Privacy rules used to feel like a big-company problem. Not anymore. As of 2026, about 20 U.S. states have their own consumer privacy laws, and more take effect each year. Add older rules like Europe’s GDPR, and a small business with customers in several states can fall under several laws at once. The good news: most of these laws ask for the same basic things. This checklist turns them into plain steps you can actually work through.
Why this matters for a small business
Many of these laws do not have a size cutoff. If you hold data on residents of a state, the state’s rule can apply to you, even from across the country. Regulators have started to enforce, and fines are real. But the point is not fear. Most of the work is good practice anyway: be clear about the data you collect, protect it, and let people ask what you have. Do that, and you are most of the way there.
The checklist
Work through these, roughly in order:
- Say what you collect. Post a clear privacy notice that lists the data you gather and why.
- Get real consent. Ask before you collect, record the yes, and let people take it back.
- Honor people’s rights. Give a simple way to see, correct, delete, or move their data.
- Name your vendors. Disclose the outside tools that touch customer data, like email or ad services.
- Lock the data down. Use encryption, multi-factor sign-in, and limited access. Weak security is a privacy problem, and our security controls checklist covers the basics.
- Manage cookies. Let visitors accept or refuse tracking, not just click OK.
- Set a retention rule. Decide how long you keep data, and delete it on schedule.
- Keep the notice current. Date it, review it each year, and note any use of AI to make decisions about people.
What has changed lately
A few trends are worth knowing. Breach-notice clocks are getting shorter, and some rules want you to report within days. More laws now cover children’s data with extra care. And regulators increasingly ask you to explain when software, not a person, makes a decision that affects someone. None of this requires a law degree. It requires a plan and a yearly review. It is part of the wider work of IT compliance.
How to keep it manageable
You do not have to solve every law at once. Start with a clear, honest privacy notice and strong security. Those satisfy the core of almost every rule. Then handle data requests with a simple inbox and a set process. Treat this as a yearly habit, not a one-time project. The laws will keep changing, and a steady routine keeps you from starting over each time.
Most privacy laws ask for the same core things: tell people what you collect, protect it, and let them ask what you hold. You do not need to master 20 laws. Start with an honest privacy notice and strong security, handle data requests with a simple process, and review it once a year. That covers the heart of almost every rule.
A few fair questions
Do these laws apply if we only sell locally?
Maybe. Many state laws apply based on where your customers live, not where you are based. If you have customers or website visitors in a state with a law, it can reach you. When in doubt, follow the stricter rule.
Do we need a lawyer?
For the basics, no. A clear privacy notice, real consent, and strong security cover most of it. Bring in legal help if you handle sensitive data, such as health records or children’s data, or if a regulator contacts you.
What is the fastest first step?
Read your own privacy notice. If it is missing, vague, or years old, fixing it is the highest-value hour you will spend. Then confirm multi-factor sign-in is on everywhere.
Want help sorting which rules reach your business? Book 15 minutes with Wayne Libonati, President & CEO. Prefer to start on your own? Score your current IT relationship in about 3 minutes.
