New data protection rules: 5 practical steps for small businesses