A small or midsize business can have privacy obligations even if it is not a hospital, bank, or technology giant. The rules that matter depend on where your customers are, what personal data you handle, how much you process, and what your contracts require.
This is an operational overview, not legal advice. Privacy laws change, and thresholds and exemptions can be fact-specific. Ask qualified legal counsel whether a particular law applies to your business.
START WITH HOW YOUR BUSINESS HANDLES DATA
Privacy-law reviews often get stuck on the question, “Which law applies to us?” Start with the facts that help answer it:
- Where are your customers and website users?
- What personal information do you collect, including through cookies, analytics, forms, and advertising tools?
- How many consumers’ records do you handle each year?
- Do you process sensitive information, such as health, biometric, or precise location data?
- Do you sell or share data, including for targeted advertising?
- Do enterprise customers require specific privacy or security terms?
Map the information from collection to deletion. Include systems, people, service providers, and third parties, not just the main customer database.
STATE CONSUMER PRIVACY LAWS: THRESHOLDS ARE NOT ALL THE SAME
By 2026, a growing number of states have comprehensive consumer privacy laws. Many use data-volume thresholds, but their definitions, exceptions, and effective dates differ. Having customers in a state does not automatically mean every law applies to you. It does mean you should check the law’s actual scope rather than assume your company is too small.
California’s CCPA, as amended by the CPRA, is a useful example. It generally applies to certain for-profit businesses doing business in California if they meet at least one of these tests:
- Annual gross revenue above $26.625 million.
- Buying, selling, or sharing personal information about 100,000 or more consumers or households annually.
- Receiving at least 50% of annual revenue from selling or sharing consumers’ personal information.
The state adjusts the revenue threshold periodically. “Sharing” for cross-context behavioral advertising can matter even when no money changes hands. California’s official CCPA statute describes the business tests and consumer rights.
Other state laws can reach businesses at lower data volumes or use different tests. Montana’s law, for example, includes a 25,000-consumer threshold, while several states use thresholds around 35,000 consumers or a lower consumer count combined with revenue from data sales. Texas and Nebraska use small-business exclusions tied to the U.S. Small Business Administration definition rather than a simple consumer-count threshold. Connecticut’s 2026 amendments also make certain processing, such as handling sensitive data or selling personal data, important to the scope analysis.
The practical point: there is no one nationwide threshold to apply. Keep an eye on state laws taking effect later, too. Oklahoma and Louisiana are scheduled to take effect in 2027; Alabama in 2027; and Vermont in 2028. A business’s obligations can change as its customer base, data practices, or the law changes.
GDPR CAN APPLY TO A SMALL U.S. BUSINESS
The EU’s General Data Protection Regulation (GDPR) does not offer a blanket exemption just because a company is small. It may apply to a U.S. business that offers goods or services to people in the EU or monitors their behavior there. The European Commission explains the GDPR’s reach and the limited circumstances in which certain small organizations may have lighter record-keeping requirements on its SME guidance page.
That record-keeping relief is not a general exemption from the GDPR. Small businesses may still need to handle rights requests, protect personal data, document relevant processing, and meet other requirements based on their activities.
If you actively market to people in Europe, run tracking or profiling tools aimed at them, or process their information for a customer, ask counsel to assess your role and obligations. Don’t decide based on company size alone.
SECTOR RULES AND CUSTOMER CONTRACTS ALSO COUNT
A comprehensive state privacy law may not be your only concern. The information you handle and the work you do can bring other requirements into play.
Examples include:
- GLBA requirements for certain financial institutions and related service providers.
- COPPA requirements involving online services directed to children under 13 or their personal information.
- HIPAA requirements for covered health care entities and business associates. HIPAA is addressed separately and does not automatically cover all health-related data handled by other businesses.
- State breach-notification laws, which may apply when certain personal information is compromised. Requirements and timelines vary by state.
- Customer and vendor contracts that require privacy controls, security measures, audit evidence, or prompt breach notices.
PCI DSS is an industry standard rather than a general privacy statute, but payment-card contracts can still make it a practical obligation. Enterprise customers may also require a data processing agreement (DPA), security questionnaire, or specific incident-notification commitment as a condition of doing business.
THE PRACTICAL COMMON DENOMINATOR
You do not need to implement every law in the same way to build a sound starting point. These five practices support many privacy and security obligations, and make it easier to adapt as your business grows.
1. MAP THE DATA
List what personal information you collect, where it comes from, why you use it, where it is stored, who can access it, and which vendors receive it. Include business systems such as email, CRM, cloud storage, analytics, support tools, and backups.
An inventory does not need to be complicated to be useful. It needs to be accurate enough to answer questions and update when systems or vendors change.
2. COLLECT AND KEEP LESS
For each category of data, identify a clear business purpose. Avoid collecting information “just in case.” Set retention rules so records are not kept indefinitely without a business or legal reason.
Data minimization reduces exposure as well as administrative work. Less data in fewer places is generally easier to secure, locate, and delete when appropriate.
3. PLAN FOR CONSUMER RIGHTS REQUESTS
Depending on the law, people may have rights to access, correct, or delete information, or to opt out of certain sales or targeted advertising. Establish a clear intake route, a way to verify requests proportionately, and a process for finding data across systems and vendors.
Assign an owner and a response timeline. California, for example, generally requires responses to verified requests within 45 days, with a limited extension in some circumstances. Other laws may set different requirements. Legal counsel can help determine which deadlines and exceptions apply.
4. REVIEW VENDORS AND DPAs
Know which vendors process personal information for you, what they do with it, and how they protect it. Review contracts for permitted uses, security expectations, subcontractors, data-return or deletion terms, and incident notification.
A vendor’s standard terms may not meet your customer’s requirements or your legal obligations. Keep a record of reviews and escalate gaps instead of assuming a contract label resolves them.
5. ALIGN INCIDENT RESPONSE WITH NOTIFICATION DUTIES
Your incident plan should identify who investigates, who makes decisions, how evidence is preserved, and who contacts affected customers, regulators, insurers, and business partners when required. Notification obligations vary by law and situation. Under the GDPR, for example, a supervisory authority may need to be notified within 72 hours when the applicable conditions are met; the rule is not that every incident requires the same notification.
Prepare the decision path before an incident. Your legal counsel should help assess notification requirements; your technical team should be able to establish what happened and which data may be involved.
A MANAGEABLE FIRST STEP
For many SMBs, the first phase is an inventory and gap review, followed by prioritized changes to systems, vendor terms, and internal procedures. As a planning estimate, an initial technical and operational review may take two to four weeks, depending on the number of systems, vendors, and business units involved. Implementation may take longer when changes require new tools, contract negotiations, or coordination with customers.
There is no responsible one-size-fits-all price range without knowing your systems and scope. We can help identify the technical work, clarify assumptions, and provide a scoped estimate. We do not provide legal advice; we recommend legal counsel for decisions about applicability, exemptions, notices, and contract language.
Five 9’s security services include cybersecurity consulting and compliance support, and our IT consulting services can help you turn priorities into a practical plan. We focus on reliable controls, clear ownership, and knowledge transfer so your internal team can maintain the work as your needs change.
If you are unsure which data flows to review first, contact us for an honest conversation. We’ll help you understand the technical picture, be direct about what we can support, and point you to legal counsel when the question requires it.
