Most small and mid-size companies do not lose data in dramatic attacks. They lose it through shared passwords, files on someone's laptop, and tools nobody reviewed. This guide sets out a practical order of work, the way Appjad (أبجد) approaches data protection with clients: start with what you hold, then decide who sees it, then write the rules down.
Key takeaways
- Know what data you hold and where it lives before buying any tool.
- Limit access by role, and remove it when people leave or change jobs.
- Treat AI tools like any other system: approved sources, defined topics, human hand-over.
- Write ownership, access and retention into the contract, not into memory.
Start with a one-page data map
Before any security decision, you need a simple picture of what exists. A data map is one page listing the kinds of data you hold, where each one is stored, who can reach it, and how long you keep it. It does not need software; a spreadsheet is enough.
Build it by walking through the business, not by guessing. Ask each team what they collect from customers, what they receive from suppliers, and what they keep for finance or HR. Appjad runs this step as a short diagnostic, because every later decision depends on it.
- Customer records: names, contact details, order history, support conversations.
- Financial data: invoices, bank details, payroll, contracts.
- Operational data: supplier terms, stock, project files, internal procedures.
- People data: staff files, performance notes, recruitment records.
Give access by role, not by convenience
Most access problems come from convenience: one shared login for the team, an old account nobody closed, a folder open to everyone because it was faster. Each of these removes the record of who did what.
Set access by role. A salesperson needs customer contact details; they do not need payroll. A supplier portal account should see its own orders, not the whole customer base. Review the list on a fixed schedule, and make removing access part of the exit process, not an afterthought.
- List every system that holds company or customer data.
- For each one, write who has access today and why.
- Remove accounts that are unused, shared or belong to former staff.
- Set a rule for new access: request, approval, review date.
Data protection is mostly a set of small, visible decisions made before something goes wrong.
Handle AI tools with the same discipline as any system
AI assistants are now part of daily work, and they are useful. They also create a new path for company data to leave the building. The answer is not to ban them; it is to define how they are used.
Decide which tools are approved, what information may be entered, and which topics an assistant may answer. Where an AI assistant faces customers, it should answer only from sources you approve, hand over to a person when it is unsure, and have its conversations reviewed regularly. Appjad designs these controls into the proposal, so they are agreed in writing before launch.
- Approved tools only, listed by name.
- Clear rules on what may and may not be entered.
- A human hand-over route for anything sensitive or unclear.
- Regular review of conversations and outputs.
Put backups and recovery to the test
A backup you have never restored is a hope, not a control. Decide what would hurt most to lose, how quickly you need it back, and who is responsible for restoring it. Then test the restore on a real case, not in theory.
Keep at least one copy separate from your main systems, and document the steps to recover. If a key person is unavailable, someone else should be able to follow the document and bring the system back.
Write the rules into the contract
Verbal agreements about data do not survive staff changes or supplier disputes. Ownership, access, retention and hand-over should be written into every proposal and supplier agreement. Your data, code and accounts belong to you, and that sentence should appear in the document.
This matters most with external developers, marketing agencies and AI vendors. Ask who owns the accounts, what happens to the data when the contract ends, and how you get it back. If the answer is unclear, the terms are not finished.
Next step: a short review before the next launch
You do not need a large programme to start. Pick one system that holds customer or financial data, map it, review who has access, and write down the rules. Then repeat for the next one.
If you would rather have the first pass done with you, شركة أبجد runs a short diagnostic that produces a written picture of your data, access and risks, with priorities you can act on. It is a practical starting point, and it keeps control with you.
