I am trying to be sure we are not "over disclosing". From everything I am reading, it is not necessary to give an initial or annual (we have to do an opt-out) privacy notice to business customers. Am I correct on this and if not, is it any different if the business is a dba?

There are no Federal privacy regulations that covers business accounts unless it is a State law.