When it comes to protecting data, small businesses often set themselves up for unnecessary trouble because they overreach the type and amount of data they collect from their clients and potential customers.

As part of National Cyber Security Awareness Month, our blog Are You Really Going to Use That? came out on the 360 Cyber Security blog, and we thought you might like to check it out.

Talking with small business owners, all too often I find that they have an authoritarian mentality in regards to their customers, as in: “the more customer data I have, the greater control I have over them!” This is particularly true of online businesses, where customers (and their money) are hidden behind the virtual invisibility of the Internet. (I intentionally do not use the word anonymous, because the Internet is anything but anonymous!) The thinking being that more data/information will hopefully translate to more opportunities to monetize all those contacts.

The desire to create ties that bind is understandable, but is it even effective in today’s online world of permission marketing (i.e. where customers and potential clients sign up to receive specific email notifications from businesses they like, in the hopes of minimizing unsolicited spam from brands and organizations they don’t care about)?

I don’t know about you, but I don’t consider my home address, or even my date of birth, as an appropriate cost to receive an email telling me a new blog is up. Why isn’t an email address – entered twice, to make sure it’s correct – enough to ensure that I’ll get the latest news and offers from Acme Widget Company?

Given all the options available online to customers today, why do some businesses still think it is acceptable to require potential customers to create password-protected accounts just to read a blog? While undoubtedly interesting, is the information being shared in the blog so sensitive or valuable that I have to create another password-protected account to read it? That’s not a hypothetical question. If it’s the information in your blog that you’re charging for – i.e. that’s your product – then by all means go ahead and tie it to private accounts. But, if your blog is basically a marketing tool, then don’t do it.

But beyond the annoyance factor – which is no small thing – the issue of security is much greater.

The frequent news of cyber attacks on huge corporations is a strong reminder to all businesses that they are responsible for all customer data that they ask for. Businesses sometimes downplay the threat to their small business and neglect important aspects of Internet security because they think their business is under the radar of hackers. In reality, there is no under the radar for bad guys.

Let’s take a look at 5 best practices for taking care of customer data:

1. Have a privacy policy. In addition to informing your customers that they can trust you with their data…

Read the rest at 360 Cyber Security blog.