What's a Privacy & Data Security Policy, and Do I Really Need One?
Over the past several months, many businesses have been forced to pivot their general operations from personal contact with customers to more remote and virtual contact. With that, your business’s website is more important now than ever before. How many of you go to a business’s website before deciding to do business with them? Whether it’s for personal services such as a dentist or hair salon, or for business services like a CPA or attorney, a website is often the opportunity for that business to make a good impression.
Now, you’ve probably made sure that your website is clear and inviting to your customers, but have you made sure that it you’ve checked all the necessary boxes for your website and security practices to keep you out of legal hot water? Believe it or not, failure to adequately handle your website and information you obtain through it can get you sued. This week, we’re going to go over why it’s important that every business has a posted privacy & data security policy.
Do I really need a privacy policy? Isn’t it just a bunch of unnecessary fine print?
Yes, you need a privacy & data security policy, regardless of your industry. It is important that you properly inform your website visitors of your business’s privacy policy, including the type of information that will be gathered from the visitor, and for what purpose(s).
In Colorado and many other states, there are laws that require businesses to maintain the privacy and security of consumer data – specifically with respect to “personal identifying information” (PII) and “personal information” (PI).
- PII includes social security numbers; personal identification numbers; passwords; pass codes; official state or government-issued driver’s license or identification card numbers; government passport numbers; biometric data; employer, student, or military identification numbers; and financial transaction devices, including financial account numbers.
- PI includes a Colorado resident’s first name or first initial and last name in combination with any of the following, when the data elements are not encrypted, redacted, or secured by any other method rendering the name or the element unreadable or unusable:
- Social Security number;
- Driver’s license number or identification card number;
- Student, military, or passport identification number;
- Medical information;
- Health insurance identification number; or
- Biometric data (e.g. fingerprints, iris recognition, retinal scans) used to authenticate an individual when they access an online account.
- PI also includes:
- A Colorado resident’s username or e-mail address, in combination with a password or security questions and answers, that would permit access to an online account; and
- A Colorado resident’s account number or credit or debit card number in combination with any required security code, access code, or password that would permit access to that account.
- If you maintain PII, in paper or electronic form, you are required to develop a written policy to ensure that the PII is destroyed or properly disposed of when it is no longer needed.
What does my business need to do with PII and PI?
- Establish written policies governing the disposal of documents & records containing PII.
- You are required to implement and maintain reasonable security procedures and practices to protect PII, taking into account the nature and size of your business and the type of PII you collect. Specifically, you need to develop procedures and practices to:
- Help protect the personal identifying information from unauthorized access, use, modification, disclosure, or destruction; or
- Effectively eliminate the third party's ability to access the personal identifying information, notwithstanding the third party's physical possession of the personal identifying information.
- Provide notice of security breaches affecting PI, to Colorado residents within 30 days of the discovery of a security breach. Note: If the security breach impacts 500 or more Colorado residents, you must also notify the Colorado Attorney General, and if more than 1,000 residents are impacted, you must also notify the credit reporting agencies. For example, a security breach can occur when:
- An employee clicks on a link or opens an email attachment that contains malware;
- An employee provides their password or other sensitive information to an unauthorized person;
- Your entity is the victim of a ransomware attack (which is sometimes accompanied by malware that steals data);
- Unencrypted PI is sent through a payment system;
- A briefcase containing client files is stolen or misplaced; or
- A mobile device or data storage device containing personal information is stolen or misplaced.
- Aside from legal requirements, having a privacy policy and security practices in place help build trust with your clients. Knowing that you are going to keep their information secure (even if it’s just their name and email), will give them the confidence they need to come back to your site and do business with you.
Do you need help creating your privacy & data security policies? Contact us today and we’ll help make sure you’re covered!



















