Compliance
What Your Small Business Must Know About Data Privacy Laws
A plain-English guide to the data protection rules most likely to affect Texas and Tennessee small businesses: the FTC Safeguards Rule, GLBA, HIPAA, the Texas and Tennessee privacy laws, GDPR, and CCPA, plus practical compliance and breach response steps.
You come into work on Monday, coffee still hot, only to find your email full of urgent messages. An employee wants to know why their login is not working. Another says their personal information has shown up in places it should not. Suddenly, that list of things to get done is replaced by one big, pressing question: What went wrong?
For too many small businesses this is how a data breach becomes real. It is a legal, financial, and reputational mess. IBM's Cost of a Data Breach Report 2026 puts the global average cost of a breach at a record $4.99 million, and Verizon's 2026 Data Breach Investigations Report found that smaller organizations are disproportionately hit by ransomware.
Knowing the rules around data protection is a survival skill. This guide is written for small businesses in Texas and Tennessee, and it starts with the federal rules most likely to apply to you before turning to state and international privacy laws. It is general information, not legal advice, so confirm which laws apply to your business with your counsel.
Why Data Regulations Matter More Than Ever
The last few years have made one thing clear: Small businesses are firmly on attackers' radar. They are easier to target than a Fortune 500 giant and often lack the same defenses. That does not mean they are hit less often. It means the damage can cut deeper.
Regulators have noticed. Federal rules already set security requirements for financial and healthcare businesses, and a growing patchwork of state privacy laws, including laws in Texas and Tennessee, is reshaping how companies handle personal data.
The fallout from getting it wrong is not just financial. It can:
Shake client confidence for years.
Stall operations when systems go offline for recovery.
Invite legal claims from affected individuals.
Spark negative coverage that sticks in search results long after the breach is fixed.
So, yes, compliance is about avoiding penalties, but it is also about protecting the trust you have worked hard to build.
The Regulations and Compliance Practices You Need to Know
Before you can follow the rules, you have to know which ones apply. Many businesses serve clients across states, and sometimes across countries, so you may be under more than one set of rules at the same time.
Below are some of the core laws affecting small businesses, starting with the federal rules.
FTC Safeguards Rule and GLBA
If your business extends credit, arranges financing, prepares taxes, or otherwise offers a financial product or service, you may be a non-bank financial institution under the Gramm-Leach-Bliley Act (GLBA). Auto dealers, mortgage brokers, tax preparers, and title companies are common examples. The FTC's Safeguards Rule (16 CFR Part 314) requires these businesses to keep a written information security program with specific controls, including multi-factor authentication, encryption, and secure disposal of customer information. Since May 2024, it also requires notifying the FTC within 30 days when unencrypted information about 500 or more consumers is acquired without authorization. Our guide to understanding the FTC Safeguards Rule covers the details.
HIPAA
If you are a healthcare provider, health plan, or clearinghouse, or a vendor that handles patient information on their behalf, HIPAA applies. The Security Rule requires administrative, physical, and technical safeguards for electronic patient data, and the Breach Notification Rule requires notifying affected individuals without unreasonable delay and no later than 60 days after a breach is discovered.
Texas Data Privacy and Security Act (TDPSA)
In effect since July 1, 2024, the TDPSA applies to businesses that operate in Texas or offer products or services Texans use and that process or sell personal data. It has no revenue threshold, but businesses that meet the U.S. Small Business Administration's definition of a small business are generally exempt, except that they may not sell a consumer's sensitive data without consent. Financial institutions subject to GLBA and organizations governed by HIPAA are also exempt. Covered businesses must honor consumer requests to access, correct, and delete their data and to opt out of targeted advertising and data sales. The Texas Attorney General enforces it.
Tennessee Information Protection Act (TIPA)
In effect since July 1, 2025, TIPA applies to businesses with more than $25 million in annual revenue that also handle the personal information of at least 175,000 Tennessee consumers, or of at least 25,000 Tennessee consumers while earning more than half of their revenue from selling personal information. Financial institutions subject to GLBA, HIPAA-regulated organizations, and licensed insurance companies are exempt. TIPA gives businesses an affirmative defense if they keep a written privacy program that reasonably conforms to the NIST Privacy Framework. The Tennessee Attorney General enforces it.
General Data Protection Regulation (GDPR)
The EU's GDPR can reach a U.S. business that offers goods or services to people in the EU or monitors their behavior there. It requires a lawful basis for processing personal data. Consent is one of six lawful bases, and it does not need to be in writing, but it must be freely given, specific, informed, and clear. The GDPR also limits how long data can be kept and gives people the right to access, correct, delete, or move their data. Fines can reach 20 million euros or 4% of annual worldwide turnover, whichever is higher.
California Consumer Privacy Act (CCPA)
Gives people in California the right to know what information is collected, ask for it to be deleted, and choose not to have their information sold or shared. It applies to for-profit businesses that do business in California and meet at least one threshold, such as annual gross revenue above an inflation-adjusted figure ($26,625,000 since January 1, 2025) or buying, selling, or sharing the personal information of 100,000 or more California consumers or households.
Other State Privacy Laws
More states pass comprehensive privacy laws every year, and each sets its own thresholds. Some, like Texas and Nebraska, have no revenue threshold but exempt small businesses as the Small Business Administration defines them, except for the sale of sensitive data. Others, like Tennessee, apply only above a revenue and volume threshold. Consumer rights vary by state, but most include access to data, deletion, correction, and the ability to opt out of targeted advertising.
Compliance Best Practices for Small Businesses
Here is where the theory meets the day-to-day. Following these steps makes compliance easier and keeps you from scrambling later.
1. Map Your Data
Do an inventory of every type of personal data you hold, where it lives, who has access, and how it is used. Do not forget less obvious places like old backups, employee laptops, and third-party systems.
2. Limit What You Keep
If you do not truly need a piece of information, do not collect it in the first place. If you have to collect it, keep it only as long as necessary. Furthermore, restrict access to people whose roles require it, which is known as the principle of least privilege.
3. Build a Real Data Protection Policy
Put your rules in writing. Spell out how data is classified, stored, backed up, and, if needed, securely destroyed. Include breach response steps and specific requirements for devices and networks.
4. Train People and Keep Training Them
Verizon's 2026 report found a human element in 62% of breaches. Teach staff how to spot phishing, use secure file-sharing tools, and protect their accounts with a password manager and multi-factor authentication. Make refresher training part of the calendar, not an afterthought.
5. Encrypt in Transit and at Rest
Use TLS on your website, VPNs for remote access, and encryption for stored files, especially on portable devices. If you work with cloud providers, verify they meet security standards.
6. Don't Ignore Physical Security
Lock server rooms. Secure portable devices. If it can walk out the door, it should be encrypted.
Breach Response Essentials
Things can still go wrong, even with strong defenses. When they do, act fast. Bring your lawyer, your cyber insurer if you have one, IT security, a forensic expert, and someone to handle communications together immediately. Isolate the systems that are affected and revoke any stolen credentials, but do not wipe or delete affected systems or data until your forensic team and counsel agree. Logs and affected systems are evidence, and you will need them to work out what happened and who must be notified.
Once stable, figure out what happened and how much was affected. Keep detailed notes; they will matter for compliance, insurance, and future prevention.
Notification laws vary, and the deadlines are short. Texas requires notice to affected individuals within 60 days of determining a breach occurred, and notice to the Texas Attorney General within 30 days if 250 or more Texans are affected. Tennessee requires notice to affected residents within 45 days of discovery. HIPAA and the FTC Safeguards Rule add their own federal deadlines. Meet each one. Finally, use the experience to improve. Patch weak points, update your policies, and make sure your team knows what has changed.
Protect Your Business and Build Lasting Trust
Data regulations can feel like a moving target because they are, but they are also an opportunity. Showing employees and clients that you take their privacy seriously can set you apart from competitors who treat it as a box-ticking exercise.
You do not need perfect security. No one has it. You do need a culture that values data, policies that are more than just paper, and a habit of checking that what you think is happening with your data is actually happening.
That is how you turn compliance into credibility.
If your business falls under the FTC Safeguards Rule, GLBA, or HIPAA, Cyber One Solutions can help you put the security controls behind those rules in place. Learn more about our compliance support, or contact us to talk through where your business stands.