A phishing email lands in your bookkeeper's inbox. She clicks, and for two days someone outside your company has access to the customer list. When you call a lawyer, two different sets of questions come back at you. Were your safeguards reasonable? Do you have to notify anyone, and how quickly? And separately — were you allowed to hold that data at all, for that long, for that purpose? The first questions come from cybersecurity law. The second come from data privacy law. They often arrive together, but they are not the same rules, and confusing them leads to expensive mistakes.
Two Laws, Two Different Jobs
Cybersecurity law is about protection and response. It asks whether you kept personal information safe and what you must do when that safety fails. Privacy law is about permission and control. It asks what you are allowed to do with personal information and what the person it belongs to can demand from you. One is largely technical and procedural. The other is largely about consent, transparency and individual rights.
In practice, a business can violate one while fully satisfying the other. You can store data securely and still break privacy rules by keeping it longer than you said you would. You can follow every privacy notice requirement and still be found negligent when a breach happens.
Security law asks how well you protected the data. Privacy law asks whether you should have had it in the first place.
What Cybersecurity Law Actually Covers
Cybersecurity obligations come from several directions, and they rarely live in one tidy statute. Breach notification laws, sector-specific rules for health, financial and children's data, regulator expectations around reasonable security, and the security clauses your larger customers insist on all pull in the same direction.
Most of these rules expect something along these lines:
- Reasonable technical safeguards: patching, access controls, multi-factor authentication, encryption, tested backups.
- Logging and monitoring of access to sensitive systems, so you can reconstruct what happened.
- Due diligence on vendors, with security terms written into contracts rather than assumed.
- A written incident response plan with a real person's name against each step.
- Notification to affected individuals and, in some cases, regulators or law enforcement within legal deadlines.
- Cooperation with regulators during an investigation, including documentation of what you did and when.
Definitions matter here. What counts as a breach, whether a notice is required, and how fast you must act all vary by jurisdiction and by the type of data involved. A short delay in deciding can turn a manageable incident into a regulatory problem.
What starts the clock
Usually it is the moment you become aware of an incident, not the moment you finish investigating. That is why a simple log of what you saw, when you saw it and who you told is one of the most useful documents a small business can keep.
What Data Privacy Law Actually Covers
Privacy law governs the whole life of personal information: why you collect it, how you use it, who you share it with, how long you keep it and how you dispose of it. It also gives people rights they can exercise against you, which means your obligations often arrive as requests rather than as rules on a page.
Rights people can exercise
- Ask for a copy of the personal information you hold about them.
- Ask you to correct inaccurate details.
- Ask you to delete data, subject to legal retention requirements.
- Opt out of certain uses, such as sale, sharing or targeted advertising in some regimes.
- Appeal a refusal, in jurisdictions where that right exists.
Many privacy laws apply only to businesses above certain thresholds, based on revenue or the number of consumers they handle, and some categories of data — health, financial, children's — sit under separate regimes. If you sell to customers in the EU or UK, or handle data belonging to people there, GDPR-style rules may reach you regardless of where your business is registered.
Where the Two Overlap and Where They Diverge
The overlap is real, which is exactly why the distinction gets blurred. Consider a few scenarios.
- A stolen unencrypted laptop holding customer names and card numbers. A security failure, likely a notification duty, and a privacy problem if you were holding more than you needed.
- Selling your email list to a partner. Almost never a security breach. It is a privacy question about notice, consent and opt-out.
- An employee pasting the client list into the wrong email thread. Could be both, depending on who received it and what they did with it.
- A customer asking you to delete their account. A privacy request with no security dimension at all.
Same company, same week, four different legal conversations. The audience differs too: security incidents get reported to regulators and affected individuals, while privacy requests get answered to the person who made them, usually on a fixed deadline.
Why the Split Matters for a Small Business
Your biggest client's security questionnaire is a cybersecurity exercise. The privacy policy on your website is a privacy one. Consultants and software vendors tend to sell one and neglect the other, and it shows when a small team writes a careful privacy policy but leaves multi-factor authentication switched off on the accounting system.
There is also a budgeting reality. Security spending buys tools and time. Privacy spending buys process: a data inventory, a request workflow, updated contracts, a retention schedule. Neither is optional if you handle personal information at any scale, and neither substitutes for the other.
A Practical Way to Handle Both
If your time is limited, work in this order.
- Inventory personal data. What you collect, where it lives, who can see it, how long you keep it.
- Name your reason for holding each category. If you cannot name one, stop collecting it.
- Map your triggers. Which jurisdictions do your customers live in? Do thresholds apply? Any sector rules?
- Fix the basics: multi-factor authentication, patching, backups, least-privilege access, encryption on laptops and phones.
- Put privacy and security terms in vendor contracts, and check them before renewal rather than after.
- Write a one-page incident response plan, then walk through it once a year.
- Track deadlines in one calendar: privacy request response times, breach notification windows, policy reviews.
- Document decisions with dates. Regulators care about the process as much as the outcome.
Get Advice Before You Need It
Notice decisions are time-sensitive and jurisdiction-specific, and the wrong call is hard to undo. A short conversation with a lawyer who knows your industry and the states or countries where your customers live costs far less than a botched notification. This is general information, not legal advice, so confirm your own obligations before acting on any of it. Keep the plan simple, keep records, and revisit both whenever you change tools or hire.
Photo: stevepb / Pixabay
