A cleaner leaves the company on good terms. Nobody thinks twice about it. Six months later you realise the door code for a client’s house, the one written in a notes app, shared over WhatsApp when they were covering a shift once, was never changed, and nobody can say for certain who still has it. Nothing bad happened. But if you’d been asked to prove you had a process for exactly this, there wouldn’t have been one to show.
Cleaning companies handle an unusually sensitive mix of personal data for a small or medium business: client names and addresses, alarm and door codes, notes about vulnerable residents, staff DBS results, bank details for payroll, right-to-work documents. Most of it gets passed around informally, a phone note, a shared spreadsheet, a message thread, because nobody set out to build a data protection process, it just accumulated as the business grew.
Where the actual exposure sits
- Access codes and keys that outlive the staff member who was given them, with no revoke step when someone leaves.
- Client and staff data on personal devices, WhatsApp, personal notes apps, personal email, outside any company-controlled system entirely.
- No clear retention policy, so old client and former-staff data sits indefinitely instead of being deleted once there’s no legal reason to keep it.
- No process for a subject access request, if a client or former staff member formally asks what data you hold on them, most companies have no fast way to answer accurately.
The risk isn’t a hacker. It’s a WhatsApp thread that still exists two years after the person in it left.
This overlaps with problems you’ve probably already read about
Staff offboarding is exactly where the turnover and retention piece and data protection meet, every departure is also a data-access event, and it deserves the same checklist treatment as returning a uniform: revoke logins, reissue codes, confirm what data that person still has copies of. Staff files themselves, DBS results, right-to-work documents, the records covered in the vetting and DBS piece, are some of the most sensitive personal data a cleaning company holds, and deserve access controls, not just a folder anyone on the team can open.
Client-facing systems matter too. A proper client portal is also a data protection improvement, not just a convenience feature, it replaces scattered messages and spreadsheets with a controlled system where access can actually be limited to the people who should have it, and revoked cleanly when a relationship ends.
What a reasonable process actually looks like
It doesn’t need to be a legal department. It needs a few concrete habits: access codes and client details living in one access-controlled system rather than personal phones, a clear step in offboarding that revokes access and flags anything that needs changing physically, a retention period for old client and staff records instead of indefinite storage, and a way to answer a subject access request without a week of searching. Gevu’s staff and client records are built around exactly this, access controlled by role, offboarding that actually removes access, and an export tool for data requests, because it’s the standard Seawolf Cleaning Services holds itself to as a working cleaning company handling the same kind of client data every day. You can also see how Gevu itself handles this in its own privacy policy.