Data Privacy for Small Businesses: The Essentials

Data privacy compliance in practice for a ten-person company isn't about hiring a law firm to produce an 80-page policy nobody reads. It's about having five key components in place: someone responsible for data, an inventory of what you store, a legal basis for each use, robust vendor contracts, and a plan for data breaches. This guide shows you how to set up each one, what it costs, and where small businesses often waste money.

TL;DR

• Small businesses (with annual revenue up to $4.8 million) often have simplified requirements under some data privacy regulations: they may not need a dedicated DPO, can use simplified record-keeping, and get double the response time. But they are not exempt from the law.
• The true minimum: a contact channel for data subjects, a data inventory, a legal basis for each purpose, data protection clauses in vendor contracts, and a one-page incident response plan.
• Significant incidents must be reported to relevant authorities and affected individuals within 3 business days; for small businesses, this is often extended to 6 business days. All incident records must be retained for 5 years.
• US regulatory bodies are increasing enforcement and reviewing compliance rules. The first LGPD fine, for example, was issued to a small business, demonstrating that size doesn't grant immunity.
• Buying a ready-made "data privacy compliance kit" rarely works: the documentation needs to accurately describe what your company actually does.

Before we begin, an honest disclaimer. I am not an attorney. I am a developer and CTO, and for over 15 years, I've operated servers, Moodle with student data, managed hosting, and integrations with the official WhatsApp API. What follows is the perspective of someone who implements the technical and operational aspects of data privacy laws, the side that most often fails in small businesses. For final contract drafting, a data privacy attorney remains the right person.

Data Privacy Compliance in Practice Starts with Knowing Your Business Size

US data privacy laws apply to any business that processes personal data: name, Social Security Number, phone, email, address, photo, purchase history. If you have customers, employees, or leads, you process personal data. No business is too small for data privacy laws, which is why discussing data privacy in practice starts with your business size, not just a document.

What does exist is a lighter regime. Some regulations define small-scale data processors as micro-businesses, small businesses, startups, non-profit organizations, and even individuals who process data as controllers. In practice, the cutoff is often based on annual gross revenue, such as up to $4.8 million (with similar limits for startups).

Who Loses the Benefit

Section 3 of such regulations typically removes the simplified regime for those engaged in high-risk processing. High risk is usually defined when you combine a general criterion (large-scale processing or processing that could significantly affect data subject rights) with a specific criterion, such as:

• use of sensitive data (health, biometrics, religion, union affiliation) or data concerning children, adolescents, and the elderly;
• decisions made solely by algorithm, such as automatic credit approval;
• surveillance of publicly accessible areas;
• use of emerging or innovative technologies.

A clinic with ten employees storing patient records, or a vocational school with minor students on Moodle, needs to look at this carefully. A construction supply store with customer registrations, probably not.

What Truly Changes

Obligation	Standard Business	Small Business (no high risk)
Data Protection Officer (DPO)	Mandatory	Waived, provided a communication channel with the data subject is maintained
Record of Processing Activities	Complete	Simplified, often with free templates from regulatory bodies
Security Policy	Proportional to risk	Can be simplified
Timeframe to respond to data subjects and report incidents	Standard	Double
Legal bases, principles, and data subject rights	Mandatory	Remain mandatory

The last line is what people often forget. Section 6 of such regulations explicitly states that flexibility does not exempt anyone from legal bases, principles, and data subject rights. Data privacy compliance in practice for small businesses means less paperwork, not less responsibility.

DPO or Communication Channel: The First Component of Data Privacy Compliance in Practice

The DPO (Data Protection Officer) is the person who receives complaints from data subjects, communicates with relevant regulatory authorities, and guides the team. For standard businesses, many data privacy laws require appointing one and publishing their name and contact information on the website. The role typically involves formal appointment, a substitute for absences, and attention to conflicts of interest.

For small businesses, some regulations waive the DPO requirement but demand a communication channel with the data subject. And there's a detail worth noting: appointing a DPO anyway counts as a good governance practice, one of the mitigating factors that regulatory bodies consider when calculating a penalty.

How to Do It Without Hiring Anyone

1. Create a specific email, such as [email protected], and publish it in your privacy policy and website footer.
2. Designate one person to check this email weekly. In a ten-person company, this is usually the managing partner or finance manager.
3. Write a short response script: confirm the requester's identity, locate the data, respond within the deadline, and log the request.
4. If you decide to formally designate this person as a DPO, create a simple, dated, and signed document. It costs nothing and works in your favor.

When Not to Do It

Do not appoint someone as a DPO who independently decides on data usage while also being responsible for overseeing that use, such as a marketing director who purchases lead lists. And do not outsource to a "DPO as a service" provider you've never met, who doesn't know your systems, and merely lends their name to your website. In our view, that's a facade, and a facade won't help when a real problem arises.

Data Inventory: The Map That Supports Everything Else

The data inventory, or record of processing activities, is the spreadsheet that answers: what data do I collect, from whom, for what purpose, where is it stored, with whom do I share it, and for how long do I keep it? Without it, everything else is guesswork. If I had to choose a single data privacy compliance task for a ten-person company, this would be it. You cannot choose a legal basis, review contracts, or respond to a data subject if you don't know where the data resides.

The good news: in June 2023, a US regulatory body published a simplified record-keeping template for small entities, a spreadsheet with a few fields (categories of data subjects, data, sharing, security measures, retention period, purpose, and legal basis). Using the template is not mandatory, but it's the shortest path.

How to Set It Up in an Afternoon

Gather the three or four people who handle data the most and go through your company's processes, one by one:

• Sales and Customer Service: CRM, quote spreadsheets, WhatsApp, website forms.
• HR: onboarding forms, medical exams, payroll, timekeeping, resumes received.
• Finance: invoices, collections, vendor bank details.
• Marketing: email lists, ad pixels, custom audiences.
• IT: backups, server logs, cameras, email accounts.

The Most Common Trap We Encounter

In the diagnostics we perform, the inventory almost always reveals the same three things: resumes from years ago stored in an email without a retention policy, spreadsheets with customer Social Security Numbers shared via public link, and old backups nobody knows exist. On servers we've taken over from other providers, we've found complete Moodle database copies forgotten in a publicly accessible web folder. The most dangerous data is the data you've forgotten you have, which is why data privacy compliance in practice starts with the map.

Legal Basis: Data Privacy in Practice Goes Beyond Consent

Whenever you use personal data, you need a legitimate purpose or legal justification. The most common mistake for small businesses is assuming everything depends on consent and adding an "I accept" checkbox on every form.

Consent is the most fragile basis: the data subject can revoke it at any time, and you need to prove it was freely given, informed, and specific. In day-to-day data privacy practice, most business routines have better justifications:

Process	Most Common Legal Basis	Observation
Issue invoices and retain accounting documents	Compliance with legal obligation	Does not depend on customer authorization
Deliver the product or provide the contracted service	Contractual necessity	Includes WhatsApp contact regarding the order
Payroll, tax filings, benefits administration	Legal obligation	Occupational exams involve sensitive health data
Debt collection	Exercise of legitimate rights / credit protection	Without exposing the debtor
Newsletter and offers for non-customers	Consent	Clear opt-in and easy unsubscribe
Cameras and access control	Legitimate interest (security)	Requires balancing test and visible notice

Legitimate Interest Has Rules

Legitimate interest is not a wild card. It requires that the use is something the data subject reasonably expects, that you document your reasoning, and that you respect their rights. Sending an offer to a customer who purchased last month tends to pass. Buying a phone list and sending messages does not. It was precisely this type of practice that led to the first LGPD fine, as we will see later.

If your company uses IA to respond to customers or summarize documents, the legal basis also applies to what goes into these tools. I wrote about this in the guide to an AI usage policy for businesses, which complements this section.

Vendor Contracts: Who is a Processor and What to Demand

Under data privacy laws, your company is typically the controller: it decides why data is used. Those who process data on your behalf are processors: your website host, cloud-based management system, accountant, email marketing platform, WhatsApp provider. By law, controllers and processors can be jointly liable for damages, so the contract with each processor matters.

A ten-person company usually has several vendors that handle personal data, and data privacy in practice includes knowing who they are. You don't need to renegotiate all of them tomorrow. Start with those that store the most data or the most sensitive data.

What the Contract Needs to Say

• that the vendor only processes data according to your instructions and for the contracted purpose;
• what security measures they maintain (encryption, access control, backup);
• how quickly they notify you of an incident, ideally within 24 to 48 hours, so you can meet your deadline with the relevant regulatory authority;
• if they use sub-processors and where the data is stored (US or abroad);
• what happens to the data at the end of the contract: return and deletion.

What We See From Our Side of the Counter

As a hosting provider and developers, we are processors for our clients. In managed Moodle hosting, for example, we store data for thousands of students, sometimes minors, and the question "how quickly will you notify me of an incident?" should be in every negotiation. Rarely is it.

With the official WhatsApp API, there's an extra layer: Meta processes messages, the customer service platform provider also does, and your company is the controller of the conversations. It's worth knowing where the histories are stored and for how long. If you operate Moodle, the guide to Data Privacy in Moodle delves deeper into the case for educational institutions.

When a vendor only offers standard terms, like major cloud providers, read their data protection addendum (DPA), save a copy, and record it in your inventory. You can't negotiate with Google, but you can know what they promise. This is also data privacy in practice done with honesty.

Incident Response Plan: Data Privacy in Practice on One Page

In day-to-day data privacy practice, a security incident is any event that compromises the confidentiality, integrity, or availability of personal data: a stolen laptop, a compromised email, a spreadsheet sent to the wrong customer, ransomware on the server.

US data breach notification laws and regulations define the rules. For small businesses, data privacy in practice, what matters is this:

• notification to relevant authorities (e.g., state attorneys general, FTC) and data subjects is mandatory when the incident could cause significant risk or harm, for example, when it involves sensitive data, data concerning children, adolescents, or the elderly, financial data, passwords and authentication data, confidential data, or large-scale data;
• the deadline is 3 business days from the moment you know the incident affected personal data;
• for small businesses, the deadline is often doubled (6 business days), unless there is a risk to the physical or moral integrity of data subjects;
• notification is typically done via an electronic form provided by the relevant authority;
• every incident, whether reported or not, must be recorded for at least 5 years.

The Plan Fits on One Page

1. Who decides: name and phone number of the coordinator (partner) and the technical lead (internal or vendor).
2. First hour: isolate the problem, change passwords, preserve evidence. Do not delete logs.
3. First day: determine what data and how many people were affected. This is where your inventory pays off.
4. By the deadline: decide if there is significant risk, notify relevant authorities and data subjects if applicable.
5. Afterward: record the incident and what changed to prevent recurrence.

Low-Cost Prevention

Some regulations accept a simplified security policy, and regulatory bodies often publish security guides for small entities. In data privacy practice, prevention is the cheapest part: two-factor authentication (2FA) for email and systems (I detailed this in the guide to two-factor authentication for businesses), backups with copies out of reach of ransomware, revocation of access on the day someone leaves the company, and updated systems. Most incidents we address started with a reused password, not a sophisticated attack.

Traps, Costs, and What US Regulators Are Focusing On

Data privacy compliance in practice has become more serious in recent months. US regulatory bodies, like the FTC and state attorneys general, are increasingly active, with enhanced resources and a focus on enforcement. They are continually reviewing enforcement regulations and sanctioning processes.

Penalties can range from warnings to fines of up to 2% of revenue, limited to $50 million per infraction, in addition to public disclosure of the infraction and blocking or deletion of data. And history shows that small size doesn't protect you: the first LGPD fine, published in July 2023, was applied to Telekall Infoservice, a micro-business, for offering WhatsApp contact lists for an electoral campaign. This resulted in $14,400 in fines, plus a warning for not appointing a DPO or demonstrating a legal basis.

Where Small Businesses Lose Money

• Off-the-shelf data privacy compliance kits. Generic privacy policy templates describe a company that isn't yours. If the document states you don't share data, but your CRM is hosted in the United States, it becomes evidence against you.
• Decorative cookie banners. An "accept" button that doesn't block any pixels until clicked doesn't deliver on its promise.
• Six-month compliance projects. For ten employees, data privacy in practice can be achieved in a few weeks of focused work.
• Do it once and forget it. Data privacy in practice is an ongoing routine: the inventory changes when you adopt a new system, and contracts change when you switch vendors.

What It Really Costs

Data privacy compliance in practice can cost close to zero if someone in the company has the time: the record-keeping template from regulatory bodies is free, the communication channel is an email, and the incident response plan is a single page. The cost appears in three areas: team hours to assemble the inventory, legal review of the most sensitive contracts, and technical corrections, such as activating 2FA, organizing backups, and closing access points. This last part is where most businesses get stuck, because it requires someone who understands servers, systems, and vendors simultaneously.

If you've read this far and realized you don't know where your company's data is, the problem isn't legal; it's diagnostic. That's precisely the starting point for technology consulting focused on security and data privacy.

How Agathas Web Solves This

Most small businesses don't need a full-time DPO to implement data privacy in practice. They need someone to map the technical landscape once, correct what's exposed, and make the routine simple enough for their own team to maintain.

At Agathas Web's consulting services, security and data privacy are key vectors we audit in every diagnostic. With us, data privacy in practice works like this:

• Free initial consultation to understand your company, systems, and where the most sensitive data resides.
• Technical deep dive with read-only access, under a bilateral NDA signed before starting: we map where data is stored, who has access, how backups, passwords, and vendors are managed.
• Practical deliverables: completed data inventory, incident response plan, access policy, list of vendor contracts to review, and prioritized technical corrections.
• Execution or ongoing support: if you wish, we implement corrections (2FA, backups, server hardening, access review); or we support your team in a CTO as a Service format.

A focused security audit lasts 2 to 3 weeks and costs between $6,000 and $12,000, with a fixed quote provided after the initial consultation. It is conducted by a company partner with experience operating Moodle in production, managed hosting, system development, and integrations with the official WhatsApp API. We are not a law firm: when a case requires legal review, we state this in the report and provide the technical material your attorney needs. And since we don't resell software, our recommendations are tailored to you.

Conclusion: Data Privacy in Practice is Routine, Not a Document

For a ten-person company, data privacy in practice boils down to five components: a communication channel (or DPO), an honest inventory, a legal basis for each purpose, contracts that specify what the vendor does with your data, and an incident response plan that someone knows how to use. The small business regime makes things lighter, but it doesn't erase the law, and US regulatory bodies are more structured than ever for enforcement.

Start this week with the inventory: gather those who handle data and fill out a template from a regulatory body. If you get stuck on the technical side, or if you discover data where it shouldn't be, schedule a free diagnostic with Agathas Web and leave with a plan that fits your company's size.