Election Year Issues: Privacy and Data Security for Small Businesses

With high-profile data breaches at large retail chains to suspected foreign hackers targeting confidential customer information from financial institutions, keeping employee, customer, and financial data safe should be among the top concerns of small-business owners. Here's a closer look at what businesses need to know about data privacy and security.

Increasing Regulations Set the Bar for Privacy and Data Security Protections

State legislatures and regulators are becoming increasingly involved in ensuring that businesses have adequate protections in place against cyber fraud. They are focused on protecting the financial, personal, and health data of businesses’ customers and employees. The U.S. and other countries are also taking action at the federal level to protect citizens' personal data in terms of how it's collected, stored, and processed. Businesses need to be aware that comprehensive data security and privacy concerns are only increasing in importance and that the regulatory environment is becoming more demanding and complex.

Processes, Policies, and Systems are Part of Compliance

As businesses are determining what steps to take to stay in compliance, it's important to consider processes, systems, and policies. What process are you using to collect data? Has it been vetted to identify potential risks of security breaches and has your staff been trained on best practices? Are your computer systems and employee policies designed with data protection in mind? Do you have a clear customer notification policy in place if a data breach has occurred? The stakes are high; businesses face significant penalties if they’re found to have caused a data breach through neglect or failure to have the right systems in place.

Now is the time to audit your processes, policies, systems, and enforcement. It's also important to look at all elements of your business, from internal data to how you track and store the information of visitors to your website.

What Happens after the Breach is as Important as What Happens Before

While taking all possible steps to protect consumer data is important, regulators are also looking closely at how companies handle the situation after a data breach has occurred. State and federal legislators have issued requirements on how and when customers need to be notified in the case of a data breach (in 2014 Florida passed the nation's most stringent laws in this area, which could ultimately serve as a national model), as well as guidelines on compensation and assistance to mitigate and prevent damage to consumer credit from data breaches (there have been several states that have bills in their legislatures that may require a business to offer 12 months of free credit monitoring to all individuals affected by a breach of security).

While staying up to date on and in compliance with regulatory changes may seem daunting, you don’t have to do it alone. Service companies like Paychex can help small businesses navigate the latest legislative changes affecting all areas of their business, from employment law to banking regulations.