All organizations, for profit or otherwise, need to collect some data on their customers. Online stores may keep past order history to recommend future products. Non-profits who offer education may collect demographic data on their students to better tailor their class offerings. Review sites collect preferences so other potential customers can make informed choices. All of this data is valuable to criminals and other bad actors. This presentation will cover some scenarios you should consider, some tradeoffs you should consider when deciding what to collect, and some techniques for protecting the data you do collect.