Danon Computers blog
Los Angeles Small Business IT Guide: California Data Rules in Plain English
Running a Los Angeles small business means following California privacy and breach laws, even if you only have a handful of staff. This guide explains the rules that touch everyday IT, without the legal jargon.
This is general information from an IT provider, not legal advice. Ask your attorney how these rules apply to you.
Three California rules worth knowing
You must notify people after certain breaches
California Civil Code section 1798.82 requires a business to notify California residents when certain unencrypted personal information is acquired by someone unauthorized. Think Social Security numbers, driver’s license numbers, account numbers with access codes, medical details, or login credentials. If more than 500 residents are affected, a sample notice also goes to the Attorney General.
The word that matters most there is unencrypted. A stolen laptop with full-disk encryption is a very different event from one without it.
You are expected to use reasonable security
Civil Code section 1798.81.5 says businesses that own or license personal information about Californians must maintain reasonable security. The law does not list products. In practice, regulators and courts look for the basics: strong sign-in, current updates, encryption, limited access, and a way to recover.
The CCPA may apply to you
The California Consumer Privacy Act, as amended by the CPRA, applies to for-profit businesses that cross certain revenue or data thresholds. The California Privacy Protection Agency publishes the current figures. Many small offices fall below them, but the vendors and clients you work with may not, and they will ask about your controls.
A practical checklist for small offices
- Encrypt every laptop and phone that holds client information
- Require multi-factor sign-in on email, accounting software, and remote access
- Keep a simple list of where personal data lives, and who can open it
- Delete what you no longer need, on a schedule
- Back up off-site and test a restore at least twice a year
- Write a one-page plan for what happens if a device is lost or an account is taken over
City paperwork is separate from IT rules
The City of Los Angeles Office of Finance issues the Business Tax Registration Certificate most local businesses need. That registration has nothing to do with cybersecurity, but it is a reminder that the city, county, and state each have their own rules. Keep your IT records as organized as your tax ones.
Where an IT partner fits
A good provider handles the technical half of this list and documents it, so you can show a client, an insurer, or an auditor what is in place. See our Los Angeles managed IT page for the neighborhoods we cover, or read about our managed IT services. We have been serving Los Angeles businesses since 1998.
Insurance asks the same questions
Cyber insurance applications now read like a security audit. Carriers commonly ask about multi-factor sign-in, offline or immutable backups, and endpoint protection before they will quote. For Los Angeles small business IT, the same short list keeps showing up in state law, client questionnaires, and insurance forms. Fixing it once helps with all three, and keeping the evidence in one folder makes the next renewal much faster.
Common questions
Does encryption really change whether we must notify?
Under section 1798.82, the notice duty is tied to unencrypted data, or encrypted data taken together with the key. Your attorney should make the final call.
We are tiny. Does any of this apply?
The breach and reasonable security rules are not limited to large companies. The CCPA thresholds are.
How do we find our gaps?
Book an IT assessment and we will walk through the checklist with you.