Most first year businesses meet none of those, and it is worth saying plainly because vendors imply otherwise. A local service business with a few hundred customers is not close to the thresholds. The reason to know about it anyway is that the revenue threshold is one a growing business can cross without noticing, and the obligations begin at that point rather than after a grace period.
What it requires when it does apply is a set of rights you must honour. Telling people what you collect and why, at or before the point of collection. Responding to requests to know what you hold about somebody, to delete it, and to correct it. Honouring a request not to sell or share personal information, where sharing includes some common advertising arrangements that businesses do not think of as selling. And not treating somebody worse for exercising those rights.
That advertising point is the one that catches people. Running certain tracking or advertising tools can constitute sharing under the definition, even though no money changes hands and you would never describe it as a sale. If you are near the thresholds and running advertising pixels, that is worth specific advice.
The practical posture regardless of thresholds is the same short list: collect only what you use, say plainly what you collect, do not add people to lists without a clear action, know which tools hold customer data, and be able to delete somebody on request. This is general information rather than legal advice.
Check the thresholds against your actual figures annually rather than assuming, because the revenue one in particular is reachable by a growing business and the obligations begin on crossing it rather than after a grace period. Businesses that check once at founding and never again are the ones that discover the requirement retrospectively, which is a considerably worse position than having prepared for it.
Adopt the practices regardless of whether the thresholds apply, because the cost is minimal and the direction of regulation is consistent. Several states have passed comparable laws with differing thresholds, and the practical requirements overlap substantially: tell people what you collect, honour deletion requests, do not sell data without an opt out, and know which tools hold what. A business already operating that way is prepared for whichever regime eventually reaches it.