How Small Businesses Should Address Privacy Regulations