Guide
What to Do With Customer Data When Closing a Business
Customer personal data has to be inventoried, checked against the promises the company already made, and then deleted or returned, with a separate hold for records a tax filing or a legal claim still needs. That is a legal obligation. What the company does with its own operational records, including any license, is a separate decision. Customer details are not a Vetrix product.
| Fact | Detail |
|---|---|
| Who the Disposal Rule covers | A person under FTC jurisdiction that possesses consumer information for a business purpose. eCFR |
| What consumer information excludes | Information that does not identify individuals, such as aggregate information or blind data. eCFR |
| What disposal includes | Discarding, and the sale, donation, or transfer of any medium, including computer equipment, upon which consumer information is stored. eCFR |
| Storage limitation | Where the GDPR applies, personal data kept in a form that permits identification are not kept longer than necessary for the purposes. legislation.gov.uk |
Customer data is not the company archive
Customer personal data is the information customers gave the company about themselves. Operational records are how the company did its work. Deleting customer data and licensing operational records are different projects, and the customer data comes first.
A customer name, a support ticket, a billing address, and a login are about the person. A runbook, a product spec, and an internal decision log are about the work. The same export can contain both. Split them before anyone talks about a license, a sale of the files, or a cancellation of the tool that holds them.
For the choices for the company's own records, including whether a de-identified license is one of them, read what to do with company data when closing a business. For what a license never includes, including customer and staff details, read is selling company data to AI safe. You can finish the deletion and return work whether or not any operational records are licensed.
The guides to closing, selling or licensing a company split the rest of the close into single tasks. Staff communication is a separate conversation. Read how to tell employees the company is closing for that conversation. If the company is a Delaware corporation, read how to dissolve a Delaware corporation for the filing.
Inventory what you hold about customers
If a customer can be singled out from the file, it belongs on the inventory before anyone cancels a tool.
Walk the places a customer can be picked out: account records, support mail, billing, analytics exports, spreadsheets on laptops, the copy a vendor still hosts after you think you exported, paper in a drawer, and a backup disk labeled with a year. Each row of the list needs the system, where it lives, whether it identifies a customer, and whether a contract or a tax duty says to keep it.
Do not start with the tool you want to cancel. Start with the person. If a name, an email, a payment method, or a ticket history can single someone out, the file is customer personal data even when it also contains your own notes. A folder of product screenshots with no customer in them is an operational record. Put it on the other list.
Put that list on the company records inventory template.
Vendors count. If the help desk, the billing tool, or the analytics account still stores the customer, the inventory names that vendor and who can still log in. The deletion step later has to reach that copy. A note that says "we canceled the card" does not say the vendor deleted the file.
One person should own the list, and a second person should read it before any tool is canceled. The owner writes the row. The reader checks that a customer can still be found, or that the file truly has no person in it. A row nobody can open is not finished. Put the admin login, or the name of the person who still has it, on that row before the password is reset.
The order for customer data
Work in this order so a canceled login is not the only way into a customer file you still have to delete or return.
Do the six steps in order. The inventory tells you what exists. The contracts tell you what you already promised. The hold tells you what a filing or a claim still needs. The notice tells the customer which of those outcomes is theirs. The deletion is the act. The written note is the record of the act. Skipping ahead to cancellation leaves the copy you meant to delete sitting in a vendor account nobody can open.
List every place customer personal data sits
Write one row for every system that can single out a customer, including a vendor that still hosts a copy. Note where it lives and whether a contract or a tax duty says to keep it. Finish the row before anyone cancels a tool.
Read the privacy notice and the customer contracts
Read what the company already promised about deletion, sale, or return. Use the notice on your site and the contracts you actually signed. Do not borrow another company's notice and treat it as yours. If the notice says you delete on request, the closing message has to sit next to that promise. If a contract says the customer gets a copy back, return is the step.
Mark what a tax return or a legal claim still needs
Separate the files a final tax return or a live legal claim still needs from the files you will delete. Where the GDPR applies, Article 17(3)(e) says paragraphs 1 and 2 shall not apply to the extent processing is necessary for the establishment, exercise, or defense of legal claims. Tax retention is a different clock. Ask your lawyer whether a particular dispute qualifies before you keep a customer file for it.
Tell customers what will happen, in a channel you actually use
Tell customers, in a channel you already use with them, whether you will delete their data, return it, or keep a named category for a named duty. Use the email on the account, the billing contact, or the support address they wrote to. A post they will not see is not notice. There is no sample letter to copy. Say the decision, and say who will answer if it is wrong.
Delete or return the customer data, including vendor copies and old devices
Canceling a subscription is not the deletion step. Deletion includes the vendor's copy and the disk in a drawer. Ask the vendor to delete the customer file and keep the confirmation. Where the file is consumer information, take reasonable measures under 16 CFR 682.3. Selling, donating, or handing over a computer that still holds that information is disposal under 16 CFR 682.1(c).
Write down what was deleted and what was kept
Keep a one-page record: the date, the categories deleted or returned, and the reason a category was kept. Name the person who did the work. The record answers a later question from a customer, a buyer, or a tax examiner. It does not replace the deletion.
If the privacy notice is silent, say what you will do now, in plain words, and do that thing. Do not send a closing message that contradicts the notice or the contract you already signed.
What the Disposal Rule covers
Handing a buyer a laptop that still holds consumer-report information is disposal under the rule, not a side detail.
When the file is a consumer report or was built from one, use the Disposal Rule's definitions. The rule reaches a person under FTC jurisdiction that, for a business purpose, maintains or otherwise possesses that information. It does not attach itself to every name in a sales tool. A credit report, a background report, a tenant history, or a score built from one of those is the kind of file the definition describes. A name the customer typed into your own form is a different file. Start that file with the contract and the privacy notice.
Ordinary customer names in a CRM are not automatically consumer information. The rule is about consumer reports and information derived from them. Do not treat a checkout list as if the rule had already classified it. If you are not sure the file came from a consumer reporting company, ask your lawyer before you rely on this rule, and still delete or return the file, including the vendor's copy and any old device.
Do not treat a list of emails, account ids, or ticket text as aggregate or blind data. Those files still identify someone. A count of signups with the names removed can sit outside consumer information. A spreadsheet of the same signups cannot.
Wipe the disk, or destroy it, before the equipment leaves your control. A buyer of the furniture is not a destruction vendor. Leaving the laptop in the lot is a transfer of the medium that still holds the information.
Reasonable measures are the standard in 16 CFR 682.3(a): protect against unauthorized access to or use of the information in connection with its disposal. The examples under 682.3(b) are illustrative, not a closed list. They require policies you follow for paper and for electronic media, and due diligence before you hire a destruction firm, plus monitoring of that contract. Read them in 16 CFR 682.3.
| Term | Rule | Section |
|---|---|---|
| Consumer information | A record about an individual that is a consumer report or is derived from a consumer report, including a compilation of such records. | 682.1(b) |
| What it excludes | Information that does not identify individuals, such as aggregate information or blind data. | 682.1(b) |
| Disposal | Discarding or abandonment, or the sale, donation, or transfer of any medium, including computer equipment, upon which consumer information is stored. | 682.1(c) |
| Reasonable measures | Protect against unauthorized access to or use of the information in connection with its disposal. | 682.3(a) |
| Paper | Policies and procedures that require burning, pulverizing, or shredding papers containing consumer information so that the information cannot practicably be read or reconstructed. | 682.3(b)(1) |
| Electronic media | Policies and procedures that require destruction or erasure of electronic media containing consumer information so that the information cannot practicably be read or reconstructed. | 682.3(b)(2) |
| Destruction vendor | After due diligence, enter into and monitor a contract with a record-destruction business to dispose of material specifically identified as consumer information. | 682.3(b)(3) |
Where the GDPR changes the timeline
If you already know you have customers in the EU or the UK, or an establishment there, two GDPR articles change how long identifiable customer data may be kept. Ask your lawyer whether they apply to your company.
Article 5(1)(e) of Regulation (EU) 2016/679 says personal data shall be kept in a form which permits identification of data subjects for no longer than is necessary for the purposes for which the personal data are processed. Longer storage for archiving, research, or statistics is a separate clause in the same article, and it has its own conditions. A closed shop is not one of those purposes.
Article 17(1)(a) of Regulation (EU) 2016/679 gives a right to erasure where the personal data are no longer necessary in relation to the purposes for which they were collected or otherwise processed.
Where the GDPR applies, keeping identifiable customer data after the purpose has ended needs a ground, and a closed shop is not itself a ground.
A legal claim can limit that erasure. Keep only the files that claim needs. Do not keep the whole customer database because a dispute might appear later. Ask your lawyer whether a particular claim qualifies before you hold a customer file for it.
Anonymization and pseudonymization are not the same thing. For how that difference applies to a license, read is it legal to sell company data to AI companies. Pseudonymized data are still personal data. A hashed email that can still single a customer out has not been erased.
Keep what a filing or a claim still requires
A customer-deletion project that also destroys the payroll file needed for a final employment-tax return has gone too far.
The IRS says: "You must file a final return for the year you close your business." Read that duty on the IRS page for closing a business. The same page says to keep your records, and that how long depends on what each document records. For the periods, read how to wind down a company and the IRS page on how long to keep records.
Keep the category, the reason, and the place it lives. A tax file stays because the return still needs it. A contract file stays because a claim is open. A marketing export does not stay because someone might want it later. When the reason ends, the file goes back into the deletion step.
Before you cancel, read what to do before canceling software when closing a business for the vendor deletion dates and the export you need. Each vendor's own deletion page is the date that matters for that tool.
If the operational records might be licensed, read questions to ask before selling company data before you talk to a buyer. Customer personal data is not the product those questions are about.
General information only. This is not legal, tax or financial advice.
Related
- Closing
What to do with company data while the company is closing, before tools are canceled.
- What's shared
Which records can be licensed, which details never leave, and what you approve.
- What to do before canceling software when closing a business
Nine cross-vendor steps before you cancel: filings, admins, exports, then each vendor's own deletion page.
- Winding down
Order of operations to wind down a company, from approval through taxes and dissolution.
Questions about customer data when a business closes
Does closing the company delete our customer data?
No. Closing the legal entity does not erase vendor copies, laptops, or backups. You delete or return the customer data yourself, including the vendor's copy and the disk in a drawer. Canceling a subscription leaves that copy in place. Write down what was deleted and what a tax filing or a legal claim still needs.
Does the FTC Disposal Rule treat giving away a computer as disposal?
Yes, when the computer still holds consumer information. 16 CFR 682.1(c) defines disposal to include the sale, donation, or transfer of any medium, including computer equipment, upon which consumer information is stored. Consumer information means a consumer report or a record derived from one, not every name in a customer list. Ordinary CRM rows are not automatically in the rule. If a laptop holds a consumer report, handing it over is disposal, and the rule asks for reasonable measures against unauthorized access.
Where the GDPR applies, when does storage limitation require erasure?
Where the GDPR applies, Article 5(1)(e) says personal data kept in a form that permits identification are not kept longer than necessary for the purposes. Article 17(1)(a) covers the case where the data are no longer necessary for the purposes for which they were collected or processed. Ask your lawyer whether the GDPR applies to your company. A closed shop is not, by itself, a ground for keeping identifiable customer data.
Can we keep customer records that a lawsuit or a tax return still needs?
Article 17(3)(e) says paragraphs 1 and 2 shall not apply to the extent processing is necessary for the establishment, exercise, or defense of legal claims. Mark that hold separately from the files you delete. Tax retention is a different clock. The IRS says you must file a final return for the year you close your business, and that how long you keep records depends on what each document records. Ask your lawyer which period applies before you keep a customer file.
Is licensing operational records the same job as deleting customer data?
No. Licensing is an option for the company's own operational records. Customer and staff details stay out of a Vetrix license. Deleting or returning customer personal data is a separate project: inventory, the promises you already made, notice, deletion or return, and a record of what you kept. The two projects can run in the same month. They are not the same decision.
Sources
- eCFR. 16 CFR 682.2, Purpose and scope. Checked 2026-11-04
- eCFR. 16 CFR 682.1, Definitions. Checked 2026-11-04
- eCFR. 16 CFR 682.3, Proper disposal of consumer information. Checked 2026-11-04
- legislation.gov.uk. Regulation (EU) 2016/679, Article 5, as of 25 May 2018. Checked 2026-11-04
- legislation.gov.uk. Regulation (EU) 2016/679, Article 17, as of 25 May 2018. Checked 2026-11-04
- eCFR. 16 CFR Part 682, Disposal of Consumer Report Information and Records. Checked 2026-11-04
- Internal Revenue Service. Closing a business. Checked 2026-11-04
- Internal Revenue Service. How long should I keep records?. Checked 2026-11-04