If you run a small law firm, a solo dental practice, or a ten-person financial advisory office, you may have assumed the wave of state privacy legislation was aimed at large corporations with dedicated compliance teams. That assumption now carries real risk.
Several state and federal privacy laws apply to small businesses regardless of headcount, particularly firms in healthcare, financial services, and law. HIPAA, the FTC's GLBA Safeguards Rule, Illinois' Biometric Information Privacy Act, Washington's My Health Data Act, and all fifty state breach notification statutes carry no meaningful size exemption. Knowing which law applies to your data type—not your employee count—is the starting point for compliance.
Which laws already apply to your firm?
Most of the well-publicized omnibus state privacy laws—California's CCPA, Virginia's VCDPA, Colorado's CPA—include consumer-count or revenue thresholds that effectively exempt the smallest firms. But those laws are not the full picture. Four categories of law have no meaningful size exemption.
Federal sector laws
HIPAA applies to any covered entity—including a solo physician, a two-person dental office, or a medical billing service—and to every business associate that handles protected health information. The FTC's GLBA Safeguards Rule applies to any financial institution regardless of size. That definition is broad: it includes small accounting firms, independent insurance agencies, tax preparers, and mortgage brokers. Neither law offers a small-business carve-out.
State biometric laws
Illinois' Biometric Information Privacy Act (BIPA) applies to any private entity that collects fingerprints, facial scans, or other biometric identifiers. There is no revenue threshold and no employee minimum. If your office uses a fingerprint time clock or a facial-recognition door system, BIPA applies to you if any employee or client is an Illinois resident. Texas has a comparable biometric identifier statute with similarly broad reach.
State consumer health data laws
Washington's My Health Data Act covers any organization that determines how consumer health data is collected or used and that conducts business in Washington or targets Washington residents. There is no headcount or revenue threshold in that definition. Entities already fully governed by HIPAA for the same data carry a partial exemption, but health data that falls outside HIPAA's scope—wellness surveys, appointment-scheduling details, health-related email correspondence—may still be covered.
State data breach notification laws
All fifty states require prompt notification to affected individuals, and in most cases to the state attorney general, when personal information is compromised. These laws apply to every business that handles residents' data, regardless of size. A two-person office that loses a laptop with unencrypted client files is subject to the same notification obligation as a hospital system.
What data actually triggers these obligations?
Consider what your firm handles on an ordinary day:
- Client names combined with Social Security numbers, account numbers, or medical record numbers
- Employee payroll records and direct deposit information
- Any photograph or scan used for time-and-attendance or building access (potentially biometric under state law)
- Appointment records that reveal a client's provider relationship
- Emails containing a client's financial position or health condition
If any of these live in your Microsoft 365 environment—your email, SharePoint, or OneDrive—you have obligations. The question is not whether a law applies. The question is whether you can demonstrate compliance when a regulator or an opposing attorney asks.