PCI, HIPAA, state privacy laws — compliance obligations don't disappear just because you're small. Here's how to figure out which ones apply to you.
When business owners hear the word "compliance," they tend to think of big corporations with legal departments and dedicated compliance officers. Certainly not their 12-person dental practice or the small retail store that's been in the family for thirty years.
But here's the uncomfortable truth: compliance obligations don't scale by company size. If you process credit cards, you have PCI requirements. If you handle patient health information, HIPAA applies to you whether you have two employees or two thousand. If your customers live in California, you may already have CCPA obligations. The regulations don't care how many people work for you.
The even more uncomfortable truth is that most small business owners don't know this. We see it constantly — businesses that have been unknowingly out of compliance for years, exposed to fines and liability that nobody warned them about. This isn't a scare tactic. It's just the reality of how these regulations work, and it's fixable once you know what applies to you.
Let's walk through the major frameworks, figure out which ones you might actually fall under, and talk about what "compliance" practically means for a small business. This isn't legal advice — for that you need an attorney — but it should give you a much clearer picture of where to focus your attention.
The Payment Card Industry Data Security Standard (PCI DSS) applies to any business that accepts, processes, stores, or transmits credit card data. That's a very broad net — and it probably catches you.
This isn't a law, technically. It's a set of requirements maintained by the major card brands (Visa, Mastercard, etc.), and compliance is required by your merchant services agreement. Violating it can result in fines from your payment processor, higher transaction fees, or — in the worst case — losing the ability to accept cards altogether. After a breach, non-compliance can also expose you to liability for fraudulent charges.
The good news: PCI compliance for small businesses is usually a "self-assessment questionnaire" process, not a full audit. The questionnaire that applies to you depends on how you accept cards:
The most common small business failure: running a payment terminal on the same network as everything else, with no segmentation. We've written about network segmentation elsewhere — it matters for security cameras and IoT devices too — but for PCI it's specifically required. Your payment network should be isolated from your general business network. If it isn't, that's a compliance gap and a security risk at the same time.
Your merchant services provider or payment processor should have PCI resources available. If they haven't walked you through the self-assessment questionnaire, ask them about it.
HIPAA — the Health Insurance Portability and Accountability Act — applies to what it calls "covered entities" and their "business associates." Covered entities are healthcare providers (doctors, dentists, therapists, chiropractors, optometrists), health plans, and healthcare clearinghouses. Business associates are vendors who handle protected health information (PHI) on behalf of a covered entity — think billing services, IT providers who have access to medical records systems, or cloud storage vendors a practice uses to store patient files.
HIPAA violations aren't just theoretical. The Department of Health and Human Services has fined medical practices with fewer than ten employees. A solo therapy practice in California was fined $25,000. A small dental practice was fined for emailing unencrypted patient records. The penalties scale by severity and willfulness, but they start at $100 per violation and can reach $50,000 per violation for willful neglect.
What does HIPAA compliance require practically? The key pieces are:
If you're in healthcare and your IT isn't specifically HIPAA-aware, that's a problem worth addressing. Generic IT support doesn't cut it when your systems contain PHI. Your IT provider needs to understand healthcare compliance, not just fix computers.
This is the area where most small business owners are most surprised. There is no single federal data privacy law in the United States — instead, there's a growing patchwork of state laws, each with its own requirements and thresholds.
The most well-known is the California Consumer Privacy Act (CCPA), now strengthened by CPRA. It applies to for-profit businesses that meet certain thresholds: annual gross revenues over $25 million, OR buying/selling personal data of 100,000+ consumers annually, OR deriving 50% or more of annual revenue from selling consumer data. Most small businesses won't hit those thresholds — but if you operate in California or serve California customers, it's worth confirming you don't.
More practically relevant for many small businesses are breach notification laws. Every state now has one. If your business suffers a data breach and customer personal information is compromised, you are almost certainly required by law to notify those customers. The specifics vary by state — what counts as a breach, how quickly you must notify, what the notification must include — but the obligation is nearly universal.
Other state laws that may apply depending on your industry and location:
This sounds complicated, and it is — which is exactly why most small businesses don't address it. But "I didn't know" has never been a successful defense in a data breach lawsuit, and it won't be with regulators either.
Here's the thing about compliance: a lot of it overlaps with just running a secure business. Encrypt your sensitive data. Control who has access to what. Have a backup plan. Document your procedures. Know what you'd do if something went wrong. These are good practices regardless of which regulation applies to you.
We tell our clients to think about compliance not as a checkbox exercise but as a framework for building good habits. If your security posture is solid — if you have real layered security in place, documented procedures, and a real disaster recovery plan — you're probably most of the way to compliant in whatever framework applies to you. The compliance documentation is often just capturing and formalizing what you're already doing.
That said, there are some specific steps worth taking right now:
You can't protect data you don't know about. Do a basic inventory: what types of sensitive data does your business collect and store? Credit card numbers? Patient records? Social Security numbers? Employee personal information? Where is each type stored — on a server, in the cloud, in email, in paper files? Who has access to it?
This isn't a huge project. An afternoon with a spreadsheet is often enough to get a clear picture. But it's foundational to everything else.
Based on the data you hold, figure out which frameworks are relevant. If you're unsure, talk to your attorney — this is exactly the kind of question they can help you answer quickly. Many business attorneys can do a 30-minute compliance overview for a modest fee, and it's worth every dollar.
Every compliance framework includes breach notification requirements. If you discovered tomorrow that your systems had been compromised and customer data had been accessed, what would you do? Who would you call? How quickly are you required to notify customers? Your state attorney general? Your payment processor?
If you don't have answers to those questions, you need a basic incident response plan. It doesn't have to be elaborate — a one-page checklist covering who does what in the first 24 hours is infinitely better than nothing. Our post on what to do after a data breach covers the basics if you want a starting point.
Most compliance requirements have a technical component: encryption, access controls, audit logging, multi-factor authentication. If your IT infrastructure is held together with duct tape and good intentions, compliance is harder to achieve and maintain. Getting your IT fundamentals solid first makes everything else easier.
Compliance doesn't maintain itself. Someone in your organization needs to own it — to make sure the security risk assessment gets done each year, that new employees get trained, that vendor agreements include the right language. In a small business, this might be you. That's fine. Just make sure it's someone, with a clear responsibility, and not a task that falls through the cracks because everyone assumed someone else was handling it.
A few things we want to be clear about, because we hear a lot of misconceptions:
Compliance is not the same as security. A business can be technically compliant and still get breached. Compliance is a minimum floor, not a ceiling. The goal is actually being secure, which goes beyond checking boxes. If you've been thinking "we did our PCI questionnaire so we're good," please revisit that assumption.
Cyber insurance doesn't replace compliance. Cyber insurance is valuable — we recommend it for most businesses — but many policies have requirements. Some won't pay out on a claim if you weren't compliant with applicable regulations or if you didn't have basic security controls in place. Compliance and insurance work together; neither replaces the other. See our post on what to know about cyber insurance for more on that.
Compliance doesn't expire when you complete the paperwork. It's ongoing. Data environments change, regulations update, new threats emerge. The security risk assessment under HIPAA isn't a one-time thing — it's supposed to be reviewed and updated regularly. Building compliance into your annual rhythm is the only sustainable approach.
"We're too small to be a target" is not a compliance strategy. We've addressed this misconception before. Small businesses are targeted precisely because they often have the same types of data as larger companies but much weaker protections. Regulators don't exempt small businesses either — the penalties are lower in absolute terms, but they're structured as percentages or per-violation amounts that can still be devastating to a small operation.
We want to close with something that might be counterintuitive: don't let the scope of this paralyze you. Compliance is one of those topics where the perfect becomes the enemy of the good. Many small businesses do nothing because the full picture feels overwhelming. That's the worst outcome.
Start with the most obvious: do you take credit cards? Get your PCI questionnaire done. Do you handle patient data? Get a BAA with your IT provider and schedule a security risk assessment. Have a data breach? Know who you'd call in the first hour.
Then build from there. Each step you take reduces your exposure and makes the next step easier. The goal isn't a perfect compliance program on day one — it's steady, meaningful progress toward running a business that handles customer data with the care it deserves.
If you're not sure where your gaps are, a practical IT assessment can help you see the technical side of the picture. We look at these things regularly for our clients, and we're happy to have an honest conversation about what you're dealing with. Our IT Buyer's Guide can also help you think through what questions to ask any provider you work with on this.