# Know what customer data you keep and who can see it Version 1.1 ยท Kramaniti Kosh > How to use this file: fill in the Working template section below. It opens in any text editor, or you can paste the whole file into ChatGPT, Claude or Gemini and ask it to help you fill it in for your business. ## Intended outcome A one-page map of the personal details your business keeps about customers: what each kind is, where it lives, who can see it, which AI tools or outside apps touch it, and when it gets deleted, with a named owner and a review date. It gives you and your lawyer a clear starting point for India's data protection rules, instead of guessing. ## Before you begin - A list of every place customer details are kept today: billing software, WhatsApp phones, spreadsheets, email inboxes, paper registers, booking apps, shared drives - The names of everyone who can open each of those places, including part-time staff, family members and outside vendors - A list of the AI tools and outside apps your team uses with customer information, even occasionally (chat assistants, transcription, form builders, marketing tools) - One person who will own the map and keep it current ## How to use 1. Walk through a normal day with the people who handle customers. Write down each kind of customer detail they collect or look up, and where it ends up. Include the copies nobody planned, like screenshots on personal phones or files forwarded on WhatsApp. 2. Fill in one row per kind of data in the map below. Where you do not know an answer, write "not known" and add it to the open questions. Do not guess. 3. Mark anything that looks risky, such as health details on a personal phone or customer files pasted into a free AI tool. Take the open questions and risky rows to a lawyer who works on data protection before you change contracts, notices or consent forms. ## Working template ## Map header Business: Map owner: Backup owner: Date filled in: Next review date: Who helped fill it in: ## The data map Copy this block once for each kind of customer detail you keep. Kind of data (for example name and phone, address, ID proof, health or test details, payment details, photos): - Why we collect it (in one plain line): - Where it is kept (every place, including phones and paper): - Who can see or change it (by name or role): - Outside apps or vendors that hold a copy: - AI tools that see it, and what for: - How long we keep it, and who deletes it: - What the customer is told when we collect it: - Risky or unclear (yes or no, and why): ## AI tools and outside apps For each tool or app that touches customer data: - Tool or app: - Which kinds of data go into it: - Who uses it: - Paid business account or free personal account: - Have we read what it does with the data we put in (yes, no, not sure): - Allowed for customer data (yes, no, only with details removed): ## When a customer asks - Who handles a customer asking what data we hold about them: - Who handles a request to correct or delete their details: - Where those requests are recorded: ## If something goes wrong What counts as a problem (a lost phone with customer chats, a file sent to the wrong person, a leaked sheet): Who must be told straight away: Who decides what to tell customers and any authority, after taking legal advice: Where it is recorded: ## Open questions for our lawyer - - - ## Owner and review Named owner for this map: Review date: Change that triggers an early review (a new app, a new branch, a new AI tool, a staff member leaving): ## Stop rules - Do not paste health, ID or payment details into any AI tool that is not on the allowed list above. - If you do not know where a kind of data lives or who can see it, write "not known" and add it to the open questions. Do not fill gaps with guesses. - This map is not legal advice. Do not rewrite consent forms, privacy notices or vendor contracts from it alone; take it to a lawyer first. - When a staff member leaves, check their access in every place on the map that week. - Do not record deadlines or legal duties in the map unless they come from a lawyer or the official text, with the source written next to them. ## Demonstration This is an illustrative scenario, not a client case study or a measured result. Do not reuse its details as facts about your work. A sample diagnostic lab with two branches in Bengaluru collects patient names, phone numbers, ages, doctor referrals and test results. Reports go out on WhatsApp and email. The owner has heard about the new data protection rules and wants to know, before speaking to a lawyer, what the lab actually keeps and where. ### Sample inputs Demonstration inputs only. No patient numbers, volumes or dates are used. From a walk-through with the front desk at each branch and the lab manager: patient details are entered in the lab software; front desk staff also save patient numbers on the branch WhatsApp phone to send reports; home collection staff photograph prescriptions on their own phones; a part-time accountant sees invoices with patient names; one staff member sometimes pastes report summaries into a free AI chat tool to write plain-language explanations. ### Example output #### Map header [Fact within this demonstration] Map owner: [Name the lab manager]. Backup: [Name the owner]. Filled in with both front desks and the home collection lead. #### The data map Test results: kept in the lab software and sent as PDFs on WhatsApp and email. Seen by technicians, the pathologist and front desk staff. Copies also sit in the WhatsApp phone's chat history at each branch. How long they are kept: not known. Risky: yes, health details on shared phones. Prescription photos: kept on home collection staff's personal phones. Seen by the staff member who took them. Deleted: not known. Risky: yes. Names on invoices: seen by the part-time accountant through the billing export. Risky: unclear, added to open questions. #### AI tools and outside apps [Fact within this demonstration] A free AI chat tool is used by one staff member with report summaries. Business account: no. Allowed for customer data: no, until the owner decides otherwise. [Inference] The free tool row matters most because health details are leaving the lab's own systems, not because it happens often. How often it happens has not been measured here. #### Open questions for our lawyer How long the lab must or may keep test results and prescriptions. What patients should be told when they give their number for WhatsApp reports. What the lab needs from the software vendor and the accountant in writing. #### Stop rules applied [Recommendation] Stop pasting report details into the free AI tool now, move prescription photos off personal phones into the lab software, and take the open questions to a lawyer before changing any forms. This recommendation is not the business's decision. ## Quality check Every kind of customer data has a row; every row names where it lives and who can see it, including phones, paper and outside vendors; every AI tool that touches customer data is listed with whether it is allowed; unknowns are written as "not known", not guessed; risky rows are marked; the map has a named owner, a backup and a review date; no legal duty or deadline appears without a source. ## Limits and human review The map shows what customer data you keep and who can reach it; it does not give legal advice, tell you which data protection duties apply to your business or from when, or make you compliant with any law. Take it to a lawyer who works on data protection before changing consent forms, notices, contracts or how long you keep data. A filled map is not approval to collect, share, move or delete customer data. Keep consequential actions with the named human owner. ## Edition notes New in Kosh at version 1.1. Provider-neutral Markdown instructions; no installation or platform compatibility is implied. Runtime behaviour has not been verified across AI providers. Reuse terms have not yet been published. Background reading: [The Smallest Useful AI Policy Is a Workflow Note](/insights/the-smallest-useful-ai-policy-is-a-workflow-note/). Finding where customer data and AI tools meet in your daily work is part of Kramaniti's [Foundation Strategy audit](/audit/).