Which Data Is Most Valuable to the Business

The owner starts with information whose loss or disclosure would have a direct financial impact: bank documents, the customer database, accounting records, contracts, orders, corporate email and commercial materials. For each group, the director determines who needs it to perform a specific task. An employee does not receive access "just in case", and the administrator changes rights after a transfer, dismissal or completion of a project.

The owner separates customers' and employees' personal data from ordinary working files. The director or an authorised person determines why the company collects particular information, where it is stored, to whom it is disclosed and when it is no longer required. Agreements with an accountant, cloud service, marketing agency or other contractor should reflect the data that the contractor actually receives.

For online banking, the director's email, accounting services and administrative portals, the owner retains a backup recovery method under their control. One employee's password for every resource creates unnecessary dependency; separate accounts and multi-factor protection make it possible to close one person's rights without changing access for the entire team.

The value of information should be assessed by its consequences. If managers cannot see orders without the CRM, documents cannot be prepared quickly without the accounting database, and customers receive no replies without corporate email, those data sets belong in the first tier for protection and recovery. This list helps the owner avoid spending the same budget on a critical database and an archive of secondary materials.

Where to Keep Copies and How to Retrieve Your Data from a Service

A backup is useful only if working files and databases can actually be restored from it. The director decides which data must be recovered first, how often it changes and how long the business can operate without it. The responsible employee or technical specialist creates copies in a separate repository and periodically tests restoration rather than merely checking that automated copying took place.

Before choosing a cloud service, the owner looks at more than the tariff. It is important to know whether the customer database and documents can be exported in a usable format, who controls access, whether a login log is available, how backups work and what happens to the data after the contract ends. The ability to retrieve the company's own information preserves the freedom to change provider without interrupting the business.

For CRM, accounting, warehouse and customer-database services, the right to export data should be checked before payment. The owner then knows in advance which files will be received when the contract ends, in what format and who will help transfer them to another system. This is ordinary commercial prudence: a business should not leave critical information in a service from which it cannot be retrieved.

During an incident, the director does not need every archive at once but the correct recovery order: payments, current orders, customer communications, accounting and then historical materials. The contacts of responsible people and the location of backups must be known in advance. CERT-UA recommendations can be used as a technical basis, but the internal procedure should reflect the actual services used by the particular company.

Who Grants, Changes and Closes Access

The owner approves which data is critical, while the director identifies the people who may create accounts, grant rights, order new services and restore information. The administrator implements these decisions and maintains an up-to-date access register. This allocation gives a clear answer to a simple question: who can open a particular database today and who will close that access tomorrow.

In an agreement with an outsourced accountant, IT specialist or marketing agency, the director specifies the data the contractor receives and what must be returned when the work ends. The customer database, advertising accounts, domain, website, source files and accounting archive remain under the company's control; the contractor works through separate access issued specifically to them.

On the day an employee or contractor changes, the responsible person closes their accounts, changes shared secrets if any were used and checks that working files have been handed over. At the same time, the director verifies that the domain, email, advertising accounts and cloud storage are registered to the business rather than to the former contractor's personal address.

UBC can help prepare concise rules for access, data transfer and handling personal information and align them with agreements with employees and contractors. The owner receives a clear list showing which data is critical, where it is stored, who has rights, where the backup is kept and who will restore operations if the main service becomes unavailable.

Legal documents, technical protection and backups work together. The agreement defines the contractor's obligations, the access log shows who worked with the data, and the backup restores the files. For day-to-day work, the team needs rules that can actually be followed: separate accounts, approved rights, secure login methods and regular tested recovery.