How to protect client privacy in a pet-care business

Write out what a dog walker with thirty clients actually holds. Thirty home addresses. How to get into most of them. Which days those houses are empty and for how long. Where the keys are. Phone numbers, emergency contacts, sometimes a spare key in a bag in a van.

Put like that, it is one of the more sensitive datasets a small business can carry — and almost nobody set out to be responsible for it. It arrived one client at a time.

The things worth fixing first

Get client data out of your personal phone

Addresses and access instructions scattered across WhatsApp threads and a notes app are a problem in three ways: they are on a device that can be lost, they cannot be revoked when someone leaves, and they cannot be deleted properly when a client does. A single place you can control is the whole fix.

Do not label keys with addresses

The oldest rule in the trade and still worth repeating. A key labelled "14 Elm Road" is a burglary kit if the bag is stolen. Use a code that means something only to you, and keep the mapping somewhere else.

Give people access to what they need, and no more

A part-time walker covering six jobs does not need the addresses and access instructions of your entire book. This is not distrust — it is the ordinary principle that access follows need. It also limits the damage of a lost phone to six clients rather than three hundred.

Have an offboarding step

The day someone stops working for you, their login should stop working. Shared logins make this impossible, which is one of several reasons not to have them.

Photos are client data too

A photo of a dog is usually fine. A photo of a dog in front of a recognisable front door, posted publicly, with a caption saying the owners are in Spain for a fortnight, is not. Ask permission once, record the answer, and think about what is in the background before anything is published.

Health information belongs to the owner

An animal's medical details are the owner's information, given to you for a purpose. The default should be that it travels only as far as the owner allows — and that where it has not been shared, the person looking sees that it was withheld rather than assuming there is nothing to know.

That distinction is doing real work. A blank field reads as "no allergies". A locked card reads as "ask before you give that treat". Those are very different instructions to hand somebody at a front door.

What UK data protection means for a round of thirty

You are handling personal data about identifiable people, so UK GDPR applies to you regardless of size. Nobody expects a sole trader to run a compliance department, but a few things are reasonable and achievable:

• Collect what you need for the job, and not more.
• Be able to say where it is kept and who can see it.
• Keep it accurate and current.
• Delete it when the relationship ends — while keeping the financial records you are required to keep.
• Be able to answer a client who asks what you hold about them.
• Have a rough plan for a breach: a lost phone, a stolen bag of keys.

The ICO publishes guidance aimed at small organisations, and it is the right place to check your specific obligations rather than a blog post.

Ending a relationship cleanly

When a client leaves, two things have to happen at once and they pull in opposite directions: their personal information should go, and your invoices and totals must stay — you are required to keep financial records, and your own history should not develop holes. Archiving that does both is the practical answer.

In CorePaw Pro archived clients work exactly that way: private information goes, and your invoices and totals stay. Access is granted per area and enforced with row-level security on every read and write rather than by hiding buttons, and where an owner has not shared something the walker sees a locked card saying so.

We are also plain about what is not yet true: access codes are stored as entered rather than encrypted at rest today, and that is stated on the security and privacy page rather than glossed over. If it matters to you, it is worth reading before you sign up.