Small Business Data Privacy: What You're Responsible For

TL;DR: Data privacy rules are not just for big companies. The ones that catch small businesses depend on what data you handle or what you do, not how large you are. Start by listing the personal information you keep, where it lives, and who can reach it, then delete what you do not need and put a privacy policy in place that matches what you actually collect.

Most small business owners assume compliance and risk management around customer data is a problem for companies with legal departments. It is not. Small businesses have paid real penalties for data privacy failures, and several of them did not know the rule applied to them. This post walks through which rules reach small businesses, what enforcement actually looks like, and the simple first step you can take this week to reduce your small business data privacy risk.

Why Privacy Rules Reach Small Businesses

The privacy laws that make headlines, like California's CCPA, do carry size thresholds. The CCPA applies above $26,625,000 in annual revenue (as adjusted January 1, 2025) or when other data-volume tests are met, so most small businesses really are below that line.

( Ricardo Unikel, Esq., Of Counsel at Company Counsel LLC)

The rules that actually catch small businesses are triggered by the data you touch or the work you do. Here are the most common ones:

• You are a health care provider (a dentist, therapist, or chiropractor). HIPAA has no size threshold.
• Your website or app is aimed at children under 13. The Children's Online Privacy Protection Act (COPPA) has no size threshold.
• Your website collects personal information from California residents. The California Online Privacy Protection Act (CalOPPA) requires you to post a privacy policy, regardless of size.
• You scan employee fingerprints or faces in Illinois. The Illinois Biometric Information Privacy Act (BIPA) has no size threshold.
• You prepare taxes, broker loans, or give financial advice. The FTC Safeguards Rule applies. Having fewer than 5,000 consumers eases a few requirements, but you are still covered.
• You hold Social Security, driver's license, or account numbers. State breach notice and data security laws in all 50 states generally apply with no size threshold.
• You hold personal data on Massachusetts residents. Massachusetts regulation 201 CMR 17.00 requires a written security program, and the state's own checklist is written for "a small business or individual."
• You sell sensitive data in Texas. The Texas Data Privacy and Security Act (section 541.107) applies specifically to small businesses and requires consent first.

A related misconception is "I'm not in that state." Breach notice and data security laws generally follow where your customer lives, not where you are. A Florida accountant with Massachusetts clients is subject to the Massachusetts rule.

What Enforcement Looks Like for Small Businesses

These are public enforcement actions against other businesses, not our clients, but they show how the wake-up call tends to arrive.

• A North Carolina dental practice (HIPAA, 2022). Dr. U. Phillip Igbinadolor & Associates posted a patient's information online in response to a negative review, then ignored the federal Office for Civil Rights (OCR) data request and subpoena. The result was a $50,000 civil money penalty with no chance to negotiate.
• A Pennsylvania dental practice (HIPAA, 2026). A patient complained that she could not get her own records. The practice said a staff member had stolen them, and it had no access policies. It paid a $140,000 settlement after OCR proposed a civil money penalty.
• A small app developer (COPPA, 2020). HyperBeard, Inc. used third-party ad networks in its cartoon-style apps that collected children's ad IDs without parental consent. The FTC imposed a $4 million penalty, all but $150,000 of it suspended because the company could not pay. The full amount comes due if its financial statements prove false.
• A New York CPA firm (state data security and breach notice law, 2025). A 2023 ransomware attack exposed unencrypted Social Security numbers for 5,881 people, and clients were not told until November 2024. Wojeski & Company paid $60,000 and agreed to a full security program, per the New York Attorney General.
• A New York City law firm (HIPAA as a hospital vendor, and New York data security law, 2023). Hackers used an unpatched email server, exposing data on about 114,979 people. Heidell, Pittoni, Murphy & Bach paid $200,000 and agreed to a list of required security controls.

What Fixing It Actually Involves

The penalty is only part of the bill. In each of these cases the business also had to deal with the following:

• Hiring lawyers. Each business needed counsel to answer the regulator, negotiate the settlement, and, after a breach, handle notice obligations. Skipping this step costs more. The North Carolina practice never answered OCR's request or subpoena, so the penalty was imposed without a hearing. The Pennsylvania practice requested a hearing and settled before it took place.
• Years of investigation. The Pennsylvania practice received OCR's proposed penalty on July 31, 2024 and signed its settlement on August 11, 2026. Wojeski's first breach was in July 2023 and it settled in October 2025. The New York law firm was hacked in November 2021 and settled in March 2023.
• Notifying affected people. Breach cases can require mailed notices and credit monitoring.
• Remedial action. Settlements may require new written policies and security controls, and reputational damage may follow.

The First Thing to Check: What Data You Hold

When a client asks whether they are compliant, the first thing we check is what personal data the business actually holds, and whose. You cannot judge your exposure until you know that.

Once the data is mapped, a privacy policy is the next step. In some cases the law requires one. CalOPPA, for example, requires any commercial website or online service that collects personal information from California residents to post one. For a broader look at the rules that apply to your business, see our guide to business compliance laws.

Who Can Worry Less

A local, offline-heavy business with little or no customer data has low exposure. Think of a landscaper, a handyman, a bakery that takes cards only through a processor like Square, or a business-to-business consultant whose "customer data" is business contacts.

That said, almost no business with employees holds zero sensitive data.

A Simple First Step You Can Take This Week

Spend one hour making a one-page list of every kind of personal information your business keeps, where it lives, and who can reach it. Then delete or shred anything you do not need. Finally, put a privacy policy in place that is consistent with the data you actually collect.

Key Takeaways

• Most privacy rules that reach small businesses are triggered by the data you hold or the work you do, not by your size.
• Health care providers, businesses serving children under 13, and anyone holding Social Security, driver's license, or account numbers are covered regardless of size.
• Breach and data security laws generally follow where your customer lives, not where you are.
• Regulator cases can run for years and cost far more than the penalty alone.
• Start with a one-page inventory of the personal data you keep, delete what you do not need, and match your privacy policy to what you collect.

When to Get Help

If your inventory turns up health information, children's data, financial account numbers, or customers in several states, it is worth having a lawyer review it before a regulator or a breach forces the issue. Contact Company Counsel and we will help you work out which rules apply to your business and what to put in place.

About the author: Ricardo Unikel, Esq. is Of Counsel at Company Counsel LLC, focusing on business law and intellectual property law.