Yeah, that is the correct behavior what I would expect in a business setting - its a basic decency, not to mention customers switching to competition if they find out their data is not protected.