GDPR The Beginning
The internet has dramatically changed the way we communicate and how we handle everyday tasks. We send emails, we share documents, we pay bills and we purchase goods by entering our personal details online without giving it a second thought.
Have you ever stopped to wonder how much personal data you have shared online? Or what happens to that information? We’re talking about banking information, contacts, addresses, social media posts, and even your IP address and the sites that you’ve visited are all stored digitally.
Companies tell you that they collect this type of information so that they can serve you better, offer you more targeted and relevant communications, all to provide you with a better customer experience. But, is that what they really use the data for?
This is the question that has been asked and answered by the EU, and why on 25th May 2018 a new European privacy regulation called GDPR will be enforced and permanently change the way you collect, store and use customer data.
What Is GDPR And Why Is It Important?
GDPR will be implemented in all local privacy laws across the entire EU and EEA region. It will apply to all companies selling to and storing personal information about citizens in Europe, including companies on other continents. It provides citizens of the EU and EEA with greater control over their personal data and assurances that their information is being securely protected across Europe.
According to the GDPR directive, personal data is any information related to a person such as a name, a photo, an email address, bank details, updates on social networking websites, location details, medical information, or a computer IP address.
In a B2B setting, everything is about individuals interacting and sharing information with and about each other. Customers in B2B markets are obviously companies, but the relationships that handle the business topics are people – or individuals.
What You Need To Know About GDPR
Under the GDPR, individuals have:
The right to access – this means that individuals have the right to request access to their personal data and to ask how their data is used by the company after it has been gathered. The company must provide a copy of the personal data, free of charge and in electronic format if requested.
The right to be forgotten – if consumers are no longer customers, or if they withdraw their consent from a company to use their personal data, then they have the right to have their data deleted.
The right to data portability – Individuals have a right to transfer their data from one service provider to another. And it must happen in a commonly used and machine-readable format.
The right to be informed – this covers any gathering of data by companies, and individuals must be informed before data is gathered. Consumers have to opt-in for their data to be gathered, and consent must be freely given rather than implied.
The right to have information corrected – this ensures that individuals can have their data updated if it is out of date or incomplete or incorrect.
The right to be notified – If there has been a data breach which compromises an individual’s personal data, the individual has a right to be informed within 72 hours of first having become aware of the breach.
The right to restrict processing – Individuals can request that their data is not used for processing. Their record can remain in place, but not be used.
The right to object – this includes the right of individuals to stop the processing of their data for direct marketing. There are no exemptions to this rule, and any processing must stop as soon as the request is received. In addition, this right must be made clear to individuals at the very start of any communication.
The GDPR is the EU’s way of giving individuals, prospects, customers, contractors and employees more power over their data and less power to the organisations that collect and use such data for monetary gain.
The Business Implications Of GDPR
This new data protection regulation puts the consumer in the driver’s seat, and the task of complying with this regulation falls upon businesses and organisations.
In short, the GDPR applies to all businesses and organisations established in the EU, regardless of whether the data processing takes place in the EU or not. Even non-EU established organisations will be subject to GDPR. If your business offers goods and/ or services to citizens in the EU, then it’s subject to GDPR.
All organisations and companies that work with personal data should appoint a data protection officer or data controller who is in charge of GDPR compliance.
There are tough penalties for those companies and organisations who don’t comply with GDPR fines of up to 4% of annual global revenue or 20 million Euros, whichever is greater.
Many people might think that the GDPR is just an IT issue, but that is the furthest from the truth. It has broad-sweeping implications for the whole company, including the way companies handle marketing and sales activities.
The Impact Of GDPR On Customer Engagement
The conditions for obtaining consent are stricter under GDPR requirements as the individual must have the right to withdraw consent at any time and there is a presumption that consent will not be valid unless separate consents are obtained for different processing activities.
This means you have to be able to prove that the individual agreed to a certain action, to receive a newsletter for instance. It is not allowed to assume or add a disclaimer, and providing an opt-out option is not enough.
This changes a lot of things for companies such as the way your sales teams prospect or the way that marketing activities are managed. Companies will have to review business processes, applications and forms to be compliant with double opt-in rules and email marketing best practices. In order to sign up for communications, prospects will have to fill out a form or tick a box and then confirm it was their actions in a further email.
Organisations must prove that consent was given in a case where an individual objects to receiving the communication. This means that any data held, must have an audit trail that is time stamped and reporting information that details what the contact opted into and how.
If you purchase marketing lists, you are still responsible for getting the proper consent information, even if a vendor or outsourced partner was responsible for gathering the data.
In the B2B world, salespeople meet potential customers at a trade show, they exchange business cards, and when they come back to the office, they add the contacts to the company’s mailing list. In 2018, this will not be possible anymore. Companies will have to look at new ways of collecting customer information.
Initial Preparations GDPR Checklist For May 2018
There are many things a company will have to do in order to be compliant with GDPR. Here are just a few first steps to get you started.
1. Map your company’s data
2. Determine what data you need to keep
3. Put security measures in place
4. Review your documentation
5. Establish procedures for handling personal data
While GDPR does create challenges and pain for businesses, it also creates opportunity.
Companies who show they value an individual’s privacy (beyond mere legal compliance), who are transparent about how the data is used, who design and implement new and improved ways of managing customer data throughout its lifecycle build deeper trust and retain more loyal customers.
The May 2018 deadline may seem a long way off at the moment, but before you know it, a year will have passed. If you haven’t already started your journey, we urge you to start now.
Dedicate time to understand what you need to do in order to become compliant and use the practical tips shared in this article to help you get started. Then, create a plan of action for your journey to GDPR so that when May 2018 rolls along you’re calm and relaxed and you can answer all your customers’ questions regarding compliance.
How will GDPR impact your business?
And what are you doing right now in order to be GDPR compliant by May 25th, 2018?
We Can Help
Get in touch to find out how we are helping business stay complaint. Drop us an email to firstname.lastname@example.org to find out more.