Data protection sounds like a legal programme. In a small business it is closer to housekeeping: know what you hold, keep it in fewer places, give access to fewer people, back it up and practise getting it back. The legal requirements matter, but the operational basics are what prevent the bad week.
This seven-step plan is designed to be completed over a month, not a year. Each step produces a document or a configuration change you can show to a client, an insurer or a regulator. Skip the theatre and focus on the controls that change outcomes.
Step 1: Inventory where data lives
List every system that stores customer, employee or supplier data: email, CRM, accounting, support desk, cloud drives, HR tools, marketing platforms and the physical files in the office. For each one, record the owner, the type of data, who has access and the retention period.
Expect surprises. The spreadsheet a salesperson keeps on a personal drive is part of your data estate, whether or not IT knows about it. The goal is not a perfect inventory; it is a living list with a named owner for each system.
Step 2: Classify what matters
Use four simple levels: public, internal, confidential and restricted. Restricted covers payment data, government identifiers, health information, credentials and anything that would cause serious harm if disclosed. Confidential covers customer records and commercial contracts. Internal is ordinary business material. Public is marketing content.
Classification decides everything that follows: who can access it, how it is encrypted, how long it is kept and what happens if it leaks. If every folder is "important", nothing is.
| Level | Examples | Minimum handling |
|---|---|---|
| Restricted | Payment data, IDs, credentials, health records | Encrypted, least privilege, access logged, no personal email |
| Confidential | Customer records, contracts, payroll | Named accounts, MFA, encrypted at rest, retention rule |
| Internal | Meeting notes, internal plans | Company accounts only, shareable with the team |
| Public | Website copy, published prices | No special handling |
Step 3: Reduce and control access
Apply least privilege: people get the access their role needs, not the access that is convenient. Remove admin rights from everyday accounts. Use named accounts instead of shared logins. Review access when someone changes role and remove it the same day they leave.
Turn on MFA for every system that supports it, starting with email and the password manager. Use a business password manager so credentials are generated, stored and shared deliberately rather than pasted into chats.
Step 4: Build backups you can restore
Follow the 3-2-1 rule: three copies of important data, on two different media, with one copy off-site. Add immutability or offline retention so ransomware cannot encrypt the backup along with the original. Cloud sync is not a backup; if a file is deleted or encrypted, the sync copies the damage.
Define recovery targets before you shop for tools: how much data can you afford to lose (recovery point objective) and how long can you be offline (recovery time objective). A small accounting firm may tolerate four hours of lost work but not two days of downtime. Those numbers determine the design.
Test restores on a schedule. A monthly single-file restore and a twice-yearly full restore are enough for most small businesses. Record the date, the person and the result.
What to back up
- Accounting and payroll data
- CRM and customer records
- Cloud documents and shared drives
- Email and calendars, if they are not covered by the provider's retention
- Website content and databases
- Configuration and credentials for critical systems
Step 5: Encrypt data at rest and in transit
Use full-disk encryption on every laptop and phone. Require HTTPS for internal tools. Encrypt restricted data before it leaves your systems, especially when sending files to a client or storing them on removable media. Keep keys separate from the data they protect.
Email is not a secure transport for restricted data. Use a secure portal or an encrypted archive with a password sent through a different channel. If a client insists on email, document the decision and the risk.
Step 6: Write an incident response page
You do not need a 40-page manual. One page with six sections is enough to start: who declares an incident, how to contain it, who to call, what to preserve, how to communicate and how to review afterwards. Include out-of-hours contacts and the insurer's number.
- Detect and declare: what counts as an incident and who makes the call.
- Contain: disable accounts, isolate devices, revoke sessions.
- Assess: what data, how many people, what legal notification duties apply.
- Communicate: who speaks to customers, staff and regulators, and with what message.
- Recover: restore from a known-good backup and verify integrity.
- Review: a blameless post-mortem with dated actions.
Keep a printed copy. If your systems are encrypted by ransomware, your incident plan should not live only on the affected network.
Step 7: Train people and review vendors
People are not the weakest link; unclear processes are. Train staff to recognise phishing, report suspicious messages without shame and use the password manager. Run a short simulation twice a year and use the results to improve, not to punish.
Review vendors that touch your data. Ask where data is stored, who can access it, how it is encrypted, what happens on termination and whether the vendor has had a breach. Keep the answers with the contract. A cheap tool that cannot answer these questions is not cheap.
The one-page plan
| Area | Owner | Review |
|---|---|---|
| Data inventory and classification | Operations lead | Quarterly |
| Access reviews and leavers | IT or ops | Monthly |
| Backups and restore tests | IT or vendor | Monthly / twice yearly |
| Incident response contacts | Managing director | Every six months |
| Staff awareness | HR or ops | Twice a year |
| Vendor due diligence | Owner of the contract | At renewal |
Where to spend first
If the budget is limited, spend in this order: password manager and MFA, tested backups, disk encryption, then awareness training. These four remove the most common causes of serious loss. Fancy endpoint detection is useful, but it will not save you from a missing backup or a reused password.
Common mistakes
Treating cloud sync as backup. It replicates deletions and encryption. Keep an independent copy.
Giving everyone admin rights. Convenience today becomes a containment problem tomorrow.
Never testing recovery. An untested backup is a hope, not a control.
Collecting more data than needed. The safest record is the one you never stored. Delete what you do not use.
Writing a plan nobody can find. Store it offline, print it and tell people where it is.
The bottom line
Data protection for a small business is a set of ordinary habits: a current inventory, fewer copies, tighter access, tested backups and a plan for the bad day. None of it requires an enterprise budget. It requires someone to own the checklist and a calendar reminder that actually gets respected.
Start with the inventory this week and the backup test this month. Two small actions now are worth more than a perfect policy that stays in a drawer.
