You’re Storing Customer Data You Should Have Deleted

The folder nobody has opened since 2019

Every small business I audit has one. A shared drive folder called Scans, or Old Stuff, or Client Docs Backup. Inside are photos of driver licenses, a spreadsheet with full card numbers from before you switched processors, tax forms for employees who left years ago, and about four thousand PDFs nobody has touched since the last presidential election.

You do not need any of it. But you are still fully responsible for all of it.

That is the ugly part of data. It does not sit there neutral. Every record you keep past its usefulness is a record you have to protect, and a record that shows up in the breach notification letter if somebody gets in.

Why old data is worse than no data

Think of it like cash in the register. You would not leave twelve years of receipts and float in the drawer overnight. You take the deposit and you keep what you need for tomorrow.

Data works the same way, except most owners never make the deposit. Here is what those old files actually cost you:

They expand the breach. A hacker who gets into your file share does not steal your active clients only. They take the whole folder. Five hundred old records means five hundred more notification letters, and the size of a breach drives the cost of it.
They trigger legal duties you did not plan for. Florida law gives you 30 days to notify affected people after you determine a breach happened, and if 500 or more Floridians are involved you also notify the Department of Legal Affairs. That clock does not care whether the records were current.
They complicate insurance. Cyber policies ask what data you hold and how long you keep it. Answering that question honestly is hard when you have no idea what is in the closet.
They cost you goodwill. Telling a client from 2018 that their scanned license was stolen from you is a conversation with no good ending.

Where this stuff actually hides

Cleaning the main shared drive is the obvious part. The copies are what get you.

Email. This is the big one. Years of attachments with W-9s, voided checks, and signed contracts, all sitting in a mailbox with a password somebody reused.
The Downloads folder on every computer. Nobody ever cleans it. Every document anyone opened from email is still there.
Old exports. Somebody pulled a full customer list out of the CRM to make a mailing once. That CSV is now on a desktop, in a Dropbox, and in a sent email.
Your website. Contact and intake forms often store every submission in the site database forever, including whatever people typed into a comment box.
Text messages and chat. Clients send sensitive documents by text now. Those live on the phone and in the backup of the phone.
Retired hardware. The laptop in the closet, the old phone in a drawer, the copier that leased out with a hard drive inside it.

How long should you actually keep things?

I am not your accountant or your attorney, and the specifics depend on your industry, so ask them for the real schedule. But here is the general shape most small businesses land on:

Tax and financial records: commonly 7 years. Ask your CPA for your situation.
Employee files: varies by record type and several years past separation. Your HR advisor or attorney sets this one.
Signed contracts: usually kept for the life of the agreement plus a statute of limitations buffer.
Payment card numbers: you should not be storing full card numbers at all. Your processor holds them. If a full number is sitting in a spreadsheet or an email, that is the first thing to kill.
Copies of IDs, Social Security numbers, and bank details: keep only if a law requires it, and only in one controlled place. Never in email.
Marketing lists and old quotes: these have almost no shelf life. Prune aggressively.

The rule underneath all of it is simple. Keep what a law or a real business need requires. Delete the rest on a schedule instead of never.

The cleanup, in four steps

1. Find it

Search your file shares and your email for the obvious patterns. Terms like SSN, social security, routing number, drivers license, W-9, and voided check will surface a shocking amount in about twenty minutes. Microsoft 365 has content search built in if you are on a business plan.

2. Decide, then write it down

Sort what you find into keep, archive, and delete. Then write a one page retention policy that says what you keep and for how long. One page. It does not need to be a legal document, it needs to exist so the decision is not remade every time.

3. Delete for real

Deleted is not deleted until it clears the recycle bin, the cloud trash, and the backups you cannot reach. For physical media, wipe drives properly or destroy them. For paper, shred it, do not toss it in the dumpster behind the plaza.

4. Stop the flow at the source

This is the step that makes it stick. Quit collecting what you do not need. Take the Social Security field off your intake form. Tell clients to upload sensitive documents to a secure portal instead of texting them. Turn on retention policies in Microsoft 365 so old mail expires on its own. Set the CRM to purge dead leads after a set period.

Otherwise you will do this whole cleanup again in three years.

What this means for you

Data you do not have cannot be stolen from you. That is the entire strategy, and it is free. An afternoon of honest searching and deleting shrinks your risk more than most security products you could buy this quarter.

If you want help finding where sensitive data is sitting across your email, your file shares, and your website, that is part of what we do for clients from Delray Beach to West Palm Beach. We will map it, help you set a retention policy you can live with, and make sure the delete actually deletes. Always happy to troubleshoot.