Small businesses are not exempt by size alone. The good news: a few disciplined habits cover most of the ground.
Five things to do first
- List what personal data you collect, where it sits (forms, WhatsApp, Excel, accounting software), and why.
- Publish a clear privacy notice and link it next to every form.
- Use an unticked consent checkbox where consent is your ground, and keep a record.
- Name a person who answers privacy questions and handles complaints; publish their contact.
- Lock down access: strong passwords, separate logins, remove ex-staff, keep backups.
Common small-business traps
- Spreadsheets of customer phone numbers shared over chat groups.
- Marketing messages to everyone who ever enquired.
- No plan for what to do if a laptop or phone is lost.
Frequently asked questions
Do I need a lawyer?+
A lawyer is advisable for notices and contracts. A readiness assessment helps you prepare and know what to ask.
Relevant provisions
- Section 5Rule 3 · pending verificationPrivacy notice at or before collection
- Section 6(1)-(3)Valid consent for processing
- Section 8(5)Rule 6 · pending verificationReasonable security safeguards
- Section 8(10), Section 13Rule 14 · pending verificationGrievance redressal mechanism
Official sources
Legal reviewPending legal review · drafted 19 Oct 2026
See where your business stands.
Run a free evidence-based website scan or talk to a compliance specialist about implementation.