A customer list starts as a few names on the back of an order slip and turns, around the fiftieth name, into a pile nobody can search. I have built and kept customer lists myself, which is as much of my own history as this post will lean on. The reasons for what to put in the list and what to leave out come from two published sources, linked below, and the layout is plain bookkeeping sense that I will say is mine when it is.

How To Keep Track Of Clients On Excel Or Sheets (For Very Small Business Owners) [2026 Full Guide], Tutorials With Noel on YouTube

The decision comes before the columns: how much do you need to know about a person to serve them well, and how much of that are you prepared to guard? The Federal Trade Commission’s guide to protecting personal information and a Xero article on customer data small businesses can collect both start from the same place, and it is not a spreadsheet function.

Collect less than you could

Hand pulling a blank index card from a wooden card box

Every column is something you have to protect

The Xero piece calls the principle collection minimisation: collect the customer data you need to deliver your product or service, and be clear about why you need each piece. It points out that asking for something you do not need can cost you the customer’s trust, and that people fed irrelevant questions often give false answers, which leaves you with what the article calls “junk data” that can lead to bad decisions.

The FTC says it more bluntly. In the second of its five principles, titled scale down, it says that if you have no legitimate business need for sensitive personally identifying information, “don’t keep it.” It adds: “In fact, don’t even collect it.” A column you never create is a column you never have to secure, back up or explain.

That gives a first test for every field. Can I name the day I would use it? A phone number passes if you call about orders. A birthday fails unless there is a birthday offer that someone actually runs. A home address passes for something you ship and fails for something the customer picks up.

Xero also says non-essential information should be voluntary and that you should say what it is for, whether marketing or a clear benefit to the customer. Optional notes belong in one column that the customer knows about, not scattered across several that grew over time. The test of a good note is whether you would be comfortable reading it aloud to the person it describes, and Xero’s own version of that test asks whether customers would trust you to keep the data safe.

Sensitive categories need a harder look still. Xero names ethnicity, religious status, political affiliation and sexual orientation as data that needs a particularly careful justification because of the extra obligations that come with it. A shop that sells sandwiches or briefcases rarely has such a justification, and the sheet is simpler without the column. The same article makes a similar point about copying documents such as driving licences: where you can check a fact without storing the document, check it and let the document go back in the customer’s wallet.

The columns

One row per customer, and a second sheet for what they bought

What follows is layout, which neither source covers: the Xero article says outright that it does not get into how to organize the data, so this part is mine.

Start with a single sheet and one row per customer:

  • Name, as the customer writes it.
  • One way to reach them: an email address or a phone number, with a column saying which they prefer.
  • The date of the first order, so you can see how long they have been around.
  • A column for source: where they heard of you, in a few fixed words you pick in advance.
  • A notes column, kept short, for facts a customer told you for the purpose of being served.

Resist adding more columns than the first sheet needs. A sheet with eight tidy columns gets used. A sheet with thirty gets abandoned in a month, and every abandoned column is information that goes stale without anyone noticing.

The second sheet holds orders: one row per order, with the customer’s name copied from the first sheet, the date, what they bought, what they paid, and a status. Putting orders on their own sheet means a customer who buys six times has six rows on the order sheet and still only one row on the customer sheet. Names typed twice with a different spelling become two customers, so choose one way to write each name and stay with it, or give each customer a short number and use that.

What a remake needs

Leather briefcase pattern pieces and hand tools laid out on a workbench

Disclosure: Marcellino NY is my own business, so I have a financial interest in it

Marcellino NY has been my own business since 2010. It makes handmade English bridle leather briefcases and offers bespoke customization. Two things I learned there shape how I would build an order sheet. The first is an early lesson: too many customization options make every piece different, which makes each one hard to track and harder to remake. The second is that Marcellino NY is on social media, and customers have asked for an exact remake of a piece they saw there.

Both point at the same column. If a customer can come back and ask for the same thing again, the order sheet has to say exactly what the first one was. That means a column for every choice that varied, filled with fixed words instead of a loose description, so that the next person to read the row, who may be you in a year, does not have to guess. The fixed words also expose the problem from the early lesson: if the column for a choice has thirty different entries, you offered too many choices.

This applies well outside leather. A shop that bakes to order, prints to order or sews to order has the same exposure. The customer remembers what they got, and your record has to be at least as exact as their memory.

Keeping it safe

A spreadsheet is a file, and files get passed around

The FTC’s third principle is lock it: protect the information that you keep. It covers physical security, electronic security, training for staff and checking the contractors and service providers who touch the data. For a small shop that becomes a short list.

  • Keep the sheet where only the people who need it can open it. The FTC states the principle as limiting employee access to what each person needs, which it calls the principle of least privilege.
  • Do not email the whole file. Send one row, or send nothing and let the person open the sheet.
  • Leave payment card numbers out of it entirely. The sheet needs to know that someone paid, not how.
  • Keep a copy somewhere other than the machine it lives on.

Its fourth principle, pitch it, covers the end of the data’s life. The FTC says to dispose of sensitive information you no longer need in a way that makes it unrecoverable, shredding paper before it is thrown out, and using wipe utilities on old computers and drives since ordinary deletion often leaves files recoverable. A customer who stopped buying five years ago, with nothing owed either way, is a candidate for deletion, not for a very polite filing system.

Some records have to stay for tax reasons, and that is a different question from the customer list. If an order row is also the only record of a sale, ask an accountant before deleting it.

Using the list

Locked filing cabinet beside a paper shredder in a small back office

A customer list that nobody reads is a diary. Pick one question per month that the sheet can answer: who ordered once and never again, which source column brings repeat customers, which orders carried the most notes. Then look.

One honest turn against all of this tidiness: a spreadsheet can only hold what someone remembered to type, and the busiest hours at a counter are exactly when nobody types anything. The fix is a habit of ten minutes at the end of the day, not a better template.

Dates deserve a rule of their own. Pick one format, write it the same way every time, and keep it in a column that does nothing else, because a sheet that sorts by date is the only way to find last spring’s orders without scrolling through everything since. Free-text status words behave the same way. If an order can be new, in progress, ready or done, those four words are the whole list, and a fifth that someone invents at the counter is a sign the process changed and the sheet did not.

Xero’s point about junk data applies in the other direction too. A list that has been filled in carelessly, with half-spelled names and a source column that says “?”, teaches you nothing and can mislead you into thinking you know your customers. Clean the sheet when you look at it, not once a year.

For informational purposes only. The privacy and recordkeeping rules that apply to a customer list depend on what you collect and where your customers live; consult a licensed attorney or accountant before deciding what to keep or delete.

Sources