Run it with less chaos · Every business
Customer Data Privacy Basics for Small Service Businesses
The Federal Trade Commission's guidance for businesses comes down to five habits, know what you keep, keep less, lock it, dispose of it properly and plan for a breach, and a small service business can put all five in place in an afternoon.
A small service business protects customer data by following the Federal Trade Commission's five principles: take stock of the personal information it holds, keep only what it needs, lock up what it keeps, dispose of what it no longer needs and plan ahead for a security incident. Some businesses also fall under specific federal rules, such as tax preparers under the FTC Safeguards Rule and many dental and medical practices under HIPAA, so the checklist below starts with the habits that apply to everyone and ends with the rules that apply to some.
General information, not legal/tax/financial advice; talk to a licensed professional about your situation.
The checklist to copy
| FTC principle | What it means for a service business | Do this week |
|---|---|---|
| 1. Take stock | List every place customer details live: the booking system, intake forms, email, texts, card terminal, photos on phones, paper files, door codes and lockbox numbers | Write the list on one page, with who can see each place |
| 2. Scale down | Collect only what the service needs, and keep it only as long as needed, under a written retention policy | Stop asking for details you never use; never keep full card numbers or Social Security numbers unless a rule requires them |
| 3. Lock it | Give each employee only the access their job needs, use long passwords and multi-factor sign-in, lock paper files and encrypt laptops and phones | Turn on multi-factor sign-in for email, booking and payment accounts; give each person their own login |
| 4. Pitch it | Shred paper and wipe devices properly before they are sold, returned or thrown away | Shred old intake forms past your retention period; wipe retired phones and tablets |
| 5. Plan ahead | Name who leads the response if something goes wrong, and know whom you may need to notify | Write a half-page plan: disconnect the affected device, call the person in charge, check your state's notification rules with an attorney |
Rules that apply to some businesses
- Tax preparers and some other financial businesses: the FTC Safeguards Rule requires a written information security program with a designated person in charge, and these businesses must report to the FTC, within 30 days of discovery, any breach of unencrypted information involving at least 500 consumers. Firms holding information on fewer than 5,000 consumers are exempt from some, not all, of the rule's requirements.
- Dental, medical and other health practices: HIPAA covers health care providers such as doctors, dentists, chiropractors and psychologists when they send health information electronically for standard transactions like insurance claims, which includes most practices that bill insurance.
- Businesses that take cards: card networks require security standards for anyone who accepts cards, so use a payment provider's terminal or link rather than writing card numbers down.
- Everyone: state laws set their own rules for notifying customers after a breach, which is why the plan in step 5 includes a call to an attorney.
Why it works
Most breaches start with people rather than technology. The 2025 Verizon Data Breach Investigations Report, which analyzed 12,195 confirmed breaches, found a human element, such as a clicked phishing link, a reused password or a mistake, in 60% of them, and found a third party, such as a vendor or software provider, involved in 30%, double the share of the year before.
That is why the cheapest steps in the checklist, separate logins, multi-factor sign-in, keeping less and asking vendors how they protect your clients' details, address the most common causes.
Sources
- Federal Trade Commission. Protecting Personal Information: A Guide for Business. 2016, updated 2024.
- Federal Trade Commission. FTC Safeguards Rule: What Your Business Needs to Know.
- U.S. Department of Health and Human Services. Covered Entities and Business Associates.
- Verizon. 2025 Data Breach Investigations Report. 2025. 22,052 incidents, 12,195 confirmed breaches.
Related reading: One Place for Every Client's Details: Record Keeping for Salons, Trades and Practices · Text Message Marketing for Small Businesses: What's Allowed and What Works · The Five Kinds of Software a Small Service Business Needs (and What to Cancel) · Running a Mobile Service Business: Routes, Supplies and Scheduling
Email hello@osnovaops.com about your business if you want help mapping where your customers' details live and setting up the simple habits that protect them.
osNOVA also runs free live events for owners, listed at osnovaops.com.