California's privacy law has strict thresholds. Most small businesses are exempt — but here's how to check whether you're one of them, and what to do if you're not.