NEWS GDPR: DISPELLING THE


The EU General Data Protection Regulation (GDPR) comes into force on May 25 and is the most significant change to data protection legislation in Europe for over two decades. Here, Mike Richardson dispels some of the myths and suggests how you can turn your compliance responsibilities into an opportunity to reap greater business value from your data


MYTH #1 IT DOESN’T APPLY TO SMEs


WE’LL HAVE TO RE-PERMISSION OUR ENTIRE DATABASE


MYTH #2


FIRST AND FOREMOST, we need to address the fundamental misconception that the GDPR doesn’t apply to small businesses. In fact, GDPR is designed to govern how every organisation treats its personal information, putting individuals firmly in charge of the way their data is used. The size and location of your business is irrelevant; if


you hold personal information on individuals in the EU, as consumers and employees, then the regulation applies. In practice, this means that the principles guiding how data should be collected, processed, shared and stored apply to virtually every business within the EU, as well as those beyond Europe that process data on individuals within the Union. There’s no exemption for small businesses or sole traders. The reality is that GDPR represents the dawn of a new era of


data protection and, quite apart from the statutory side of the regulation, compliance could become a make-or-break factor in securing business in the future. Why? Under GDPR, both data controllers and data processors shoulder compliance responsibility, with either or both being liable to pay compensation or fines. So if you are a “data processor”, for instance, a supplier


handling personal data for your clients, then you will find that the data controller will extend its scrutiny of data practices to your business, as a third-party processing data on their behalf. In practice, thousands of contracts are being rewritten to incorporate GDPR compliance, so processors need to get their data houses in order if they are to meet what will soon become a standard contractual requirement. Equally, if you are passing sales leads to business partners


you need to ensure they are also GDPR compliant. It is clear that every SME will not achieve full compliance by May 25, but what’s important is to understand your obligations now so you can start assessing what data you hold, whether it is lawful to do so, and what changes you need to make.


6 SME www.smeweb.com


THE REASON THAT so many companies are worried about the stricter requirements around consent is because they know that obtaining renewed opt-in – or re-permissioning – is a very time-consuming exercise and one that could easily backfire. It’s undeniable that you run the risk of contacts either withdrawing their consent or simply not replying. In the latter case, contacts would still have to be removed from your database because GDPR-standard consent involves the data subject taking “clear, affirmative action” to give you permission to use their data. But, in their panic, many companies are overlooking the fact


that consent is just one of six lawful bases allowing organisations to process personal data and/or perform marketing activity. So, once you’ve got a handle on the data that you capture and where it is held – the key starting points of the information audit that you are hopefully conducting as part of your compliance programme – you must analyse which legal basis you can apply in order to continue processing each individual’s data. Processing can often be justified on an alternative basis


to consent, particularly where you have client contracts in place. Also, some direct marketing will still meet the criteria for “legitimate interests”, but you must tread carefully and ensure that you do not infringe the “rights and freedoms” of the individual. It is crucial that you document your decision-making so


that you could explain your rationale to the Information Commissioner’s Office. Being able to demonstrate compliance and your commitment to embracing the data protection principles is one of the key goals of the regulation. In reality, a proportion of the typical database will not be GDPR compliant and your only options will be to proactively seek fresh consent or delete the data.


Page 1  |  Page 2  |  Page 3  |  Page 4  |  Page 5  |  Page 6  |  Page 7  |  Page 8  |  Page 9  |  Page 10  |  Page 11  |  Page 12  |  Page 13  |  Page 14  |  Page 15  |  Page 16  |  Page 17  |  Page 18  |  Page 19  |  Page 20  |  Page 21  |  Page 22  |  Page 23  |  Page 24  |  Page 25  |  Page 26  |  Page 27  |  Page 28  |  Page 29  |  Page 30  |  Page 31  |  Page 32  |  Page 33  |  Page 34  |  Page 35  |  Page 36  |  Page 37  |  Page 38  |  Page 39  |  Page 40  |  Page 41  |  Page 42  |  Page 43  |  Page 44  |  Page 45  |  Page 46  |  Page 47  |  Page 48  |  Page 49  |  Page 50  |  Page 51  |  Page 52