You Need Privacy Policies Even When No Law Requires Them

Texas now has a comprehensive privacy law, the Texas Data Privacy and Security Act, and it reaches most businesses that are not small businesses under the Small Business Administration's definitions.¹ Many smaller companies will read that and conclude they can skip privacy and data protection policies entirely. Even where no law requires them, that is a mistake, because the business reasons for having those policies don't depend on a statute.

The case for skipping them deserves a fair hearing

The argument for doing nothing is not foolish. A small company with no legal obligation has limited time and money, and policies cost both. Writing them takes effort, following them takes discipline, and nobody outside the company may ever ask to see them. If the law doesn't require it, why spend the resources?

The problem with that argument is that it treats the law as the only party asking. It isn't.

Your partners and customers will ask even when the law doesn't

Many of the companies you want to do business with are subject to privacy and data protection laws, even if you are not. Before they share data with you or let you handle data for them, they will assess how you protect it. A company with no policies to show often never gets past that review.

Customers ask too, in a quieter way. People are more likely to give accurate information to companies they trust, and they routinely give false details to companies they don't.² A business that shows it takes care with personal data gets better data back, which pays off well beyond compliance.

Breaches cost money whether or not a privacy law applies

IBM put the average cost of a data breach in 2024 at $4.88 million.³ That figure includes ransoms, legal fees, settlements, and lost business, and none of those costs wait for a privacy statute to apply. Policies that you actually follow reduce the chance of a breach. An incident response plan written before something goes wrong lets you identify, contain, and recover from one faster, and backup and recovery practices keep a bad day from becoming a lost month.

The laws are coming to you anyway

New privacy laws keep arriving, in the U.S. states and around the world.⁴ A business with policies already in place can adjust them when a new law reaches it. A business with nothing has to build the whole program at once, usually under a deadline, and usually while also trying to work out which law applies.

Whether a statute requires privacy and data protection policies is the wrong question for most businesses. The better question is who else is already expecting you to have them, and how much it will cost to find out when they ask.

This post does not constitute legal advice. Readers should consult competent legal counsel before taking action based on the analysis presented here.