If your small business collects personal information through a website, contact form, app, or customer list, you should check which privacy requirements apply and whether you need a privacy policy. The answer depends on your activities and the laws that cover them. A useful policy explains what you collect, how you use it, and who receives it. Posting a policy alone does not make those practices compliant.
What personal data does a small business collect?
Start with the information people give you directly: names, email addresses, phone numbers, mailing addresses, and details they enter in a contact form. Customer records can also include purchase histories, appointment details, and notes about service requests.
Then look at what your tools collect. Depending on their settings, website analytics, advertising tools, apps, and payment systems may collect or process information such as IP addresses, device details, browsing activity, and transaction records.
You don't have to sell information to have privacy responsibilities. Collecting it, storing it, or sending it to another company can raise questions you need to address.
Which privacy rules apply?
The United States does not have one comprehensive federal privacy law covering every business and every kind of personal data. States have written their own laws, and the rules differ. Federal requirements also exist for particular activities and types of information.
For a Lincoln, Nebraska, business, the review shouldn't stop at where the office is located. Where customers live, what information the business handles, and whether a law's coverage thresholds or exceptions apply can all matter. Being small doesn't settle the question either way.
What should a privacy policy say?
A privacy policy tells people what happens to their information. It should reflect the business's actual practices, using language a customer can follow. Depending on the applicable requirements, the policy may need to address:
- What you collect and where it comes from: information submitted through forms, gathered by website tools, or received from other sources.
- Why you use it: for example, answering inquiries, providing services, processing orders, or sending marketing messages, if those are your practices.
- Who receives it: including the vendors or categories of companies that handle information for you.
- How long you keep it: or how you decide when it is no longer needed.
- What choices or rights people have: along with a way to contact the business or submit a request.
The policy should not promise something your business cannot do. If it says customers can request deletion, for example, you need to understand how to handle that request under the applicable rules and across the systems holding their information.
Where do copied policies and unreviewed tools leave gaps?
A copied policy describes someone else's business. It may name tools you don't use, omit tools you do use, or make promises that don't match your practices.
Another common gap is having no record of what you collect. You can't describe your data practices accurately if nobody knows where form submissions go or which systems still hold old customer records.
Vendors matter, too. A booking tool, email platform, or website plug-in may handle information even when you rarely open its dashboard. Review its role, settings, and terms rather than assuming the vendor takes care of every privacy obligation.
What should you check first?
- List the collection points. Include website forms, apps, customer lists, and any tools connected to them.
- Follow the information. Record what each tool collects, why you need it, where it goes, who can access it, and how long it stays.
- Compare practice with policy. Identify what the business is doing right, what it is doing wrong, and what still needs review.
- Build a plan to stay compliant as you grow. Address the gaps and review privacy implications before adding new tools or new uses for customer information.
You don't need to guess at every legal question before starting this inventory. A clear record of your practices makes it easier to identify the requirements that apply and the changes worth prioritizing.
Request a data privacy consultation
Graves Legal is Aaron Graves's solo business-law practice in Lincoln, Nebraska. To discuss your business's data practices, privacy policy, and compliance plan, request a consultation with Graves Legal.
This article provides general information, not legal advice for your business.