Every SME owner has a folder like this: quotes sent three months ago, enquiries that never converted, a spreadsheet of leads from a trade show. Nobody thinks of it as customer data because nobody paid. It is still personal data, it still carries names, phone numbers, email addresses and sometimes budget details, and it is usually the least protected file in the business.
That gap matters more than it used to. Hong Kong's third Cyber Security Attack and Defence Drill expanded this year to more than 70 government departments and private organisations, with private companies invited into the defending teams for the first time. The message for smaller firms is simple: attackers do not only go after live customers. They go after whatever is easiest to reach.
Why unsold leads are the soft target
Live customer records usually sit inside a system someone owns — a CRM, a booking platform, an e-commerce backend. Prospect data rarely does. It lives in a personal inbox, a phone contact list, a shared drive folder named leads 2025, or a WhatsApp group the salesperson created and never cleaned up.
Three things make this risky:
- It spreads. The same enquiry may exist in email, a phone, a spreadsheet and a chat thread. You cannot delete what you cannot find.
- It is shared casually. A link to a spreadsheet gets forwarded to a freelancer, a supplier or an ex-colleague, and the link keeps working long after the project ends.
- It is kept forever. No one feels responsible for deleting a lead that never became a customer, so it stays for years.
Under Hong Kong's Personal Data (Privacy) Ordinance, the data protection principles apply to personal data whether or not a sale happened. You are expected to keep it no longer than necessary and to protect it against unauthorised access. A prospect list with no owner and no retention rule fails both tests quietly.
A four-step clean-up you can run this week
1. Map where prospect data actually lives
Before deleting anything, list every place an enquiry could be stored: shared inbox, sales spreadsheet, phone, WhatsApp, cloud drive, form submissions, old website contact forms. Ask each person who handles enquiries to add to the list. You are looking for the folders nobody has opened in a year.
2. Decide what you still need
Split the list into three groups:
- Active — a real conversation in the last 90 days. Keep, with an owner named.
- Dormant — no contact for six to twelve months. Keep only if there is a genuine reason, and record it.
- Dead — no reply, wrong fit, or the person asked not to be contacted. Delete the record and any copies.
Write the rule down, even if it is one paragraph. A written retention rule is what turns a tidy-up into a habit.
3. Close the sharing loopholes
Shared links are the most common way prospect data escapes. Go through your cloud drive and check every file that contains names or contact details. Turn off anyone with the link access, set expiry dates where the tool allows it, and remove access for anyone who has left the project. If a freelancer needs a list, send the minimum columns they need rather than the master file.
4. Make the next enquiry safer by default
Change the front door rather than chasing the mess afterwards. Use a website contact form that writes into one owned system instead of scattering into inboxes. Limit who receives form notifications. If your site collects enquiries, check what happens to that data after submission — a form that emails a copy to five people creates five copies you cannot recall. Our team can review how your site handles form data as part of a build or a maintenance arrangement, and it is worth doing before the list grows again.
The scam angle: old leads are good bait
A leaked prospect list is useful to a fraudster because it contains real context — a person who genuinely asked about your service, the rough budget, the date. That makes a follow-up email or call far more convincing than a generic phishing attempt.
Two patterns to watch for:
- Invoice redirection. Someone emails a prospect or supplier, referencing a real past quote, and asks for payment to a new bank account. If your quote PDFs contain bank details, treat them as sensitive documents.
- Internal-style requests. A message that appears to come from a colleague asking for the lead list or a customer export. Verify by a second channel before sending anything.
Brief the team on one rule: any request to send a list of contacts, or to change payment details, gets confirmed by phone with a known number. That single rule blocks most of these attempts.
What good looks like in practice
You do not need an enterprise data platform. You need three things: one place where enquiries land, a named person responsible for it, and a date after which records get deleted. Add a quarterly review where someone actually opens the folder and clears it.
If you are unsure where to start, a short conversation is usually enough to spot the two or three folders that carry the most risk. You can book a review with us and walk through your enquiry flow end to end.
Summary
Quotes that never converted are still personal data, and they are usually stored with less care than live customer records. Map where prospect data lives, decide what you still need, close shared-link access, and route new enquiries into one owned system. Then add a deletion date and a simple verification rule for anyone asking you to send a contact list or change bank details. None of this requires new software — just an owner and a habit.