Every time a customer fills in a contact form, requests a quotation, creates an account, or places an order, they may be sharing information they expect your business to handle responsibly.
It could be as simple as a name and phone number. It might include an email address, a delivery location, details about a project, or information connected to a purchase.
For a business, collecting these details can make it easier to respond to enquiries, fulfil orders, and maintain customer relationships. But collecting information also creates a responsibility: you need to understand what you are gathering, why you need it, who can access it, and how it will be protected.
Many businesses concentrate on how their website looks and functions without giving the same attention to what happens after a visitor submits a form. The information may be sent to an inbox, stored in a website database, copied into a spreadsheet, or passed to another service. If nobody understands that process, customer details can end up in places where they are unnecessarily exposed or difficult to manage.
This is not a concern reserved for banks, hospitals, or large technology companies. Even a small business website can collect personal information that deserves appropriate protection.
Understanding how to manage that information is an important part of running a professional online business.
Your Website May Collect More Information Than You Realise
When people think about customer information, they often think about online shops storing names, addresses, and order details. However, personal information can be collected through much simpler website features.
A contact form may request a name, email address, phone number, and message. A quotation form might ask for a company name, project requirements, budget, and preferred contact time. A booking system may collect appointment details, while a newsletter form gathers email addresses for future communications.
Some websites also use analytics tools, customer relationship management systems, live chat services, and other integrations that process information about visitors.
The important point is that information collection does not begin only when a customer creates an account or pays online.
Consider a business that offers office cleaning services. Its enquiry form asks visitors to provide their names, company details, office locations, phone numbers, and descriptions of their cleaning requirements.
Those details help the company prepare quotations and follow up with prospective clients. However, they may also reveal information about a customer’s workplace, operations, or business arrangements.
The business should therefore understand what information it genuinely needs and ensure that the details submitted through the website reach the appropriate people.
You do not need to remove every form or stop collecting useful information. You need to make deliberate decisions about what you collect and how you manage it.
Only Ask Customers for Information Your Business Actually Needs
One of the simplest ways to reduce information-related risk is to avoid collecting unnecessary details.
Some website forms ask for far more information than is required for the task. A customer who wants to request a basic service enquiry may be asked for their full address, date of birth, company size, and several other details before they can submit the form.
Every additional field gives the business another piece of information to manage. It can also make the form feel unnecessarily intrusive and discourage people from completing it.
Start by reviewing the purpose of each form field.
| Website feature | Information that may be sufficient | Information to reconsider |
|---|---|---|
| General contact form | Name, preferred contact method, and message | Personal details unrelated to the enquiry |
| Service quotation request | Contact details and a description of the required service | Sensitive documents before they are necessary |
| Newsletter registration | Email address and any genuinely necessary preferences | Additional personal details with no clear purpose |
| Appointment booking | Contact details and relevant booking information | Information unrelated to scheduling the appointment |
| Online order | Details necessary to process and deliver the purchase | Information that is not required for fulfilment |
These are general examples, not fixed requirements for every business. The appropriate fields depend on what the website needs to accomplish.
For instance, a delivery service may genuinely need a delivery address, while a business providing remote consultations may not need one at the initial enquiry stage.
Ask whether each field serves a clear purpose. If the information is unnecessary, remove it. If it is useful but not essential, consider whether it can be optional or requested later.
A shorter, more focused form can make the customer experience easier while reducing the amount of information your business must manage.
Make It Clear Why You Are Asking for Customer Details
Customers should not have to guess why a website is requesting their information.
A simple explanation near a form can help visitors understand what happens after they submit it. For example, a quotation form might explain that the information will be used to assess the request and contact the customer about the proposed service.
A newsletter registration form should explain that the person is signing up to receive marketing or informational emails. Signing up for a newsletter should not be treated as automatic permission to receive unrelated marketing simply because someone submitted a general enquiry.
Your website should also provide accessible privacy information explaining how personal data is handled. The details required will depend on the applicable law, the nature of the data, and how your business uses it.
For Nigerian businesses, the Nigeria Data Protection Act 2023 and guidance from the Nigeria Data Protection Commission are important reference points when assessing relevant obligations. Requirements can vary according to the circumstances, so a qualified privacy professional may be needed for advice specific to your business.
A privacy notice should reflect what actually happens to the information. Publishing a generic policy without checking the website’s forms, integrations, and processes does not ensure that the business is handling information appropriately.
The principle is straightforward: explain your practices honestly, collect information for clear purposes, and make the relevant privacy information easy to find.
Know Where Website Enquiries Go After Submission
When a visitor clicks the Submit button, the information does not necessarily remain in one place.
Depending on how the website is configured, a submission may be emailed to a member of staff, stored in the website’s database, forwarded to a customer management system, or sent to another service.
This matters because the security and accessibility of that information depend partly on the systems and people involved.
Imagine a company whose contact form sends every enquiry to a shared email account. Several employees can access the inbox, and one former staff member still has access through an old account.
The form itself may work perfectly, but the business has an access-management problem.
Another company may copy every enquiry into a spreadsheet that is shared with more people than necessary. A third may use several connected services without knowing which ones retain customer information.
To understand your website’s information flow, ask the person managing it to explain:
- Where form submissions are delivered or stored.
- Which staff members can access them.
- Whether third-party tools receive copies.
- How long enquiries are retained.
- How access is removed when an employee or contractor no longer needs it.
You do not need to understand every technical detail. You should, however, know enough to ensure that customer information is not being handled without clear ownership and appropriate safeguards.
Restrict Access to the People Who Need It
Not every employee needs access to every piece of customer information.
A member of the sales team may need to review new enquiries, while a developer may need administrative access to maintain the website. Someone responsible for social media may not need access to the website’s customer database at all.
Giving people access according to their responsibilities helps limit unnecessary exposure.
This principle is often called least-privilege access: people should receive only the permissions they need to perform their work.
For businesses using WordPress, this means choosing user roles carefully rather than giving every staff member full administrator privileges. The same approach applies to email accounts, customer management tools, spreadsheets, and other services that receive website submissions.
Good access management also includes individual accounts, strong passwords, and multi-factor authentication where available.
Avoid sharing one administrator login among an entire team. Individual accounts make it easier to identify who has access and remove permissions when responsibilities change.
If an external developer or agency manages the website, agree on what access is required for the work and how that access will be managed afterwards.
These measures do not eliminate every security risk, but they help reduce the number of people and accounts that could expose customer information unnecessarily.
Protect the Journey From the Customer’s Browser to Your Business
Customer information can pass through several systems before it reaches the person responsible for responding.
The website should use HTTPS so information transmitted between the visitor’s browser and the website is encrypted in transit. However, HTTPS is only one part of protecting information. It does not automatically secure the website’s database, email accounts, staff devices, or connected services.
Other safeguards may include maintaining website software, securing administrator accounts, validating submitted information, and ensuring that connected services are configured appropriately.
The right controls depend on the website’s functionality and the sensitivity of the information it handles.
A basic contact form may require a different level of protection from a customer portal that stores confidential documents or detailed account information.
Businesses should also avoid encouraging customers to submit passwords, payment card details, identity documents, or other sensitive information through a general enquiry form when a more appropriate secure process is available.
If a website accepts payments, use a suitable payment provider and understand how payment information is handled. Do not store sensitive payment details simply for convenience.
When a developer recommends a new form, plugin, integration, or customer portal, ask what information it will collect and how that information will be protected.
Security should be considered when the feature is planned, not only after the website has launched.
Decide How Long Customer Information Should Be Kept
Businesses sometimes retain customer enquiries indefinitely because deleting them feels unnecessary or nobody has established a process for doing so.
Over time, the business may accumulate old enquiries, duplicate spreadsheets, outdated customer records, and information that no longer serves a legitimate purpose.
Keeping information indefinitely can increase the amount of data that needs to be protected and make it harder to manage records accurately.
A better approach is to establish appropriate retention practices based on the purpose of the information, relevant business needs, and applicable legal requirements.
For example, an unanswered enquiry may need to be retained long enough for the business to respond and follow up. A completed transaction may require records to be kept for accounting, contractual, or other legal purposes.
These situations should not automatically have the same retention period.
Your business should identify which records it needs to retain, why they are needed, and when they should be reviewed or deleted. If information must be kept for a legal or regulatory reason, that requirement should be considered before removing it.
Also remember that deleting a record from one location may not remove copies held in email archives, spreadsheets, connected systems, or other storage locations.
The process should reflect how your website and business tools actually work.
Customer Information Should Not Automatically Become Marketing Data
A customer who contacts your business is not necessarily asking to receive promotional messages.
Someone might submit a form to request a quotation, ask about a product, or clarify your opening hours. Adding that person’s details to a marketing list without an appropriate basis can undermine trust and may conflict with applicable privacy or electronic marketing requirements.
Keep service enquiries separate from marketing subscriptions unless you have established a suitable and transparent way to handle both.
If you offer a newsletter, explain what people are signing up for and use an appropriate opt-in process where required. Do not hide marketing permission inside unrelated terms or assume that providing a phone number automatically authorises promotional messages through every channel.
Your business should also provide a suitable way for subscribers to stop receiving marketing communications, in line with the requirements that apply to your activities.
Respecting customer preferences is not merely a technical or legal exercise. It helps demonstrate that your business values the relationship rather than treating every enquiry as permission to send unlimited promotions.
Be Prepared to Respond if Information Is Exposed
Even businesses that take security seriously can experience incidents.
A staff email account might be compromised, an incorrectly configured system might expose information, or a website vulnerability might allow unauthorised access. The appropriate response depends on what happened, what information may be affected, and which legal or contractual obligations apply.
The worst time to decide who should handle such an incident is after it has occurred.
Businesses should know who is responsible for investigating a suspected exposure, contacting relevant service providers, securing affected accounts, and determining what action is required.
If you suspect that customer information has been exposed, avoid deleting evidence or making uncoordinated changes that could complicate the investigation. Contact the responsible technical professional or service provider promptly, take appropriate steps to limit further access, and obtain qualified advice about any notification obligations.
Do not assume that every technical issue constitutes a confirmed data breach. Equally, do not dismiss a credible warning simply because the website still appears to work.
A prepared response process can help the business investigate the situation, limit further harm, and fulfil its responsibilities.
Questions to Ask Your Website Developer or Maintenance Provider
If DHNigeria or another professional manages your website, you do not need to handle every security setting personally. You should still understand how the website collects and processes customer information.
During development or a maintenance review, consider asking:
- What personal information does the website collect through its forms and other features?
- Where do submissions go, and who can access them?
- Is the website using HTTPS correctly?
- Are third-party services receiving customer information?
- Can unnecessary form fields be removed?
- How are website administrator accounts and permissions managed?
- What is the process for handling old enquiries and removing information when appropriate?
- Who should be contacted if suspicious activity or a possible data exposure is discovered?
These questions help establish clear responsibilities without requiring you to become a developer.
For businesses building more complex systems, such as customer portals, online stores, or platforms that process sensitive information, a more detailed technical and privacy assessment may be appropriate.
The goal is to ensure that the website’s features, security measures, and information-handling practices fit the needs of the business.
Protecting Customer Information Is Part of Earning Trust
A website gives customers a convenient way to interact with your business, but every form and digital service that collects personal details creates a responsibility to manage that information appropriately.
Start with the basics: collect only what you need, explain how information will be used, restrict access, secure the systems involved, and establish sensible retention practices. Review the process whenever you introduce a new form, plugin, integration, or service that changes how information is handled.
These actions will not eliminate every risk or automatically guarantee legal compliance. They can, however, help your business understand its responsibilities and reduce avoidable exposure.
At DHNigeria, we help businesses establish and develop their online presence through domain registration, web hosting, and website design and development.
If you are planning a new website or improving an existing one, consider information handling as part of the project from the beginning. A professional website should not only make it easy for customers to contact you; it should also support responsible management of the information they choose to share.
Useful DHNigeria links
- Visit DHNigeria to explore our domain, hosting, and website services.
- Explore DHNigeria Web Hosting to review our hosting options.
- Contact DHNigeria through our website to discuss your website requirements.
For privacy-related guidance, you can also consult the Nigeria Data Protection Commission for official information about data protection in Nigeria.
