Data Protection and Privacy for Startups

Mortaria family, 8 Downing St., N.Y., making flowers wreaths. The Little three-year-old on left was actually helping, putting the center of the flower into the petal, and the family said she often works irregularly until 8:00 P.M. The other children, 9, 1 — Library of Congress

In the sea of global privacy regulations, how can startup companies build a good foundation around the way they treat data without going overboard on compliance? After all, the startup needs to focus on building its products, fundraising, and developing the business itself.

At the same time, there are good reasons for startups to pay attention to data protection: this is not solely about compliance, but about building customer trust. And building customer trust is key to all businesses, especially those who operate online.

One approach startups can take is to use the privacy notice as a starting point for their data protection program. But I don’t mean simply slapping up any privacy notice, but, instead, using the privacy notice to think a bit about the practices the startup has (or intends to have) around data.

Every online business will need a privacy notice and this project can be used as a way to think about a new business’s data practice. Privacy notices need to be accurate, truthful and up to date (see the FTC’s Protecting Personal Information: A Guide for Businesses). Because privacy notices should be updated as the business changes, or at least annually, the business can calendar a regular review of the privacy notice and, over, time, this process can be used to review the data protection program