Charting the Sprawl: How UK SMEs Can Map Where Customer Data Really Sits

The question nobody can answer quickly

Ask a managing director where the company holds customer data and the reply will usually be a room, a supplier or a product name. Ask the same question about which countries that data reaches, and the answer becomes vaguer. In practice, a typical small firm now runs enquiries through a website form, records them in a customer relationship platform, processes orders in an accounts package, handles support in a ticketing tool, sends campaigns through a marketing suite, and pays staff through a payroll service. Each of those is a separate processing relationship with separate hosting arrangements.

None of this is unlawful or reckless. It is simply what happens when software is bought by different people at different times for different reasons. The difficulty is that the organisation is accountable for the whole picture, and accountability tends to be tested at the least convenient moment: a customer request, a supplier breach, or an enquiry from a regulator.

Why a map beats a policy document

A privacy notice tells the outside world what you intend. A residency map tells you what is actually true. The two are rarely identical, and the gap is where risk accumulates.

The purpose of the exercise is not to eliminate overseas processing. Under UK data protection law, transfers outside the country are permitted where an appropriate safeguard is in place, whether that is an adequacy regulation, the International Data Transfer Agreement, or the UK Addendum to the standard contractual clauses. What is required is that the transfer is identified, documented and justified rather than discovered later.

A single spreadsheet, maintained by one named owner, will do more for a growing business than a lengthy policy that nobody has read since it was signed.

Step one: find the systems

Start with evidence rather than memory. Good sources include the single sign-on directory, which usually lists every application employees actually use; the company card statement, which reveals subscriptions bought without IT involvement; finance software, for anything invoiced annually; and browser bookmarks on shared machines.

For each system, record four things immediately: who owns it internally, what business function it serves, which categories of personal data it holds, and whether it is genuinely necessary. That last column is usually the most productive. Most firms find at least one tool holding customer records that nobody has logged into for a year, and the cleanest way to reduce residency risk is to stop creating it.

Step two: the columns that do the work

A workable map needs more than a list of suppliers. Add these fields, and the spreadsheet becomes a decision tool:

• Primary hosting region. Where data is stored at rest, not where the supplier is headquartered. A European region is not the same as a UK region, and a supplier with a London office may still host in Virginia.
• Processing locations. Where data is accessed from, including support staff and engineering teams. Remote access from another country is a transfer even when the server never moves.
• Backups and disaster recovery. These are frequently held in a different region from the primary service and are easy to overlook.
• Subcontractors. Most platforms rely on a chain of providers for hosting, email delivery, analytics and support. The list changes, often with notice given by email.
• Transfer mechanism. The specific document relied on, with the date it was signed or accepted.
• Retention and deletion. How long data stays after an account closes, and whether deletion is genuine or merely logical.
• Exit route. Whether data can be exported in a usable format, and at what cost.

Seven columns are enough. A map with thirty columns will be abandoned by the second review.

Step three: understand what the contract actually says

The data processing agreement is where the answers live, but it is usually presented as a link accepted at sign-up. Read it with three questions in mind. First, can the supplier change its subcontractors without consent, and how much notice is given? Second, which transfer mechanism applies, and does it cover every location you have identified? Third, what happens to the data if you leave?

Watch for corporate structure as well. A supplier owned by a parent company in another jurisdiction may be subject to that country's legal demands regardless of where the servers sit. That does not make the supplier unsuitable, but it is a consideration that belongs in the record rather than in a vague assumption.

Step four: ask suppliers plainly

Suppliers respond better to specific questions than to broad ones. A short list, sent by email so that the reply is written down:

• In which countries is our data stored, processed and backed up?
• Which subcontractors handle personal data on your behalf, and how are changes notified?
• Can we pin our account to a UK or European region, and what does that cost?
• Which transfer mechanism is included in our agreement, and when was it last updated?
• How long after termination is data deleted, and can we obtain a full export first?

A supplier that answers clearly and quickly is telling you something useful about how it will behave when a real problem occurs.

Step five: rate the risk and set a review date

Give each system a simple red, amber or green rating based on the sensitivity of the data, the number of countries involved, and how well the terms are documented. Red does not automatically mean replace. It means the arrangement needs a decision recorded, an owner named and a date for review.

Review the map annually and whenever something material changes: a new system, a supplier acquisition, a contract renewal, or a shift to a different hosting region. Log those changes in the same document so that the history is visible.

The exercise takes a competent administrator perhaps two days in the first year and a few hours thereafter. In return, the business can answer a simple question with evidence, which is a considerably better position than answering it with an assurance nobody can substantiate.