where each one travels, hunting orphaned copies, setting retention rules and committing to three fixes gives you a defensible position without a big budget. Do it once properly and the maintenance burden drops sharply.