Mission 14
Data Protection, Privacy and Responsible Handling
Learn to collect only the data you need, label it by sensitivity, keep it only as long as necessary and share it safely, so customers and staff can trust you with their information.
In this mission you will
- Explain data minimisation, classification and retention in plain language.
- Classify common business information into simple sensitivity levels.
- Choose safe ways to store, share and dispose of personal and confidential data.
- Document one dataset's purpose, owner, access and retention period.
Every business holds information about people: customers' names and phone numbers, delivery addresses, staff bank details, ID copies, purchase history. Holding this data is a responsibility. If it leaks, people can be cheated, embarrassed or harmed, and the business loses trust. Data protection is not only a legal topic. It is everyday handling: what you collect, where you keep it, who can see it and when you delete it.
Start with data minimisation
Data minimisation means collecting and keeping only what you genuinely need for a clear purpose. If you only need a phone number to confirm a delivery, do not also ask for date of birth. If you need to verify identity, check the document and record that it was checked, rather than storing a full copy unless there is a real business or legal need. Less data means less to protect, less to lose and fewer awkward questions later.
A simple classification your team can remember
- Public: information meant for anyone, such as your website content, published prices or brochure.
- Internal: everyday business information that is not for outsiders, such as staff rosters or internal notes.
- Confidential: information that could cause harm or loss if leaked, such as customer lists, pricing agreements, staff salaries and contracts.
- Restricted or sensitive personal data: identity documents, bank and payment details, health information and similar. Only a few named people should access this.
Handle data safely through its life
- 1Collect: ask only for what you need and tell people why you are collecting it.
- 2Store: use approved business systems with access control, not personal phones, personal email or random pen drives.
- 3Access: give access by role. Remove access when someone changes role or leaves.
- 4Share: use approved methods, send only the fields needed, and check the recipient before sending.
- 5Retain: decide how long each type of data is needed, and review it on a schedule.
- 6Dispose: delete securely when no longer needed, including old exports, printouts and copies in download folders.
Practical business example
The clinic's appointment spreadsheet
Kavya manages the front desk at Sunrise Physio Clinic in Pune. Over three years, the appointment spreadsheet grew to include patient names, phone numbers, addresses, ID numbers and short notes about injuries. Every receptionist had a copy on their own laptop, and two former staff still had the file in their email. When a new partner, Dr Arvind Rao, reviewed the setup, he asked a simple question: why do we need ID numbers and full addresses for appointments? The answer was that nobody had ever decided. The clinic moved appointments into one access-controlled system, stopped collecting ID numbers for routine bookings, kept treatment notes only in the clinical record, and asked former staff to delete old copies. They also agreed to review and delete inactive records on a fixed schedule.
The lesson: Data collected 'just in case' and copied to many places creates risk without benefit. Deciding purpose, owner and retention made the clinic safer and simpler to run.
Key takeaways
- Collect only the personal data you need, for a clear purpose.
- Label information as public, internal, confidential or restricted, and handle it accordingly.
- Keep one controlled copy in an approved system; clean up exports, downloads and personal copies.
- Do not paste personal or confidential data into unapproved online or AI tools.
- Understand the DPDP Act at a general level and verify current requirements with official sources or an adviser.
Scenario lab · +25 XP
The quick summary
Neha works in sales at Greenleaf Organics, a small food brand. Her manager wants a quick summary of last quarter's customer complaints. Neha has a spreadsheet with customer names, phone numbers, addresses and complaint details. She finds a free online summarisation tool and is about to paste the whole sheet in.
Fictional scenario. Never enter real passwords, OTPs or customer details anywhere in this course.
Decision 1 of 2
What should Neha do before using the tool?
Knowledge check · +20 XP on mastery
Check your understanding
Practical action · +40 XP (self-reported)
Map one dataset
Pick one important set of data, such as your customer list or staff records. Describe it without copying any real records into your notes.
- 1.Write down what the dataset is for and who owns it.
- 2.Classify it: public, internal, confidential or restricted.
- 3.List who can access it today, and mark anyone who no longer needs access.
- 4.Note where it is stored, including exports, backups and copies on phones or laptops.
- 5.Decide a retention period and a date to review and delete old records.
- 6.Remove one unnecessary field or one unnecessary copy this week.
Do this in your own records. Don’t enter passwords, OTPs, customer data or incident details here.
Mission status: Not started
A mission is complete when you have read the lesson, answered the knowledge check and acknowledged the practical action. Mastery means scoring at least 3 of 4 on the knowledge check.
View my progress