Before you invest in data privacy

The gap between knowing this and actually doing it is where most teams lose ground. Before you spend anything on data privacy, it is worth confirming a few things are already true.

The cheapest security work is the boring kind done on a schedule. Most teams find the first pass takes an afternoon and the maintenance takes minutes a month.

Prerequisites

• You can describe the outcome you want in one sentence
• Someone owns it after the work is done
• Collect only what you can justify keeping
• You have a way to tell whether it worked

The mistakes we see most

Deletion policies matter as much as collection ones. It is worth being explicit about, because assumptions differ quietly. Most teams find the first pass takes an afternoon and the maintenance takes minutes a month.

Know where personal data actually lives. Small and consistent beats large and occasional here. Most teams find the first pass takes an afternoon and the maintenance takes minutes a month.

How to tell if yours is fine

The realistic threat for most small businesses is automated and opportunistic, not targeted. Three things worth confirming about data privacy before you move on:

• Someone can say what the current setup is without going to look
• Know where personal data actually lives — and you know whether that is true here
• There is a way to tell whether the last change to this helped

Worth checking on your own setup before it becomes someone else's problem to fix.