Customer data from orders stays out of the model

Every order that reaches your shop carries data about people. In a chat app there is the contact name and phone number. On a marketplace there is the recipient's name, full address, sometimes a landmark and notes like 'leave it with the neighbour'. For cash-on-delivery orders there is the number the courier calls. All of this is personal data under the PDP Law, Law Number 27 of 2022. The legal basis is covered in the PDP Law basics lesson; here we apply it to the shop counter.

Many small sellers feel this law is only for big companies. In fact the PDP Law applies to anyone who decides the purpose and means of processing personal data, including a home business that logs orders in a notebook or spreadsheet. Only the scale changes. A cake seller with thirty customers still holds thirty names, thirty numbers and thirty home addresses. If that list leaks, those people may get calls from scammers who know exactly what they bought and where they live.

The rule we keep: the real order list is never pasted into a general AI service. A general AI service means one you have not contracted to process customer data, including a free account on your phone. The reason is not that such a service is surely malicious. You do not know where the data is stored, for how long, who can read it, or whether it is used to train a model. The customers whose data you paste were never asked either.

The good news is that almost all the help you need from AI in a shop does not need real data. The model needs the shape of the data, not its contents. If you want a formula to total weekly sales, the model only needs column names such as date, order code, product, quantity and price, plus two made-up sample rows. If you want a template for an order confirmation, the model only needs what the message should say, and you fill in the customer's name yourself when sending.

How it works: first write the result you want, then ask what the model minimally needs to know for it. The answer is usually rules, structure and samples. The real data stays in your order book, spreadsheet or shop app, and you run the result yourself there. Replacing names with codes such as PLG-01 is pseudonymisation, not anonymisation: the address and order contents can still identify the person. The full explanation is in the masking data lesson.

Article 16(2) of the PDP Law sets out processing principles. Two are felt most in a shop (points a and b): data is collected in a limited and specific way, and data is processed according to its purpose. A customer gives an address so the parcel arrives, not so their number joins a promotion list or is shared with another seller. Point (g) of the same paragraph asks that data be deleted once its retention period ends or when its owner asks, unless another rule requires keeping it. So decide how long you keep data from completed orders, for example until the complaint and return window has passed, then clean it up.

A note about phones. In a small shop, customer data is often scattered: order screenshots in the gallery, photographed shipping labels, a chat group with couriers, notes in a memo app. Each copy is a new place that can leak if the phone is lost or borrowed. Once a month, delete screenshots of completed orders and remove customer numbers from groups that no longer need them.