Choosing the right data

Customer data and GDPR

The European Union data regulators on the 25th of May 2018 started to enforce the new EU General Data Protection Regulation (GDPR) to protect and strengthen the security around residents of the EU’s personal data. Any company that does not abide by the GPPR runs the risk of losing their customers trust as well as getting fined 4% of their annual revenue or up to 20 million euros.

You can read more on the GPRs or get legal advice on what your obligations are according to the GDPR. In this lesson, we’ll break down what the GDPR is and what actionable steps you can take to ensure you are compliant.

How the GDPR impacts your business

Depending on how your business interacts with customer’s personal data, you may have different GDPR requirements. Whether your company is a data controller, i.e when a business collects its end user’s data and get to decide how and why it is processed, a data processor or both.

Your responsibilities as a data controller

If your company collects EU residents’ data and decides how and why the data is collected then processed, then under the GDPR your company is considered a data controller. These companies are responsible for how organizational, operational and technical measures are implemented and they ensure and demonstrate that the data they collect and process is done according to the GDPR which also involves entering a relevant data processing agreement. Your company will also fulfil data subjects’ rights when handling their data in line with these principles:

• Accuracy
• Transparency
• Consent
• Security
• Fairness
• Minimization and limitation of processing based on purpose

How to prepare for GDPR

We’ve outlined some tips to help you prepare for GDPR while also seeking independent legal advice:

• Have a personal data inventory on the data you collect that is up to date.
• Get educated on GDPRs provisions so you know how they may be different from pre-existing data protection practices and obligations
• Appoint a Directly Responsible Individual (DPI) or build a small team to handle GDPR compliance efforts if your company does not have in-house dedicated data privacy personnel.
• Check if you need to have a Data Protection Officer (DPO) and appoint a suitably qualified person if you do.
• Make a vendors list for where you send data and learn if they are processors or controllers like email tools, CRMs and so on. Ensure they are GPDR ready and what their obligations are.
• Have a plan on how to get and mange consent in line with GDPR and other lawful use of personal data.

Managing consent under GDPR

Companies must have legal grounds for collecting and processing EU residents’ personal data. You can build your own consent manager using any of the approved grounds by GDPR as there are several approved grounds available so you can use that works for your company’s data processing needs.

Honouring end user’s rights.

Regulations such as the GDPR make honouring end users right a requirement for company’s and we think that’s great. These laws make it easy for end user rights to be exercised and also reduce the reliance on third party data sources by data controllers. Most of this data is gotten without full consent of end users so the GPDRs help make the transition to first party data easier for companies and create a better user experience.