The security basics
Strong passwords and 2FA, limited access on a need-to-know basis, backups, and encryption where you can. Most breaches are basic failures.
Staff and third parties
People who process data for you (your 'operators' — e.g. an email tool or accountant) should be bound by agreements to protect it too.
Anyone who processes personal information on your behalf — an email tool, an accountant — who must be bound by an agreement to protect it.
Retention and deletion
Don't keep personal information forever. Set retention periods and securely delete what you no longer need — less data, less risk.