How to clean an old customer spreadsheet safely

An old customer spreadsheet often contains several histories in one file: completed orders, unanswered enquiries, promotional contacts and notes nobody now understands. Cleaning it safely begins by separating those purposes. Sorting by the oldest date and deleting rows may remove records the business must retain while leaving unnecessary copies elsewhere.

As of 22 October 2026, the main DPDP obligations are scheduled for 13 May 2027 under the commencement notification. The following method supports readiness and ordinary information management. Current legal retention, confidentiality and sector requirements still need to be checked for the business concerned.

Establish ownership before changing the file

Identify who created the spreadsheet, which team uses it and whether it is the only record of any transaction. Ask whether another process imports it automatically. A file that looks abandoned may still feed a delivery, invoicing or support workflow.

Review its permissions before circulating it for discussion. Restrict unnecessary access through the authorised owner. If the existing sharing reveals a possible exposure, assess that separately rather than treating cleanup as a way to erase evidence of the event.

Make any temporary working copy only where necessary, with controlled access and an explicit disposal plan. Creating five review copies can increase the problem the cleanup was meant to solve.

Classify rows and columns by purpose

A hypothetical bicycle shop has a workbook containing service bookings, bicycle serial numbers, customer phone numbers, warranty notes and a column labelled “good prospect”. Some customers have current repairs; others made an enquiry years earlier.

Group records by meaningful business categories. Identify active transactions, completed records with a justified retention need, unresolved disputes and data with no established current purpose. Review columns as well as rows. A retained invoice-related record may not require an informal note about the customer’s personal circumstances.

Under the future sections 4, 6 and 7, the business must assess the ground and purpose for processing. Possession of a phone number does not automatically establish permission to use it for every future promotion.

Apply the retention rules to each category

Section 8(7) addresses erasure on withdrawal or when it is reasonable to assume the specified purpose is no longer being served, whichever is earlier, subject to retention necessary for compliance with law. The final Rule 8(3) separately requires personal data, associated traffic data and processing logs to be retained for a minimum of one year from processing for the Seventh Schedule purposes, followed by erasure unless further lawful retention applies.

The team should incorporate those provisions into its future schedule rather than assume that age alone determines deletion. Other applicable laws may require particular transaction records. Identify the category and source of the requirement, and seek advice where the position is unclear.

The large-platform inactivity mechanism in Rule 8 and the Third Schedule is not a universal three-year rule for small shops. Do not copy it into this spreadsheet simply to avoid deciding what each category is for.

Decide what happens to each category

Use clear outcomes: retain for an active purpose, retain with restricted use for a justified requirement, correct an identified error, investigate an unresolved question or erase when appropriate. Assign an owner to the uncertain category so it does not become permanent limbo.

If the shop wants to use historical records for a new campaign, assess that proposed use separately. A cleanup project does not convert uncertain promotional permission into valid consent. Nor should the team send a new promotional message to everyone merely because it hopes to obtain permission afterwards.

Keep the decision record concise. It should explain the categories and reasoning without duplicating all personal data in a second audit spreadsheet.

Follow the copies and verify the result

Check shared drives, email attachments, personal downloads, old vendor uploads and operational exports. Removing a row from the main workbook may leave it in a marketing list or a technician’s downloaded file. Relevant processor copies require attention under the future section 8 framework.

Verify the final file’s permissions, fields and links to other processes. Confirm that necessary work still functions and that removed categories have not reappeared through a synchronisation or import.

Then name an owner and a recurring review trigger for the surviving dataset. A smaller spreadsheet with a clear purpose, controlled audience and retention rule is easier to maintain than another unowned archive. The cleanup is complete when the decisions apply across the relevant copies and the business knows how to prevent the same accumulation from restarting.