What Customer Information Should My Small Business Collect, and What Should It Skip?

By Bill Stilwell · Last reviewed October 17, 2026

The short answer

Collect only the information you need for a clear, written purpose, and keep it only as long as you need it. The Federal Trade Commission (FTC) says if you don’t have a legitimate business need for sensitive personal information, don’t collect or keep it. That rule applies to your website forms, your intake calls, your customer records, and what you paste into artificial intelligence (AI) tools.

What this means

11.6.1 Data minimization

For every piece of information you collect, you should be able to say why you need it (see 11.5 Data Map). If you can’t, stop collecting it. The FTC also says:

Keep it only as long as you need it. Set a retention period (see 9.8.2 Record Retention Periods).
Don’t use Social Security numbers as customer or employee ID numbers. Use them only where the law requires, like employee tax forms.
Don’t keep card numbers and expiration dates unless you truly need them (see 10.7.6 Payment Security).
Give staff access only to what their job needs.

13.5.2 Website form fields

Ask only what you need to respond. For most service businesses that’s name, a way to reach the person, the service needed, and the location or ZIP code. Leave out birthdays, full addresses, and “how did you hear about us” unless you use the answer. See 13.5 Website Forms for building the form.

16.1.2 Intake information

On the first call or message, collect only what you need to qualify the lead and respond: what they need, where, when, and how to reach them. Gather more details later, only if the job moves forward (see 16.1 Lead Intake).

25.2.1 Data you put into AI tools

Before you paste anything into an AI tool, remove names, phone numbers, addresses, and account details unless the task truly needs them and the tool’s terms allow it. Check whether the tool keeps or trains on what you enter (see 25.2 Data You Put Into AI Tools).

Made-up example: Fairview Plumbing’s old web form had 14 fields, including birthday and home value. The new form has 5: name, phone, email, ZIP code, and “What’s going on?” The office manager also stops pasting customer names into an AI tool when drafting replies and uses “the customer” instead.

Why it matters

You can’t lose what you don’t have. Fewer records mean less harm if a laptop is stolen or an account is hacked.
The FTC acts on poor data practices. Collecting or keeping sensitive data with no need, then failing to protect it, can lead to trouble.
State privacy laws are growing. Several states have laws that require businesses above certain size or data thresholds to limit collection. Check your state.
Long forms lose leads. Each extra field is one more reason to quit.

Who this applies to

Every business that collects personal information in any form, from a paper sign-in sheet to a customer relationship management (CRM) system.

How to do it

Open your data map (see 11.5 Data Map) and look at the purpose column.
Cross off anything without a clear purpose. Stop collecting it.
Trim your web forms to the fields you use to respond.
Trim your intake script to what you need to qualify and reply.
Stop using Social Security numbers as identifiers anywhere.
Set retention periods and delete old data on schedule (see 9.8.5 Secure Record Destruction).
Write an AI rule for staff: what may and may not go into AI tools.
Update your privacy notice to match what you actually collect (see 11.1.10 Privacy Notice).

What proof to keep

Your data map with a purpose for each data type
Before and after screenshots of your forms
Your intake script, with version dates
Your written AI use rule
Deletion records

Common mistakes

“Required” on every form field.
Copying a long form template from a big company.
Asking for a full address before you even know if you serve the area. A ZIP code is usually enough.
Keeping old leads forever in a spreadsheet nobody uses.
Pasting full customer emails into an AI tool to write a reply.
Collecting ID copies “just in case.”

When to get help from a pro

Privacy attorney: if you sell online in many states, handle health or financial data, or have a large customer list. Questions to ask:

Which state privacy laws apply to my business, and what do they say about limiting collection?
How long do I need to keep each type of record?
What should my privacy notice say about what I collect?

Bill’s note

[Bill: add a short note. For example, how many fields SiteSmarty puts on client contact forms and why, or what happened to a client’s lead flow after shortening a form.]

If you’d rather have this done for you, SiteSmarty builds website contact forms that ask only what you need.

How I did this for SiteSmarty

[Date I did this:]
[What I actually did, step by step: reviewing SiteSmarty’s forms, intake questions, and AI use]
[What it cost and how long it took:]
[What surprised me or what I’d do differently:]
[Screenshot or photo to add, with private info blurred: contact form before and after]
[Result so far:]

Questions people ask

How many fields should my contact form have? Only the ones you use to respond. For most local service businesses that’s about 4 to 6.

What should I ask on a first call? What they need, where, when, and how to reach them. Save the rest for later.

Can I use Social Security numbers as customer IDs? No. The FTC says to use them only for required purposes, like employee tax reporting.

What customer data is safe to put into AI tools? As little as possible. Remove names and contact details, and check the tool’s terms on storing and training.

Audit check

Line	Question	Pass looks like	Fail looks like	Evidence to collect
11.6.1 Data minimization	Does every data type collected have a clear purpose and a retention period?	Data map with purpose and retention for each row, unneeded data removed	Data kept “just in case,” no retention periods	Data map, deletion records
13.5.2 Form fields	Do website forms ask only what’s needed to respond?	Short forms with only fields that are used	Long forms with birthdays, full addresses, or unused fields	Form screenshots
16.1.2 Intake information	Does the intake script collect only what’s needed to qualify and respond?	Short script, more detail only after the job moves forward	Collecting ID or financial details on first contact	Intake script
25.2.1 AI data minimization	Is there a rule limiting personal data entered into AI tools?	Written rule, staff remove names and contact details	Full customer records pasted into AI tools	AI use rule, staff training record

Where this fits

Do this first: 11.5 Data Map

Do this next: 11.6.2 Sensitive Information

Sources

Federal Trade Commission, "Protecting Personal Information: A Guide for Business" (checked October 17, 2026)
PCI Security Standards Council, "PCI Data Storage Do's and Don'ts" (checked October 17, 2026)

This page explains general rules and Bill's own experience. It is not legal, tax, or insurance advice. Talk to a qualified professional about your situation.