Most small businesses have one. It might be called Customers, Bookings or simply Master, and the whole office can reach it on a shared drive. It began as a quick list and now holds names, addresses, phone numbers, order histories and the odd note about who prefers a call after five.
That makes it the firm’s customer database, and in most offices nobody has been asked to look after it. An owner or office manager can put that right in an afternoon, without an IT department, by checking four things: what the file holds and who can open it, what happens when someone leaves, what one mistake can do, and whether the job has outgrown a spreadsheet.
Why a Customer List Is More Than a File
The government’s guidance on data protection for businesses, published on GOV.UK, says the rules apply to any business that stores or uses personal information, and gives keeping customers’ addresses on file as an example. The information has to be kept secure, accurate and up to date, and people can ask to see what is held about them, have it corrected or have it deleted.
None of that depends on the software, so a list in a spreadsheet is covered like any other. What follows is general information, not legal advice, and specific questions are best put to the Information Commissioner’s Office.
Start With What It Holds and Who Can Open It
Read the column headings first. A free-text notes column tends to collect things nobody planned to store, such as a remark about a customer’s health. The principles behind the UK’s data protection legislation, summarised on GOV.UK, give stronger protection to sensitive information of that kind, and they also say personal information should be kept for no longer than is necessary. A tab of people who stopped being customers years ago needs a decision: keep it for a stated reason, or delete it.
Then open the sharing settings and read the list of names. Former staff, a bookkeeper who helped out once and somebody’s personal email address are common finds. Remove anyone who no longer needs the file, and check whether it opens for anyone with the link, since such a link works for whoever it is forwarded to.
Check what each person can do, too. Many people who can edit the list only ever read it, and Excel and Google Sheets both allow view-only sharing.
Check What Happens When Someone Leaves
A spreadsheet created under one person’s account usually belongs to that account. With a personal account, the business has no real control over the file. With a work account, the file can be lost when the account is closed unless somebody transfers it first. Find out who owns it today and move it to a shared company location.
Then there are the copies. A list downloaded to a laptop, attached to an email or exported for a mail-out stops changing when the original does, and soon nobody can say how many versions exist. Agree one home for the list and a rule that nobody keeps a private copy.
Know What One Mistake Can Do
The classic accident is a sort. Someone selects a single column, sorts it from A to Z, and every name now sits beside another customer’s phone number and address. Nothing looks broken, so the error can go unnoticed until an invoice or a parcel reaches the wrong person.
Three small habits limit the damage:
- Find the version history, which Google Sheets and Excel files stored online both keep, and practise restoring an earlier version.
- Lock the header row and any formula cells against accidental overwriting.
- Where a column should hold only a few fixed values, such as an order status, use a drop-down list.
When the File Has Outgrown the Job
These checks make a small list safe enough, but a spreadsheet stays a spreadsheet. Hiding a column is not the same as restricting it, because in most setups anyone who can edit or copy the file can bring it back. When the front desk needs appointment times but not payment notes, or a customer asks to be removed and nobody can say where all the copies are, the file is being asked to do a system’s job.
Moving on does not have to mean commissioning software. The harder decision is which kind of tool should take over from the workbook, because an off-the-shelf customer database with logins and permissions is enough for many small firms, and a purpose-built application only earns its cost when the process is particular to the business. Whichever it is, keep the old file as a read-only record until the new totals have been checked against it.
What to Ask About Whatever Replaces It
The replacement will hold the same personal details, so the supplier should face the same questions before anything is signed. Does each member of staff get their own login, with a second step such as a code from a phone? Can access be removed on the day someone leaves? Is there a record of who viewed, changed or exported a customer’s details? Where is the data stored, and how is it backed up?
One more question repeats the spreadsheet problem in a new form. A common gap among first-time software buyers is account ownership: the team that built the first version holds the hosting or domain accounts, and then leaves. The business should be the named owner of every account from day one.
It helps to know what a good answer sounds like, and a guide written for young software companies explains how sign-in, permissions and encryption should be set up in terms a buyer can turn into questions.
None of this needs a consultant. An afternoon with the sharing settings, the version history and the oldest tab will show most firms whether their customer list is under control or has simply been lucky so far.
