New Data-Privacy Law Takes Effect: Compliance Steps for Small Businesses

The latest data-privacy law lowers the threshold for who must comply, sweeping in many small businesses for the first time. The good news: the core obligations are manageable if you start now.

Who is now covered

The law reaches businesses that collect personal information above a modest volume — a bar that ordinary marketing lists and customer databases can cross.

If you collect email addresses, run a loyalty program or use website analytics tied to individuals, assume you are in scope until you confirm otherwise.

Your first three steps

Map what personal data you collect, where it lives and who you share it with. You cannot protect or disclose what you have not inventoried.

Update your privacy notice and build a simple process for handling access and deletion requests within the statutory deadline.