Foundation · 2 min
What you need to know
How do I know what customer data my ecommerce store holds?
Build a data inventory from forms, database fields, events, apps, exports, logs, support systems and backups, then verify it with system owners and technical observation.
What is a data inventory?
A data inventory records data categories, subjects, purposes, sources, systems, recipients, locations, access, retention and deletion methods.
Where can ecommerce customer data exist?
Customer data can exist in storefront and order databases, payment and shipping services, CRM, email, SMS, analytics, support, logs, exports, devices, apps and backups.
Should app and plugin data be included in a data inventory?
Yes. Apps and plugins may hold independent copies and create derived data. Include their fields, purpose, location, retention, access and deletion process.
Should backups be included when considering customer-data retention?
Yes. Backups affect how long data remains recoverable and how deletion is handled after restoration. Document protection, retention, and reapplication of deletions.
How should customer data flowing to external services be documented?
Record the source, destination provider, data fields, purpose, trigger, location, legal or contractual basis, retention, security and responsible owner.
A quick store check
Trace one customer from checkout through email, support, analytics, apps, exports and backups and add every destination to the inventory.
Foundation · 2 min
Frequently asked questions
Can a spreadsheet export be omitted from the inventory?
No. Ad hoc exports are often high-risk copies and need ownership, protection, retention and deletion rules.
Who updates the inventory after a new app launches?
Assign the product or data owner and make inventory review part of the launch checklist.