7. If Customer Data is Stolen or Lost — What to Do Next

A small business must respond quickly if sensitive customer information is lost or stolen, giving an unauthorized person access to that sensitive information. If this occurs, you'll need to notify the affected customers.

Getting Started

1. Create a Data Breach Notification Policy.
   A data breach notification policy tells consumers how your small business will notify its customers if a data breach occurs.
2. Train Your Employees to Identify Breaches.
   Employees need to know how to spot a potential breach and how to report this type of event.
3. Immediately Gather the Facts of a Potential Breach.
4. Notify Financial Institutions.
   If financial information, such as payment card numbers, was compromised, contact the bank or company that manages your payment card processing.
5. Seek Outside Counsel.
   Seek attorney assistance or guidance from a risk consulting company as soon as you become aware of an incident that might constitute a data security breach. Your attorney can help you identify which laws might be involved, and whether you need to alert consumers or the government of the incident.
6. Notify Affected Customers.
   Notify them in the manner you said you would in your Data Security Policy.