Many companies struggle with even basic sensitive information handling. One screaming example I can give is the attack on TalkTalk's servers resulted as 4 millions customer's personal information being exposed. Definitely a not good situation to be at.

My question is - what are the best practises for startups to handle personal information. Do you think startup should handle their customers information themselves or they should outsource it? Are there any good cloud services offering data storage/encryption. Startups are always looking to cut expenses so I'd be happy to check any service that are offering some free trails/dev packages. Thank you!

  • 3
    This is far too broad to be reasonably answerable on a Q&A site. A proper answer would fill a book, possibly more than one. – Robert Harvey Mar 19 '16 at 16:29
  • That said, this might be a good place to start. See also here. – Robert Harvey Mar 19 '16 at 16:42
  • 1
    The people over at StackExchange's startups may be interested in this same question: startups.stackexchange.com – Baronz Mar 19 '16 at 16:54
  • TalkTalk handled all customers' information with all the legally necessary care. Which doesn't include any encryption. That's what their CEO says. – gnasher729 Mar 20 '16 at 20:44

Its not as daunting as it may seem. After all the law doesnt expect systems to be unhackable. The expectation is that you show care with other peoples data. This is normally handled with a policy document and someone to sign off that new developments follow it

1: define what data is personal (read the law)

2: Dont collect it unless you need it

3: Write down why you need it and how long you need it for

4: Tell the customer why you need it and ask them to confirm its ok

5: encrypt it

6: delete it when you are done


Third party services can offer you some plug and play solutions for example payments or authentication via facebook etc.

But when it comes to simple customer data like names and addresses you have to consider that sending to third parties is exactly the kimd of thing people dont want you to do with it.

If you need the data to run your business then you are probably better off with your own database. If you dont need the data, just dont ask for it.

I guess most internet startups these days will be looking at getting a high valuation based on the number of users and potential leverage of the data you hold on the users.

This unfortunately puts you in direct opposition to the spirit of data protection laws and limits your use of third parties.

I dont think this problem has been solved yet, esp. When you consider the age of your users may prevent them from legally agreeing to your tncs

| improve this answer | |
  • Thanks, Ewan. These are definitely some sensible points that you've mentioned there. Do you know any third party services that offer encryption/storage for sensitive data? I think we may be better of outsourcing this to experts rather than implementing it ourselves. – Anton Belev Mar 20 '16 at 11:44
  • @AntonBelev if you feel like you don't have the skill set to do it right, then you're probably right. The most useful business advice I ever received was "Know what you're good at, and do it better than anyone else. Pay someone else to do the things you're not good at. " – RubberDuck Mar 20 '16 at 11:59

A very broad question indeed, especially when considering the many different data protection laws around the world.

There are three sides to this question:

  • legal: what's the law of your country ? Do you have users abroad, for which some restrictive dataprotection laws may apply (requiring safe harbor, etc...) ? Can you cope with it in your terms of refence. Here, qualified legal advise is strongly recommended.

  • managerial: what are the risk for your startup ? Can some risk be transferred ? Here typically, for payment information, it's highly recommended to transfer the risk to banks, which offer payment services and are used to deal with the complex related security issues.

  • technical: the best approach is to keep no user data. No risk... No fun ? For this hire a security expert: it's useless to encrypt personal data, if a hacker can install some backdoor on your system and intercept livestreams. Of course, hosting companies can offer you more or less security, but they are only responsible for the things they can master: they can certainly not be held responsible for security flaws in your app.

| improve this answer | |

Not the answer you're looking for? Browse other questions tagged or ask your own question.