Stop emailing sensitive customer data: safer ways to collect it

Many Indian service businesses ask customers to send a PAN card copy, a cancelled cheque or an Aadhaar photo, and the website form simply attaches the file to an email. That email now sits in a shared inbox, in the sender's sent folder, on two phones with the mail app installed, and in the backup of whichever mail provider you use. When you collect sensitive customer documents this way, you are creating copies you can never find again. This article covers why email is the wrong container, what to use instead, and how to decide what you genuinely need to keep.

None of this requires expensive systems. Most of it is about changing where files land and how long they stay.

Why email is the wrong place for documents

Email was designed to move messages, not to guard them. Once a file leaves your form as an attachment, several things happen at once.

• It multiplies. Server copy, sent copy, every recipient's copy, every device that syncs the mailbox, and any auto-forward rule someone set years ago.
• It is hard to delete. Honouring a deletion request means finding every copy, which nobody can do reliably across mailboxes.
• Access is coarse. Anyone with the inbox password sees everything in it, including documents from customers they have no reason to handle.
• It outlives its purpose. A verification document needed for one day stays searchable for a decade.
• It may travel unencrypted. Mail between servers usually uses TLS now, but not always, and you cannot verify the whole path.
• Accounts get compromised. A mailbox full of ID documents is a far more damaging breach than a mailbox full of quotes.

The same objections apply, usually more strongly, to collecting documents over WhatsApp on personal phones, which is extremely common and quietly leaves customer ID copies in staff photo galleries and cloud photo backups.

Things you should not be collecting at all

Start by cutting the list. The safest document is the one you never received.

• Full card numbers, CVV and expiry. Never accept these by form, email or chat. Use a payment gateway's hosted page or its own secure fields so the card details go straight to the gateway and never touch your server.
• Passwords for other services. If you need access to a client's hosting or social account, ask for a delegated account or a temporary invitation instead.
• Full Aadhaar numbers where a masked copy or an alternative ID would serve. Handling Aadhaar data carries specific obligations, so confirm your position with a qualified lawyer before building any flow around it.
• Documents you cannot name a use for. If nobody can say which process consumes the file, remove the field.
• Bank details in free-text fields that end up in an enquiry table read by your whole team.

Whatever remains should be justified in one sentence: we need this file, for this purpose, for this long.

Safer ways to receive what you do need

Upload into a controlled store, not an inbox

Have the form write the file to private storage, either a cloud bucket that is not publicly readable or a directory outside your web root, and record only a reference in your database. Notify the team by email with a link into your admin panel rather than an attachment. That way there is one copy, in one place, with one set of permissions.

Give each document a limited-life link

Staff should open documents through signed URLs that expire in minutes, generated when a logged-in user with the right role clicks through. Predictable file names in a public folder are how documents end up indexed by search engines.

Encrypt at rest and restrict who can look

Most cloud storage offers encryption at rest with a checkbox; turn it on. More importantly, restrict access by role so only the two people who process verifications can view files, and log every view. Logging is what lets you answer "who saw this" after an incident.

Use a portal for ongoing relationships

If customers send documents repeatedly, a small account area where they log in and upload beats email on every measure: they can see what they sent, you can request a replacement without another mail thread, and access ends when the account is closed.

Reduce what you store after checking

Often you need to verify a document, not keep it. Record the outcome, the last four digits, the date and who checked it, then delete the file. That single habit shrinks your exposure more than any technical control.

Set a retention period and actually enforce it

Decide, per document type, how long you hold it and why. Tax and company law require certain records to be kept for years; a photo used for one-time identity verification usually is not one of them. Your retention table might look like this:

1. Identity proof used for a one-off verification: delete after verification, keep only the result.
2. Documents supporting an invoice or a statutory filing: keep for the period your accountant specifies.
3. Uploads attached to an enquiry that did not convert: delete after a few months.
4. Files linked to an active service: keep while the service is live, review on closure.

Then automate it. A scheduled job that deletes files past their retention date is the only version of this policy that survives a busy quarter. Retention periods interact with legal obligations that vary by industry, so agree the numbers with a qualified professional rather than copying someone else's table.

Cleaning up what is already in your inbox

If years of documents are sitting in mail folders, do a one-time cleanup. Search for attachments by type, move anything still needed into your controlled store, then delete the mail threads including the sent folder and trash. Tell staff to remove local copies from downloads folders and phone galleries. Change the form so new files never take that route again, and remove any auto-forward rules that were quietly copying everything elsewhere.

Finish by writing a short internal note saying where documents live now and who may open them. If you need the upload handling, storage permissions and retention job built into your site, our team can put that together as part of a website development or upgrade project. For questions about which records you are legally required to retain, speak to a qualified lawyer or your auditor.

Frequently asked questions

Is it acceptable to receive documents on WhatsApp?

Messages are encrypted in transit, but the file then lives on staff phones and in their photo backups, which is exactly the problem you are trying to avoid. If customers insist on WhatsApp, move the file into your controlled store promptly and delete it from the device.

Should uploaded files be password-protected instead?

Password-protected archives sent by email are better than nothing, but the password usually travels in the same thread and the file still spreads. Controlled storage with access rules is a stronger answer.

What counts as sensitive data under Indian law?

The DPDP Act 2023 covers personal data broadly and sector rules add their own requirements, so the answer depends on your industry and the data involved. Treat identity documents, financial details and health information as sensitive by default and confirm the specifics with a qualified lawyer.

Do I need to tell customers how long I keep their documents?

It is good practice, and being explicit reduces disputes. State the purpose and the retention period on the form itself and in your privacy notice, in plain language.