How can we improve WHMCS?

As the database backup contains personal information, under GDPR the email subject should contain the word "CONFIDENTIAL". So either code the email subject to be "CONFIDENTIAL - WHMCS Database Backup", or provide for a custom header/email to be used.

Also password protect the zip file.

Additionally, it may be pertinent to add a disclaimer to the email footer; This email is intended only for the persons named in the message header ... ... ...