Privacy Policies and Data Protection for Small Businesses
If you collect an email address, take an online order or run analytics on your website, you handle personal data. Privacy laws in many countries now apply to businesses of every size. This explainer covers the main laws, what a privacy policy should say and the habits that keep customer data safe.
Key takeaways
- A privacy policy explains what personal data you collect, why, and what rights people have.
- GDPR and UK GDPR can apply to small businesses, including some outside Europe that serve European customers.
- CCPA/CPRA in California applies to businesses that meet set thresholds, and many other US states have their own laws.
- This is general information, not legal advice. Privacy laws differ by country and state and change often.
Privacy can feel like a big-company problem. But the moment you run a contact form, a newsletter, an online shop or a booking system, you are collecting information about real people. Customers increasingly care how that information is handled, and regulators in many countries expect even small organizations to follow the rules.
The aim of this guide is to give you a clear map: which laws might apply, what your privacy policy should contain and which practical steps reduce risk. It focuses on the most widely discussed frameworks, but remember that dozens of other countries and US states have their own privacy laws.
What counts as personal data
Personal data, called personal information in some laws, is broadly any information that relates to an identified or identifiable person. Common examples in a small business include:
- Names, email addresses, phone numbers and postal addresses
- Order history, payment details and account logins
- IP addresses, cookie identifiers and device data from your website
- Employee and job applicant records
- Photos, voice recordings or video that show identifiable people
Some categories get extra protection. Under GDPR these are called special category data, such as health, religion, ethnicity, sexual orientation and biometric data. California uses the term sensitive personal information. Handle these with extra care, and collect them only if you truly need them.
The main privacy laws small businesses meet
GDPR (European Union)
The General Data Protection Regulation applies to organizations established in the EU and, in many cases, to organizations outside the EU that offer goods or services to people in the EU or monitor their behavior there. There is no general small business exemption, although a few specific duties scale with size and risk.
Key ideas include having a lawful basis for each use of data, such as consent, contract or legitimate interests; collecting only what you need; keeping data accurate and secure; and respecting individuals' rights to access, correct, delete and object to the use of their data.
UK GDPR (United Kingdom)
After Brexit, the UK kept a version of GDPR, known as UK GDPR, alongside the Data Protection Act 2018. The Information Commissioner's Office (ICO) is the regulator. The principles are very similar to the EU rules, but the UK has been updating its framework, so check the ICO's current guidance. Many UK organizations that process personal data must also pay an annual data protection fee to the ICO unless they are exempt.
CCPA and CPRA (California)
The California Consumer Privacy Act, as amended by the California Privacy Rights Act, applies to for-profit businesses that do business in California and meet at least one threshold: annual gross revenue above a set amount that is adjusted for inflation, buying, selling or sharing the personal information of 100,000 or more California consumers or households, or earning half or more of annual revenue from selling or sharing personal information. Many very small businesses fall below these thresholds, but growing online businesses should keep checking.
Covered businesses must give notice at collection, honor rights to know, delete and correct, and allow consumers to opt out of the sale or sharing of their information. The California Privacy Protection Agency and the state Attorney General enforce the law.
Other laws to keep in mind
A growing number of US states have passed their own comprehensive privacy laws, and many countries, including Canada, Brazil, Australia, Japan and South Africa, have national laws. There are also sector-specific rules for areas like health data, children's data and marketing emails or texts.
| Law | Where it applies | Who enforces it | Small business note |
|---|---|---|---|
| GDPR | EU, plus non-EU businesses targeting or monitoring people in the EU | National data protection authorities | No general size exemption |
| UK GDPR and Data Protection Act 2018 | UK, plus non-UK businesses targeting or monitoring people in the UK | Information Commissioner's Office | Many must pay an annual ICO fee |
| CCPA/CPRA | Businesses dealing with California residents that meet thresholds | California Privacy Protection Agency and Attorney General | Many small firms fall below thresholds |
Common mistake
Copying another company's privacy policy. It will describe their data, their tools and their legal position, not yours. A policy that does not match what you actually do can mislead customers and create its own legal risk. Write yours from a map of your own data.
What your privacy policy should cover
A privacy policy, sometimes called a privacy notice, is a public explanation of how you handle personal data. Requirements vary by law, but most good policies cover:
- Who you are and how to contact you about privacy
- What data you collect, both directly and automatically, such as through cookies
- Why you collect it and, under GDPR-style laws, the lawful basis for each purpose
- Who you share it with, such as payment processors, email platforms, hosting providers and advisers
- International transfers, if data leaves the country or region
- How long you keep it, or how you decide
- People's rights and how to exercise them
- How you protect it, in general terms
- When the policy was last updated
Write it in plain language. Regulators in the EU and UK stress that privacy information should be concise, transparent and easy to understand.
How to get compliant, step by step
- Map your data. List every place you collect personal data: forms, checkout, email lists, booking tools, analytics, spreadsheets and paper files. Note what you collect, why, where it is stored and who can see it.
- Check which laws apply. Look at where you are based and where your customers are. Check thresholds for laws like CCPA/CPRA.
- Cut what you do not need. Stop collecting fields you never use and delete old data you no longer need. Less data means less risk.
- Review your vendors. Check that service providers who handle data for you have suitable data processing terms and security.
- Write and publish your policy. Base it on your data map and link to it from your website footer and from the places you collect data.
- Set up a process for requests. Decide who handles requests to access or delete data and how you verify identity. Many laws set response deadlines, such as one month under GDPR in most cases.
- Plan for breaches. Write a short plan for what to do if data is lost or stolen, including who decides whether to notify regulators and customers.
Pro tip
Treat your data map as a living document. Add a line every time you sign up for a new app that touches customer data. When you later update your privacy policy, most of the work is already done.
Hypothetical example
Imagine a US-based online candle shop that ships to customers in Germany and France. Because it offers goods to people in the EU, GDPR may apply even though the shop has no European office. The owner maps her data and finds an old spreadsheet of past customers with birth dates collected for a discontinued birthday promotion. She deletes the column, updates her privacy policy to list her payment, shipping and email providers, and adds a simple request process with a dedicated email address.
A note on cookies and marketing
Two everyday activities trip up many small businesses. The first is website cookies and tracking. In the EU and UK, separate rules on electronic communications generally require consent before placing non-essential cookies, such as many analytics and advertising cookies, on a visitor's device. The second is marketing messages. Many countries restrict sending marketing emails or texts without prior consent or an existing customer relationship, and require an easy way to unsubscribe. Review your cookie banner and email sign-up forms as part of your data map.
Security: the other half of data protection
Privacy laws generally require appropriate security for personal data. For small businesses, the basics go a long way: strong unique passwords, multi-factor authentication, updated devices, limited access and secure backups. The separate cybersecurity checklist on this site walks through these controls in detail.
Benefits of good privacy practice
- Builds trust with customers and partners
- Reduces the impact of a breach or lost device
- Makes it easier to work with larger clients who audit suppliers
Risks of ignoring it
- Regulatory fines and orders to change practices
- Complaints and loss of customer trust
- Being dropped by partners or platforms that require compliance
Your data protection checklist
- Map all personal data you collect, store and share
- Check whether GDPR, UK GDPR, CCPA/CPRA or other laws apply
- Delete data and form fields you do not need
- Confirm data processing terms with key vendors
- Publish a clear, accurate privacy policy
- Set up a process for access and deletion requests
- Turn on multi-factor authentication and limit access to customer data
- Write a simple breach response plan
Frequently asked questions
Does my small business legally need a privacy policy?
In many cases, yes. Laws such as GDPR, UK GDPR and California's privacy laws require you to tell people how you use their data, and many app stores, ad platforms and payment providers require a privacy policy too. Even where it is not strictly required, it is good practice.
Does GDPR apply to a business outside Europe?
It can. GDPR may apply if you offer goods or services to people in the EU or monitor their behavior, such as through certain tracking. Simply having a website that Europeans can visit is not always enough on its own; regulators look at whether you target EU customers.
Do I need consent for everything?
No. Under GDPR-style laws, consent is only one of several lawful bases. Processing an order, for example, often relies on contract. But consent is commonly required for things like non-essential cookies and some marketing messages.
How often should I update my privacy policy?
Whenever your data practices change, such as adding a new tool, a new type of data or a new market, and at least once a year as a check. Show the date of the latest update on the policy.
This article is general information, not legal advice. Privacy and data protection laws differ by country and state and change frequently. Check the guidance of your regulator and consult a qualified professional for advice on your situation.
Related reading
The bottom line
Almost every small business handles personal data, and privacy laws increasingly expect small firms to handle it well. Map your data, check which laws apply, collect less, publish an honest privacy policy and protect what you keep. These steps reduce legal risk and give customers one more reason to trust you.
