Data Privacy: GDPR, CCPA, and Small Business Obligations

Data Privacy Is Not Just for Big Tech

Every business that collects customer information has data privacy obligations. If you have a website with analytics, an email list, an e-commerce store, or even a CRM with customer contact details, you are handling personal data. The question is not whether privacy laws apply to you. It is which ones and what they require.

Small businesses are not exempt from data privacy regulation. In fact, many state and international laws apply regardless of company size. The good news is that compliance does not have to be expensive or complicated if you understand the requirements and build good habits early.

Understanding the Major Privacy Laws

GDPR (General Data Protection Regulation)

The EU's GDPR applies to any business that collects or processes personal data from EU residents, regardless of where the business is located. If you sell products or services to EU customers or even have EU visitors to your website, GDPR may apply.

Key GDPR requirements for small businesses:

Lawful basis for processing: You need a valid legal reason to collect and use personal data. Common bases include consent, contract performance, and legitimate interest.
Consent: Must be freely given, specific, informed, and unambiguous. Pre-checked boxes do not count.
Right to access: Individuals can request a copy of all personal data you hold about them.
Right to erasure: Individuals can request that you delete their personal data (the "right to be forgotten").
Data breach notification: You must report breaches to the relevant supervisory authority within 72 hours.
Data Protection Officer (DPO): Required for businesses whose core activities involve large-scale data processing. Most small businesses are exempt.
Privacy by design: Build data protection into your processes from the start, not as an afterthought.

Penalties for non-compliance can reach 4% of global annual revenue or 20 million euros, whichever is higher. However, enforcement against small businesses tends to focus on egregious violations rather than minor technical gaps.

CCPA/CPRA (California Consumer Privacy Act / California Privacy Rights Act)

California's privacy law applies to for-profit businesses that meet any of these thresholds:

Annual gross revenue over $25 million
Buy, sell, or share personal information of 100,000 or more consumers, households, or devices
Derive 50% or more of annual revenue from selling or sharing consumer personal information

Even if you do not meet these thresholds, understanding CCPA principles is good practice because many other states are adopting similar frameworks.

Key CCPA/CPRA requirements:

Right to know: Consumers can request what personal information you collect, use, and share.
Right to delete: Consumers can request deletion of their personal information.
Right to opt out: Consumers can opt out of the sale or sharing of their personal information. You must provide a "Do Not Sell or Share My Personal Information" link.
Non-discrimination: You cannot penalize consumers for exercising their privacy rights.
Data minimization: Collect only the personal information reasonably necessary for your disclosed purpose.

Other State Privacy Laws

Virginia (VCDPA), Colorado (CPA), Connecticut (CTDPA), Utah (UCPA), and several other states have enacted privacy laws with varying thresholds and requirements. The trend is clear: state privacy regulation is expanding. Build your practices to the highest standard you are likely to face.

Practical Steps for Small Business Compliance

Step 1: Data Mapping

Before you can protect data, you need to know what you have. Create a data inventory that documents:

What personal data you collect
Where it is stored (databases, spreadsheets, email, cloud services)
Who has access to it
How long you keep it
Who you share it with (including third-party service providers)

This does not need to be a complex exercise. A spreadsheet listing each data type, its source, storage location, and purpose is a solid start.

Step 2: Update Your Privacy Policy

Your privacy policy must accurately reflect your data practices. Review it against your data map and update it to cover:

All categories of personal information collected
The purposes for collection and use
Third parties with whom you share data
Consumer rights and how to exercise them
Your data retention periods
Contact information for privacy inquiries

Step 3: Implement Consent Mechanisms

If you rely on consent to collect data, make sure your consent mechanisms are compliant:

Use clear, affirmative opt-in for marketing communications
Implement a cookie consent banner that allows users to accept, reject, or customize cookie preferences
Do not pre-check consent boxes
Keep records of when and how consent was obtained

Step 4: Secure Your Data

Data security is a legal requirement under virtually every privacy law. The FTC's "Start with Security" guide recommends:

Access controls: Limit data access to employees who need it for their job functions.
Encryption: Encrypt sensitive data both in transit (HTTPS) and at rest.
Strong authentication: Require strong passwords and use multi-factor authentication for systems containing personal data.
Vendor management: Ensure your service providers maintain adequate security. Review their security practices and include data protection requirements in your contracts.
Regular updates: Keep software, operating systems, and security tools up to date.
Employee training: Teach employees to recognize phishing attempts and follow security protocols.
Incident response plan: Have a written plan for responding to data breaches before one occurs.

Step 5: Honor Data Subject Requests

Be prepared to respond to requests from individuals exercising their privacy rights:

Establish a process for receiving, verifying, and responding to requests
Respond within the timeframes required by applicable law (usually 30 to 45 days)
Document all requests and your responses
Train customer-facing staff to recognize and route privacy requests

Step 6: Prepare for Data Breaches

A data breach is any unauthorized access to personal information. Your response plan should include:

Identification and containment procedures
Assessment of the scope and severity
Notification to affected individuals and regulators as required by law
Remediation steps to prevent recurrence
Documentation of the incident and response

Most states have breach notification laws with specific timelines and requirements. Know the rules for every state where you have customers.

Common Data Privacy Mistakes

Collecting data you do not need. Every piece of data you collect is a liability. Only collect what you actually use for a legitimate business purpose.

Ignoring third-party risk. Your vendors have access to your customer data. If they have a breach, it is your problem too. Vet your vendors and include data protection clauses in your contracts.

Treating privacy as a one-time project. Privacy compliance is ongoing. Review your practices quarterly, update your privacy policy when your data practices change, and stay current on new legislation.

Assuming small size means exemption. The GDPR has no size threshold. Many state laws have low thresholds or no thresholds for certain types of data. Do not assume you are exempt without checking.

Neglecting employee data. Privacy laws often apply to employee data too. How you collect, use, and store HR data matters.

The Business Case for Privacy

Beyond legal compliance, strong privacy practices build customer trust. Consumers increasingly prefer businesses that respect their data. A transparent, well-communicated privacy program can be a competitive advantage, especially for small businesses competing against larger companies with worse privacy reputations.

Investing in privacy now prevents costly remediation later. The cost of implementing good data practices is a fraction of the cost of a data breach or regulatory enforcement action.