GDPR - What you need to know

You may or may not have heard the term 'GDPR' banded about recently. This effects your business if you hold any personal data what-so-ever.  I can't think of many, if any, businesses that don't!

GDPR stands for 'General Data Protection Regulation' and it is a new set of data protection rules that are being implemented across Europe from 25th May 2018. That's just over 8 weeks from when I am writing this (in other words, very soon!).

From a consumer's point of view it is a great initiative as data protection is so vitally important. Currently in the UK we are far behind many other countries as we haven't updated our data protection laws in 20 years. The new 'Data Protection Bill' is the UK's iteration of GDPR and looks set to stand strong after Brexit.

From a business point of view this could prove a real headache, but there is no way around it. Here are the basic headlines:

1. Know what personal data you have on file.
   This will fall into 2 categories; basic identifiers (i.e. name, address, phone number, email, IP address) and sensitive data (i.e. demographic information, preferences). Note that B2B data is still personal data.
   
   
2. Know how you got this data and make sure that reason is legal.
   There are 6 legal reasons you can hold someone's personal data and each piece of data you hold must fit into one of these categories; the 3 most appropriate for small businesses are consensual, contractual and legitimate interest.
   If you collect emails for your newsletter consumers must now 'positively' opt in to your database, i.e. perform an action to confirm they are happy for you to hold their data and it needs to be clear to them what this action is. Gone are the days of pre-checked boxes for an email sign up.
   
   
3. Make it clear to consumers how you handle their data.
   Your privacy policy needs to be current and compliant and there need to be links to this at any point where you collect consumer data.
   
   

Going forward consumers will have the right to request what information you have on them, where you got it from and also request that you delete it, so it is also worth thinking about how you deal with this.

There will be fines for anyone who doesn't comply so it's definitely time to make sure you are up-to-date and ready for the changes,

Here are some resources that go into more detail:
The ICO 12 step guide to compliance.
The ICO's full guide to GDPR.
Wired's brilliant summary of the changes.
The CIM's webinar on the changes and how this effects marketers. 

If you come across any great articles, have any tips or any questions please do comment and let me / other readers know. Thanks!