Small businesses in the U.S. and Canada must protect customer data under strict privacy laws. Here’s what compliance looks like and how to avoid penalties.