As more services move online, customers are sharing increasing amounts of personal information across apps, websites, mobile money platforms, banking services, and digital marketplaces. This data can help organizations offer faster, smarter, and more personalized services. However, it can also expose customers to unwanted marketing, fraud, identity misuse, and cybercrime when handled carelessly.
Consequently, data privacy and customer trust are now inseparable. Data protection is no longer just a legal or compliance matter it is central to building brand loyalty. Customers want to know why their information is being collected, how it will be used, who can access it, and whether they retain control over their choice.
In a one-on-one conversation with Techfolio, Nicholas Mulila, Group Chief Risk Officer at Safaricom PLC, explains why responsible data use must be simple, clear, and practical.
As organizations collect more customer data, what does responsible data use really mean in practical terms?
Responsible data management means following clear principles when collecting, processing, and storing customer data, as guided by the Data Protection Act Kenya.
- Data Minimization: The first principle is data minimization. Organizations should only collect, process, or store what is strictly necessary for their committed purpose. Companies should not ask for extra information simply because they can.
- Transparency: The second principle is transparency. Customers must understand why their data is needed, what is being collected, and how it will be used. This should be clearly explained in product terms and conditions or privacy notices.
- Responsible Disposal: Organizations must dispose of data responsibly when it is no longer needed, strictly adhering to retention and disposal policies.
- Third-Party Protocols: Where data is shared with third parties, it must comply with the law through clear Data Sharing Agreements. For high-risk processing, a Data Protection Impact Assessment should confirm the legal basis and proper safeguards.
How can companies balance personalization with customer privacy without crossing the line?
Personalization is meant to help companies meet customer needs, sometimes even before the customer realizes they could benefit from another service.
However, the customer must always have a choice. They should be able to decide whether they want to receive personalized offers and be able to easily opt out of further communication whenever they choose.
What are some common mistakes organizations make when collecting, storing, or using customer data?
One common mistake is collecting more data than needed simply out of habit. For example, outdated forms may still ask job applicants for religion, ethnic group, or home address when it is irrelevant.
Other mistakes include forgetting to delete expired data, sharing info with third parties without clear disclosure, and securing digital systems while neglecting physical paper records.
What simple steps can customers take to better understand and protect their personal information online?
Customers can take control by applying basic digital privacy tips:
- Limit Exposure: Avoid sharing sensitive details like full names, ID numbers, or bank account details openly online.
- Avoid Public Networks: Refrain from using public Wi-Fi for sensitive banking or account management.
- Read Before Clicking: Review terms, privacy policies, and cookie settings instead of accepting them blindly.
- Manage Location Sharing: Keep GPS location services turned off unless actively using a location-based feature.
- Secure Access: Use strong passwords, never share an M-PESA PIN, and avoid leaving banking apps open on unattended devices.
Achieving data privacy and customer trust is a shared responsibility. Organizations must collect less, explain more, protect better, and delete expired records. Customers, in turn, must stay vigilant about what they share and who they allow to access it in today’s digital economy.
