If you hold customer correspondence, you hold personal data.
WHAT THIS MEANS IN PRACTICE
Mailboxes containing customer names, addresses, phone numbers and order details are personal data under the NDPR in Nigeria, and under other laws if you serve customers elsewhere.
PRACTICAL OBLIGATIONS
Collect only what you need Keep it no longer than you need it
Protect access to it: strong passwords, two-factor authentication, and access limited to people who need it
Be able to say what you hold if someone asks Have a privacy notice explaining what you collect and why
WHAT THIS MEANS FOR EMAIL SPECIFICALLY
Do not keep customer correspondence indefinitely without reason. Set a retention period and archive or delete accordingly. Be careful with forwarding customer information to personal addresses, which takes it outside your control. If a mailbox is compromised, customer data may have been exposed, which may carry notification obligations.
THIS IS GENERAL GUIDANCE
Not legal advice. For anything specific, take proper advice. What we can tell you is how to secure the mail; what you must do with the data is yours.
