small business privacy legal risk map