Industry and retail
Data protection for industry and retail – from ERP to web shop
Even if you do not process health or banking data, you hold a lot of personal data: customers in the CRM and web shop, employees in the HR system, job applications, contacts at suppliers. Espresso finds this data, answers requests and deletes once the retention periods have expired – in the ERP as well as in file storage and Microsoft 365.
What makes it challenging for industry and retail
ERP, CRM and web shop
Customer data is spread across many systems, often with SAP at the centre.
Employee and applicant data
Job applications, personnel files and payroll data have their own, sometimes short, retention periods.
Customers in the EU
If you deliver to or sell in the EU, you often have to comply with the GDPR as well.
Copilot in everyday work
With Microsoft 365 Copilot, shared storage suddenly becomes searchable.
How industry and retail use Espresso
- Data Discovery Personal data in file storage and Microsoft 365 Find job applications, payroll lists and customer exports where nobody would expect them. Go to the module
- Data Deletion Deletion in ERP and CRM Data that is due is deleted across the connected systems – including across SAP and non-SAP landscapes. Go to the module
- Subject Request Requests from customers and employees Access requests on time, deletion with proof. Go to the module
- AI Privacy Control Copilot under control See which shared content Copilot can reach, and classify AI systems. Go to the module
The framework for industry and retail
The FADP and the Code of Obligations apply to everyone; the GDPR may also apply, depending on the customer base.
| Rule | What it means |
|---|---|
| FADP | Access requests, erasure and data security for everyone; a record of processing activities from 250 employees or in the case of particular risks (Art. 12 FADP, Art. 24 DPO). |
| GDPR | When goods or services are offered to people in the EU (Art. 3 para. 2 GDPR). |
| Swiss Code of Obligations (CO) | Accounting records and vouchers for ten years (Art. 958f CO); employee data only insofar as it concerns the employment relationship (Art. 328b CO). |
Overview without any claim to completeness; does not replace legal advice in individual cases. As of: 6 October 2026.
Getting started
See within six weeks where your personal data is stored
The assessment scans selected sources in your environment – also with a focus on Copilot and AI. The result is a report with a recommendation.
Frequently asked questions
Is Espresso worthwhile even without particularly sensitive data?
Yes. Customer, employee and applicant data exists everywhere, and handling requests or deletions manually takes time. Espresso is modular: you start where the pressure is greatest.
How long may job application documents be retained?
The law does not specify a fixed period. Once the recruitment process is complete, they must generally be deleted, unless there is consent or another reason for longer retention.
Does it work with SAP and other systems?
Yes. The applications do the deleting themselves using their existing functions; they are connected via an open interface or via Azure Service Bus. At Pax, the Swiss pension insurer, deletion runs across SAP and non-SAP systems.
Can we check what Copilot would find before rolling it out?
Yes. The assessment with a focus on Copilot and AI shows where in SharePoint, OneDrive and mailboxes personal data is stored and what Copilot would find.
Related topics
- Find Finding personal data Where personal data is stored in file storage, databases and Microsoft 365 – and how to find it reliably. Read more
- AI Microsoft Copilot and data protection Prompts, transcripts and shared storage: how organisations keep control of personal data with Copilot. Read more
- Fundamentals FADP and GDPR compared The operational obligations under the Swiss FADP and the GDPR side by side – with articles and deadlines. Read more
See Espresso in 30 minutes
We will show you the cockpit with sample data – and discuss where you should start.
Request a demoor write directly to info@espressodataprivacy.com