What basic data privacy practices should a small business implement to protect customer information?

• A. Collect as much data as possible and share with partners.
• B. Limit data collection, secure storage, access controls, encryption, clear privacy notices, and respond to breaches promptly.
• C. Store data unencrypted and with loose access controls.
• D. Ignore privacy notices and rely on vendor trust.

Answer: (B)

Protecting customer information hinges on minimizing data collection, securing storage and access, encrypting data, providing clear privacy notices, and having an incident response plan. Collect only what you truly need to operate, which reduces the risk if data is breached. Store data securely and enforce access controls so only authorized staff can view it, applying least-privilege principles. Use encryption to protect data both at rest and in transit, so sensitive information stays unreadable even if defenses fail. Publish straightforward privacy notices that explain what you collect, how you’ll use it, who you share it with, how long you keep it, and how customers can exercise their rights. Prepare to respond to breaches promptly to contain damage and meet any legal obligations. Other options expose customers to greater risk, or place trust in vendors without proper controls, which is not a sound privacy practice.