Keeping your business data private: a practical guide for small operators

If you hold anything about other people — a client list, a payroll file, a folder of scanned invoices, photographs from a site visit — you are holding data that somebody else cares about more than you do. Most small operators know this and still have no idea where that data physically sits. This guide is about closing that gap without turning your business into a compliance department.

What actually happens when you put data into a cloud tool

“The cloud” means a computer belonging to somebody else. When you upload a file, several things follow that are easy to overlook.

• A copy exists on infrastructure you do not control, and usually several copies, because durable storage means replication.
• Backups extend the lifetime of that data well beyond the moment you press delete. Deletion from the interface and deletion from the system are different events.
• Most services rely on sub-processors — hosting, email delivery, analytics, support tooling — so your data is handled by companies you have never chosen and may not be able to name.
• The data sits in a jurisdiction, and that jurisdiction's law applies to it. A tool that feels local may be storing your files on another continent.
• The provider's staff can usually access the data at some level. Encryption at rest protects against a stolen disk; it does not, on its own, mean nobody at the company can read your file.

None of this makes cloud tools wrong. It makes them a supply chain. The European Commission's guidance on international data transfers explains one consequence directly: transfers of personal data out of the EU are permitted freely only where the Commission has adopted an adequacy decision finding that the destination country offers an essentially equivalent level of protection, with a published list of countries and territories that qualify. Where there is no adequacy decision, other safeguards are required. That is a supply-chain question, and it belongs on your list of things to check before you sign up rather than after a client asks.

Why local-first matters for client confidentiality

Local-first software processes your data on your own machine and stores it in files you control. The security benefit is architectural rather than promissory: data that never leaves your laptop cannot be exposed by a vendor breach, cannot be subpoenaed from a provider who is not you, and cannot be quietly re-purposed by a change to somebody's terms of service.

For a small operator, the practical wins are specific. A confidentiality clause in a client contract is easier to honour when the calculation never leaves your device. There is no sub-processor list to review. There is no account to be compromised by a reused password. And there is no dependency on a company continuing to exist — a file on your disk still opens in three years.

The trade-offs are just as real, and pretending otherwise helps nobody. Local files need your own backups. Sharing between people is more manual. Sync across devices is your problem. The sensible position is not “never use the cloud”; it is to be deliberate about which category each piece of data falls into, and to keep the confidential and the merely convenient in different places.

The rules, at a high level

Privacy regimes differ in the detail, but the mainstream ones share a recognisable spine: collect only what you need, say what you are collecting it for, keep it secure, keep it no longer than necessary, let people see and correct what you hold, and tell someone when it goes wrong.

The EU and UK model

The General Data Protection Regulation covers organisations of any size, including a sole trader with a mailing list. There is no small-business exemption from the core principles. One obligation is worth knowing by heart: the European Commission's guidance on data breaches states that a breach posing a risk to individuals must be notified to the supervisory authority without undue delay and at the latest within 72 hours of becoming aware of it, and that individuals themselves must be told directly where the breach is likely to result in a high risk to them.

The UK Information Commissioner's Office publishes a self-assessment aimed specifically at small business owners and sole traders, which walks through the obligations in plain language and points at the relevant guidance. If you operate in the UK it is the cheapest hour of compliance work available.

Canada

The Personal Information Protection and Electronic Documents Act is built on ten fair information principles published by the Office of the Privacy Commissioner of Canada: accountability, identifying purposes, consent, limiting collection, limiting use, disclosure and retention, accuracy, safeguards, openness, individual access, and challenging compliance. They are a good general-purpose checklist even for businesses PIPEDA does not cover.

Canada's breach rules are worth noting because they include a record-keeping duty that catches people out. The Commissioner's guidance on mandatory reporting explains that organisations must report breaches of security safeguards posing a real risk of significant harm to the Commissioner, notify the affected individuals, and keep records of all breaches regardless of whether they meet that threshold. The guidance describes significant harm as including humiliation, damage to reputation or relationships, loss of employment or business opportunities, financial loss and identity theft, and states that breach records must be kept for two years.

Everywhere else

Australia's Notifiable Data Breaches scheme, described by the Office of the Australian Information Commissioner, requires organisations covered by the Privacy Act to notify affected individuals and the Commissioner where a breach is likely to result in serious harm. Many other countries have adopted similar structures, and plenty have not. The two safe assumptions for a small business trading across borders are that the rules apply where your customers are rather than only where you are, and that the practical requirements converge even where the legal text does not.

A practical checklist for a solo operator

1. Write a one-page inventory: what personal data you hold, where it physically lives, which tool touches it, and why you have it. Most people discover two systems they had forgotten.
2. Delete what you do not need. Old client files, exported reports, an address book from a business you no longer run. Data you do not hold cannot leak.
3. Sort what remains into confidential and routine, and stop mixing them. Confidential work belongs in tools that run on your own machine or in a service you have actually assessed.
4. Fix the basics of device security. The UK National Cyber Security Centre's guide for small organisations is built around backing up data, protecting devices, securing accounts and recognising scams — four things, no technical expertise assumed.
5. Back up properly and keep at least one backup disconnected from the machine it protects, because ransomware follows attached storage.
6. Turn on multi-factor authentication for email first. Email is the account that resets all the others.
7. Set retention periods and actually enforce them. “Keep quotes for two years, project files for seven” beats keeping everything forever.
8. Write a half-page breach plan: who you call, what you check, who you notify, and where the record goes. Under GDPR you may have 72 hours; you do not want to spend the first twelve deciding what to do.
9. Check your client contracts for confidentiality clauses before you put their data into any third-party service, including AI assistants.
10. Review once a year and whenever you adopt a new tool. Put it in the calendar or it will not happen.

What to ask before you adopt a tool

• Where is the data stored, in which country, and who are the sub-processors?
• What exactly happens when I delete something, and how long do backups retain it?
• Is my data used to train models or improve the product, and can I turn that off?
• Can I export everything in a usable format if I leave tomorrow?
• What does the provider commit to in writing about breach notification to me?
• Does this tool need my client's data at all, or would anonymised or partial data do the job?

That last question is the most valuable one on the list. A surprising amount of small-business software is asked to hold identifying detail it has no use for. Removing names and account numbers before a file goes anywhere is free, immediate, and reduces the consequences of every other failure.

The short version

You do not need a privacy programme. You need to know what you hold, hold less of it, keep the sensitive part on hardware you control, secure the accounts that guard the rest, and have a plan for the day something goes wrong. That is achievable in an afternoon, and it puts a one-person business ahead of a surprising number of much larger ones.

References

• European Commission. "What is a data breach and what do we have to do in case of a data breach?" https://commission.europa.eu/law/law-topic/data-protection/information-business-and-organisations/obligations/what-data-breach-and-what-do-we-have-do-case-data-breach_en
• European Commission. "Adequacy decisions." https://commission.europa.eu/law/law-topic/data-protection/international-dimension-data-protection/adequacy-decisions_en
• Information Commissioner's Office (UK). "How well do you comply with data protection law: an assessment for small business owners and sole traders." https://ico.org.uk/for-organisations/advice-for-small-organisations/getting-started-with-gdpr/assessment-for-small-business-owners-and-sole-traders/
• Office of the Privacy Commissioner of Canada. "PIPEDA fair information principles." https://www.priv.gc.ca/en/privacy-topics/privacy-laws-in-canada/the-personal-information-protection-and-electronic-documents-act-pipeda/p_principle/
• Office of the Privacy Commissioner of Canada. "What you need to know about mandatory reporting of breaches of security safeguards." https://www.priv.gc.ca/en/privacy-topics/business-privacy/breaches-and-safeguards/privacy-breaches-at-your-business/gd_pb_201810/
• Office of the Australian Information Commissioner. "About the Notifiable Data Breaches scheme." https://www.oaic.gov.au/privacy/notifiable-data-breaches/about-the-notifiable-data-breaches-scheme
• National Cyber Security Centre (UK). "Small organisations guide to cyber security." https://www.ncsc.gov.uk/collection/small-organisations-guide-to-cyber-security
• European Data Protection Board (2024). "EDPB opinion on AI models: GDPR principles support responsible AI." https://www.edpb.europa.eu/news/news/2024/edpb-opinion-ai-models-gdpr-principles-support-responsible-ai_en