How Should a Small Business Handle Sensitive Customer Information?

By Bill Stilwell · Last reviewed October 17, 2026

The short answer

Sensitive information includes government ID numbers like Social Security numbers, bank and card data, health details, children’s data, and biometrics like fingerprints or face scans. Collect it only when you truly need it, lock it down, limit who can see it, and never paste it into email, notes, spreadsheets, or artificial intelligence (AI) tools that aren’t approved for it. Federal and state laws add extra rules for some of these types.

What this means

11.6.2 Types of sensitive information

Government ID numbers: Social Security numbers, driver’s license numbers, passport numbers. The Federal Trade Commission (FTC) says to use Social Security numbers only for required, lawful purposes, like employee tax reporting, and not as ID numbers.
Financial data: bank accounts and card numbers. Card industry rules, called the Payment Card Industry Data Security Standard (PCI DSS), say never store the card security code or full magnetic stripe or chip data after a payment is approved, and protect any stored card number. If you show a card number, show at most the first six and last four digits (see 10.7.6 Payment Security).
Health information: The Health Insurance Portability and Accountability Act (HIPAA) covers health plans, health care clearinghouses, and health care providers that do certain electronic transactions, plus their business associates. The FTC says businesses outside HIPAA that handle health data are still covered by the FTC Act, and some by its Health Breach Notification Rule. The FTC also treats health data broadly, including information that suggests a health condition.
Children’s data: The Children’s Online Privacy Protection Act (COPPA) applies to websites and online services aimed at children under 13, or that know they collect personal information from children under 13. The FTC’s updated COPPA rule took effect June 23, 2025, with most compliance required by April 22, 2026.
Biometrics: fingerprints, face scans, and voiceprints. Some states, such as Illinois, have laws on collecting biometric data. Check your state before using fingerprint time clocks or face recognition.

25.2.2 Personal information in AI tools

Don’t put customer names, phone numbers, emails, or addresses into AI tools unless the task needs them and the tool is approved for that use. Remove or replace personal details first (see 11.6.1 Data Minimization).

25.2.3 Sensitive data in AI tools

Never put health, financial, government ID, children’s, biometric, or confidential business information into an AI tool unless your attorney or the tool’s business terms clearly allow it. Check whether the tool stores your inputs or uses them for training (see 25.2 Data You Put Into AI Tools).

Made-up example: Brightside Tutoring collects parents’ contact details and kids’ grade levels, but it used to keep copies of report cards and parent ID photos in a shared folder. It stops collecting IDs, keeps only grade level and learning goals, limits the folder to two staff members, and bans pasting student details into AI tools.

Why it matters

Sensitive data causes the most harm when it leaks. The FTC says thieves target Social Security numbers and financial data most.
Breach notices may be required. Every state has its own breach notification law, often triggered by ID numbers, financial accounts, or health data (see 11.6.6 Breach Notification).
Card rules are part of your merchant agreement. Payment processors expect you to follow PCI DSS.
Children’s and health data carry extra rules and higher risk if mishandled.

Who this applies to

Every business. Even a small service business may have employee tax forms, a customer’s gate code, or a photo of a check. Businesses in health, wellness, child care, tutoring, finance, and online sales need extra care.

How to do it

Find sensitive data in your data map (see 11.5 Data Map) and mark each row.
Stop collecting what you don’t need. Most service businesses never need a customer’s Social Security number or ID copy.
Use your payment processor to handle cards. Don’t write card numbers on paper, in email, in notes, or in spreadsheets.
Lock it down: encrypt devices, use strong passwords and multi-factor authentication (see 11.7.3 Multi-Factor Authentication), and lock paper in a cabinet.
Limit access to the fewest people possible (see 11.7.6 Least Privilege Access).
Check whether HIPAA, COPPA, or state biometric laws apply to you, and get advice if they might.
Write an AI rule that bans sensitive data in AI tools unless approved.
Delete it securely when the need ends (see 9.8.5 Secure Record Destruction).

What proof to keep

Data map rows marked as sensitive, with location and access
Your written rule on sensitive data and AI use
Payment processor setup records showing cards aren’t stored by you
Access lists for sensitive folders and systems
Destruction records

Common mistakes

Writing card numbers on a job ticket to charge later.
Asking for card numbers by email or text.
Keeping photos of IDs in a phone’s camera roll.
Assuming HIPAA covers every health detail. It covers certain businesses. The FTC Act can cover the rest.
Using a fingerprint time clock without checking state biometric law.
Pasting a customer’s medical notes into an AI tool to draft a message.

When to get help from a pro

Privacy attorney: if you handle health, children’s, biometric, or financial data. Payment processor: for card handling questions. Questions to ask:

Am I a HIPAA covered entity or business associate, or am I under the FTC’s health rules?
Does COPPA or my state’s biometric law apply to anything I do?
What would trigger a breach notice in my state?

Bill’s note

[Bill: add a short note. For example, the sensitive data SiteSmarty handles, like client logins or payment info, and how you protect it, or a client who was storing card numbers in a spreadsheet.]

How I did this for SiteSmarty

[Date I did this:]
[What I actually did, step by step: marking sensitive data in the SiteSmarty data map and locking it down]
[What it cost and how long it took:]
[What surprised me or what I’d do differently:]
[Screenshot or photo to add, with private info blurred: sensitive data rows and access settings]
[Result so far:]

Questions people ask

Can I store credit card numbers? Avoid it. Card industry rules ban storing the security code after approval and require protecting any stored card number. Let your payment processor store cards.

Does HIPAA apply to my business? Only if you’re a health plan, a health care clearinghouse, a health care provider that does certain electronic transactions, or a business associate of one. Other businesses with health data still fall under the FTC Act.

What are the rules for children’s data? COPPA applies to websites and online services aimed at children under 13, or that know they collect data from children under 13. The FTC’s updated rule had a compliance date of April 22, 2026.

Should I put sensitive data into AI tools? No, unless your attorney or the tool’s business terms clearly allow it.

Audit check

Line	Question	Pass looks like	Fail looks like	Evidence to collect
11.6.2 Sensitive information	Is sensitive data limited, locked down, and restricted to few people?	Sensitive rows marked in data map, minimal collection, encrypted storage, small access list	ID copies in shared folders, card numbers in notes or spreadsheets	Data map, access lists, processor setup
25.2.2 Personal information in AI	Are personal details removed before using AI tools?	Written rule, staff remove names and contact details	Customer records pasted into AI tools	AI use rule, training record
25.2.3 Sensitive data in AI	Is sensitive data kept out of AI tools unless approved?	Written ban with approved exceptions only	Health, financial, ID, or children’s data in AI tools	AI use rule, tool terms on file

Where this fits

Do this first: 11.6.1 Data Minimization, 11.5 Data Map

Do this next: 11.6.5 Customer Privacy Requests

Sources

Federal Trade Commission, "Protecting Personal Information: A Guide for Business" (checked October 17, 2026)
PCI Security Standards Council, "PCI Data Storage Do's and Don'ts" (checked October 17, 2026)
Federal Trade Commission, "Collecting, Using, or Sharing Consumer Health Information? Look to HIPAA, the FTC Act, and the Health Breach Notification Rule" (checked October 17, 2026)
Federal Trade Commission, "Complying with COPPA: Frequently Asked Questions" (checked October 17, 2026)
Federal Register, "Children's Online Privacy Protection Rule" (April 22, 2025) (checked October 17, 2026)

This page explains general rules and Bill's own experience. It is not legal, tax, or insurance advice. Talk to a qualified professional about your situation.