Zansa › Answers › Privacy, security and ownership
Privacy, security and ownership: 50 answers
Plain-language answers on privacy, security and ownership for small and mid-sized companies, from Zansa.
- Can Zansa work with healthcare businesses that hold sensitive data?
- Does Zansa sign an agreement before it accesses any client data?
- How does Zansa protect personal information in the reports it builds?
- Does Zansa use AI tools on my business or customer data?
- What is GDPR and does it apply to a small business?
- Does GDPR apply to my business if it is based outside the EU?
- What is the difference between UK GDPR and EU GDPR?
- What is POPIA and who must comply with it?
- What is an operator under POPIA and what must the agreement say?
- What is CCPA and CPRA and does it affect small businesses?
- Does HIPAA apply to a business that analyses health data?
- What is data residency and why does it matter for compliance?
- Can I send personal data to another country for analytics work?
- What is a data processing agreement and when do I need one?
- What is the difference between a data controller and a data processor?
- What is pseudonymisation and how does it differ from anonymisation?
- How can a small business de-identify data before building reports?
- What does data minimisation mean in practice for analytics projects?
- What is access control and why does it matter for company data?
- What is the principle of least privilege and how do I apply it?
- Why is multi-factor authentication important for business data systems?
- What is audit logging and what should a small business log?
- Why does encryption matter and what should be encrypted?
- How should a small business back up its important data?
- How long should a business keep personal data?
- What should a small business do first if it suffers a data breach?
- How soon must a data breach be reported under GDPR and POPIA?
- What should I check before choosing a data or analytics vendor?
- What security questions should I ask a vendor that will handle my data?
- Can I put customer personal data into ChatGPT or other AI tools?
- How can a company use AI tools safely when personal data is involved?
- Who owns the data when a company hires an outside analytics provider?
- Who owns the dashboards and models an analytics provider builds for me?
- What should an exit and handover plan include when ending a data project?
- Who is liable if my analytics provider causes a data breach?
- Do I need a data protection officer for a small business?
- What are data subject access requests and how should a small firm handle them?
- What counts as personal data or personal information?
- Is health data treated differently under privacy law?
- Can I use customer data for analytics without asking for consent?
- What is a privacy impact assessment and when is one needed?
- Is it safe to share spreadsheets with personal data by email?
- Why are shared passwords a problem for data security?
- Should staff and payroll data be included in company dashboards?
- What is a sub-processor and why should I ask about them?
- Is it better to keep company data in my own cloud account or the provider's?
- What should I do when an employee or contractor with data access leaves?
- How do I keep a record of which vendors process my personal data?
- Does Zansa sign an operator agreement and limit access when it handles my data?
- What is a data retention schedule and how do I create one?