Customer Data Privacy for Service Businesses

Why this matters

A residential service business holds a remarkable amount of personal data on every customer: name, address, phone, email, payment method, sometimes garage codes and alarm codes, photos of the interior of the home, equipment serial numbers, and a service history that maps the household's vulnerabilities. Treated casually, that data becomes a liability - both legally under state privacy laws and ethically when it ends up in the wrong hands. The regulatory landscape changed materially in 2020 with California's CCPA, and continues to evolve as more states pass their own consumer privacy acts. A service business operating in 2025 needs a working understanding of what data it holds, what it can and cannot do with it, and what its obligations are when something goes wrong.

What data a service business typically holds

Each category triggers different regulatory expectations and security requirements. A breach of access codes is more damaging than a breach of contact information, but breach notification laws treat them with similar urgency in most states.

US state privacy laws (operative as of 2025)

Patchwork by state. The major statutes:

A small service business operating in one state may not meet the revenue or volume thresholds for any of these laws. Most state laws apply to businesses processing data of 100,000+ consumers, or with revenues above $25M, or deriving a significant share of revenue from selling personal data. A two-truck plumber in Sacramento isn't directly covered by CCPA. A growing 30-truck operation may cross the threshold.

Even when not legally required, adopting the principles of these laws is good practice - and the threshold can be crossed faster than expected through acquisition or growth.

The core principles

Across the various state laws, similar principles emerge:

• Notice. Tell customers what data you collect and what you do with it.
• Choice. Let them opt out of uses they don't agree with (especially data sale, advertising).
• Access. When they ask "what do you have on me?", be able to answer.
• Correction. When they say "fix the typo in my address," fix it across systems.
• Deletion. When they say "delete me," delete unless retention is legally required.
• Security. Protect the data you hold with reasonable safeguards.
• Vendor accountability. Hold processors (your CRM provider, your payment processor) to the same standards.

A privacy policy, posted on the website and referenced in customer-facing forms, addresses notice. The operational systems behind it address everything else.

PCI DSS for payment data

Any business that accepts credit card payments is subject to PCI DSS (Payment Card Industry Data Security Standard). The standard is enforced by the card brands and acquiring banks rather than by government, but the consequences of non-compliance are real - fines, loss of card-acceptance privileges, civil liability.

For most service businesses, the right strategy is:

• Don't store card data on your systems. Use a tokenizing payment processor (Stripe, Square, Authorize.net) that converts the card number into a token; the actual number lives on their PCI-compliant infrastructure.
• Don't email or text card numbers. Customers who text their card number for an over-the-phone payment should be directed to a secure link instead.
• Don't write card numbers on invoices, work orders, or anywhere paper-based. A "scratch sheet" with card numbers in the truck is a PCI nightmare.
• Complete the annual SAQ (Self-Assessment Questionnaire). Most small businesses complete SAQ-A (for those using fully outsourced payment processors). The processor will guide the SAQ choice.

A breach involving stored card data triggers card-brand investigation, potential fines per the card brand schedules, and almost certain state attorney general involvement under state breach notification laws.

Breach notification obligations

All 50 states have breach notification laws. Triggers and timelines vary, but a typical structure:

• Trigger. Unauthorized acquisition of unencrypted personal information.
• Timeline. "Most expedient time possible" or specific deadlines (45 days under most state laws; faster under some).
• Recipients. Affected individuals; state attorney general for breaches above a threshold (often 500 or 1,000 residents); sometimes consumer reporting agencies.
• Content of notice. Description of incident, type of data involved, what the business is doing about it, contact information.

The business must have a breach response plan in place before a breach happens. Improvising under time pressure leads to incomplete notifications and regulatory exposure.

Encrypted data is generally exempt from breach notification if the encryption keys weren't compromised. This is the single highest-leverage technical control a small business can implement: encrypt data at rest on laptops, mobile devices, and backups.

Access codes and physical security

A unique liability for trade services: garage codes, alarm codes, gate codes, and key locations. The exposure is not abstract:

References

• California Consumer Privacy Act (CCPA), Cal. Civ. Code §§ 1798.100-1798.199, as amended by CPRA.
• Virginia Consumer Data Protection Act (VCDPA), Va. Code §§ 59.1-575 et seq.
• Colorado Privacy Act, Colo. Rev. Stat. §§ 6-1-1301 et seq.
• PCI DSS v4.0, PCI Security Standards Council.
• NIST Cybersecurity Framework 2.0, February 2024.
• IAPP (International Association of Privacy Professionals) US State Privacy Tracker - current status of state laws.
• Federal Trade Commission Section 5 Act - general unfairness/deception enforcement around privacy.
• Manuall internal: Small Business Cybersecurity, Business Insurance Basics.