Client data on your team's personal phones

In most small service businesses, a good deal of client contact happens on a phone somebody bought themselves. Photos of the work, WhatsApp threads about appointments, client numbers saved in personal contacts, a note of somebody's address in the notes app.

It is convenient, it is how the work actually gets done, and it quietly creates two problems that only ever surface at the worst possible moment.

The two problems

The first is data protection. You are the controller of that client data regardless of whose phone it sits on. If you cannot say where it is, who can see it or how it would be deleted, then you cannot meet the obligations you already have.

The second is commercial. A client list living in a stylist's personal contacts is a client list that leaves with the stylist. This is not a hypothetical and it is not usually malicious. Nobody deletes their own contacts when they change job.

What good looks like without being unreasonable

Banning personal phones outright does not work in a business with three people and no company handsets. The realistic goal is that work data lives in the work system and personal devices are a window onto it rather than a copy of it.

• Client contact happens through the business, not from a personal number. Business messaging, a business WhatsApp or the system that already holds the booking.
• Client numbers are not saved into personal contacts. If somebody needs to ring a client, they should be doing it from a record rather than from their address book.
• Photos of work go straight into the client record or the business account, then off the camera roll. This also solves the consent question, because the permission and the photo end up in the same place.
• Anybody accessing the system on their own phone does it through an account with a password, two factor authentication and permissions limited to their role.
• Screen lock and remote wipe are non negotiable on any device that touches client data.

Write two short things down

A one page policy saying what is and is not allowed on a personal device. It does not need to be long. It needs to exist, be signed and be understood, because "we assumed everyone knew" is not a defence.

A leaver checklist. Revoke system access the same day, not at the end of the month. Remove them from group chats. Ask them to confirm in writing that they have deleted client data from personal devices and contacts. Change any shared password, because shared passwords always exist even in businesses that say they do not.

The one that catches everybody out

Group chats. A WhatsApp group with the team in it, where client names, conditions, addresses and complaints get discussed, is a data processing activity nobody has assessed, sitting on devices you do not control, with a full history visible to anybody added later.

It is also very hard to delete. If a client asks you to erase what you hold about them, a five year team chat is not something you can honestly say you have dealt with.

Move operational chat to somewhere with records, roles and the ability to remove a person and their access. Keep the team group for arranging who is bringing the biscuits.

The uncomfortable question worth asking

If your most experienced member of staff left tomorrow and took their phone with them, how much of your client base would go with it and could you truthfully tell those clients you still control their data?

If the answer is uncomfortable, the fix is not a difficult conversation with a colleague. It is a system where the client belongs to the business, everybody can do their job through it and nobody needs to keep a private copy in order to work.

None of this is legal advice, and a business with employees should get the employment side of any device policy checked.