Data privacy for small teams

Every audit we run turns up some version of this. Most advice about data privacy assumes a team that does not exist at your size. Here is the version that does not.

The realistic threat for most small businesses is automated and opportunistic, not targeted. The version that survives contact with a real deadline is the simple one.

What to keep

Collect only what you can justify keeping. The cost of getting this wrong is rarely visible on the day it happens. The failure mode is not doing it wrong, it is doing it once and assuming it stays done.

What to drop

Process that exists to coordinate ten people is overhead when there are two of you. Where this goes wrong is almost never a lack of knowledge.

Where to start

Know where personal data actually lives. The teams that handle this well are rarely the ones with the biggest budgets. It is worth deciding this deliberately rather than inheriting whatever the last person set up.

What this looks like day to day

The cheapest security work is the boring kind done on a schedule. Three things worth confirming about data privacy before you move on:

• Someone can say what the current setup is without going to look
• Collect only what you can justify keeping — and you know whether that is true here
• There is a way to tell whether the last change to this helped

If any of that sounds like a description of your current setup, it is fixable.