The small business no-nonsense guide to GDPR
Why are we writing this GDPR guide?
The clock on GDPR enforcement has now run down.
Many are understandably frightened and unsure of whether they will be compliant. There is unfortunately a lot of confusion around this legislation, so the purpose of this guide is to cut through the confusion and provide an overview of what the legislation is. Including, the steps you need to take to see if you are compliant, and what needs to be done to meet any gaps in your data processing system. It is paramount for all businesses new and existing to meet the requirements of GDPR.
As most of our customers are small businesses we will be interpreting the GDPR from a small business point of view. In addition, we’ll demonstrate how RealtimeCRM can help you become compliant.
What is GDPR?
On the 25th May 2018 GDPR (General Data Protection Regulation) came into effect, it is a wide ranging overhaul of current data protection regulation that will affect all businesses. The Regulation is an essential step to strengthen citizens’ fundamental rights and keep up to date with the tremendous changes that have taken place particularly on the internet in the last twenty years.
Think of the internet of things, social media and online shopping which have come into being over the last twenty years. This is an ever growing ocean of personal data that needs to be protected and made secure.
Perhaps you’ve been approached by a consultant or offered a course? While GDPR will affect all businesses we don’t believe it has to be difficult to deal with. Of course you must bear in mind that no-one can offer authoritative legal advice on the subject until it is tested in the courts. We can tell you our interpretation but we are not lawyers, we are not your lawyers, and this is not legal advice!
The GDPR is a modern privacy framework which aims to account for the complex nature of modern data collection, storage, processing and distribution. The goal is to provide a path which allows businesses to build and maintain a data policy that ensures you keep your eye on the ball of data security and management.
It’s in your interest to be compliant. This is not simply because this new legislation has teeth in the form of significant fines which we will cover later on. Instead, by doing so you signal to your customers that you take the security of their personal data seriously. In turn you’ll strengthen those customer relationships.
As you can see from the above Pew Research survey, privacy matters to individuals. If you cannot demonstrate high standards of data protection - or worse you are found to be negligent - it will harm your business.
Additionally, the GDPR will require all companies within the EU to create data processing systems with the same underlying principles. This will allow for a consistent and cohesive data protection environment, which in turn makes it easier for businesses to interact with each other.
What are the key principles of GDPR?
The GDPR sets out the data protection principles in Article 5, they can be summed up as follows:
- The personal data is processed lawfully, fairly and in a transparent manner in relation to individuals.
- The personal data has been collected for a specific and legitimate purpose and is not processed beyond the scope of the legitimate purpose used to justify the processing.
- That the personal data is adequate, relevant and limited to what is necessary in relation to the purpose for which it is being processed.
- That the personal data is accurate and kept up to date.
- The personal data is kept in a form which permits the identification of data subjects for no longer than is necessary for the purposes for which the personal data is being processed.
- The personal data is processed in a manner that is secure including protection against unauthorised or unlawful process and against accidental loss or damage.
Does it apply to me?
This new regulation applies whether or not your business is based in the EU and regardless of the actual location you process data. As long as you are processing the data of people in the EU for the purpose of offering goods and services (whether paid or not) or monitoring the behavior of people in the EU, for example by placing cookies on the devices of EU individuals you must adhere to the GDPR:
“This Regulation applies to the processing of personal data of data subjects who are in the Union by a controller or processor not established in the Union, where the processing activities are related to..”
-Article 3(2) General Data Protection Regulation-
In the context of the UK and the vote to leave the European Union, this will have no impact on GDPR enforcement as the Information Commissioner Office (ICO) has confirmed the new bill will apply in the UK from 25th May 2018.
For the purposes of this guide we will focus our attention on the GDPR and its effect on small businesses. The GDPR is not a one size fits all solution to the problem of data protection. It has differing levels of obligation depending on the size of the business when it comes to reporting:
“The obligations referred to in paragraphs 1 and 2 shall not apply to an enterprise or an organisation employing fewer than 250 persons unless the processing it carries out is likely to result in a risk to the rights and freedoms of data subjects, the processing is not occasional, or the processing includes special categories of data as referred to in Article 9(1) or personal data relating to criminal convictions and offences referred to in Article 10.”
-Article 30(5) General Data Protection Regulation-
In plain language, the GDPR does not expect the same level of obligation from a small company of say 12 employees as it would from Facebook. This is unless of course you process data more than occasionally or if the data is of special categories, in which case you will need to comply in the same way as larger organisations.
Our guide will walk you through a general overview of the principles of the GDPR with specific reference to interpreting it as a small business.
It’s important to understand the general principles because, as the GDPR states, data protection is not a product but a process. In understanding the process you will be able to evaluate your current data protection procedure and update it where necessary to ensure that you are compliant with the GDPR.
A few key definitions
Data Subject: A “natural person” who can be directly or indirectly identified by information such as a name, an identification number, location data, an online identifier (such as a username), or their physical, genetic, or other identity. An example would a person named ‘James Sample’.
Personal data: The GDPR applies to ‘personal data’ meaning any information relating to an identifiable person who can be directly or indirectly identified in particular by reference to an identifier.
Sensitive personal data: The GDPR refers to sensitive personal data as “special categories of personal data”. The special categories specifically include genetic data, and biometric data where processed to uniquely identify an individual. See Article 9(1) for an exhaustive list of what classifies as sensitive personal data.
Profiling: Any form of automated processing of personal data consisting of the use of personal data to evaluate certain personal aspects relating to a natural person, in particular to analyse or predict aspects concerning that natural person’s performance at work, economic situation, health, personal preferences, interests, reliability, behaviour, location or movements.
Controller: Determines the purposes for which and the manner in which any personal data is to be processed. For example ‘James Sample’ registers with a landscaping company named ‘Green Landscapes’ via their website to find out more information about their services, in this case Green Landscapes becomes the controller of the personal data that James provided.
Processor: They process the data on behalf of the controller. Any software or CRM system such as RealtimeCRM becomes a processor of James’ personal data when Green Landscapes imports his data into RealtimeCRM.
Processing: Anything that is done to or with personal data such as:
- Organisation, adaptation or alteration of the information or data.
- Retrieval, consultation or use of the information or data.
- Disclosure of the information or data by transmission, dissemination or otherwise making available.
- Alignment, combination, blocking, erasure or destruction of the information or data.
Enforcing the GDPR
Under the Data Protection Act (DPA) the ICO could issue fines of up to £500,000 to a data controller that was in violation of the legislation. The GDPR however allows for far more significant fines of two differing levels of severity:
Under the GDPR, the ICO can issue fines of up to €10 million or 2% of worldwide turnover of the preceding financial year (whichever is greater) against both data controllers and data processors.
The following is a list of some of the provisions which, if violated, can result in the above fine:
- Failure to implement measures to ensure privacy by design (i.e. ensuring data protection is considered in the early stages of a project and throughout its life cycle).
- Failure by a controller in relation to the engagement of processors.
- Failure of a processor to process data only in accordance with the controller’s instructions; failure to report breaches; and failure to appoint a data protection officer, if such appointment is required pursuant to the GDPR.
The ICO can impose fines of up to €20 million or 4% of worldwide turnover of the preceding financial year (whichever is greater) against both data controllers and data processors.
The following is a list of some of the provisions which, if violated, can result in the above fine:
- The basic processing conditions including in respect of obtaining consent.
- Infringement of the rights of data subjects including international transfers of personal data.
- Failure to implement or adhere to a subject access request process.
In addition to the above fines the GDPR explicitly states that individuals have the right to complain including the right to judicial redress in court. This should not be taken lightly as we have seen in the case of PPI claims against UK banks therefore proof of compliance is a must.
Having listed the potential penalties of GDPR it’s not time to panic. If you are sensible and do a proper audit of your current data management system you can change it to be compliant and avoid the above. By reading on you will see that compliance is more than manageable and that the purpose of the legislation is not trip you up but to encourage you to think about data protection. Then, incorporate it into your business not as an afterthought but as one of the cornerstones of good practise.
Thinking about your current data processing
In this section we’re going to begin to think about the GDPR in more specific terms. How exactly does it apply to your business?
Before we delve into each provision of the GDPR there are a few important questions to ask yourself which will help you to see how the new legislation applies to you.
Under Article 30, the GDPR includes a reduced burden for small businesses when it comes to keeping records of their data processing. This however does not apply if you are processing special categories of data (see Article 9 for a full list of these) or if the processing you carry out results in a high risk to the rights and freedoms of the data subjects. Additionally, it does not apply if the processing of data is not just occasional. The interpretation of the not occasional phrase has not been made explicit and so we will interpret it conservatively and assume that the higher standard of recording applies to small businesses as well.
All of this may sound quite intimidating but you need not be on your own in attempting to meet the relevant compliance requirements. You can seek advice from third party consultants or benefit from the compliance mechanisms offered by cloud service providers. In that spirit we will discuss in this guide the various ways in which RealtimeCRM can help you as well as the other steps you can take to stay on top of GDPR.
Becoming GDPR compliant begins with knowing what data you collect and process, and why. This is a useful exercise to run because you may find out that you can reduce the amount of data you collect and therefore reduce your GDPR overhead.
To get to that point though you have to perform an audit of your current data processing. Fortunately, the ICO has produced an easy to use template with example data which you can fill in with all the current data processing that you do, where your data came from, who you share it with and under what lawful basis under the GDPR guideline you process that data.
We recommend you read this entire guide so you have a fuller understanding of GDPR before filling in the template below:
The GDPR encourages a risk based approach to data processing. Article 30 of the GDPR requires controllers to “ensure a level of security appropriate to the risk.” In order to find out your level of risk you will have to do a risk assessment.
It’s not as complicated as it sounds. All it requires is some common sense and an honest review of your current data processing system.
- A Threat Assessment: Are you able to identify data breaches, unauthorized network access or even things as simple as whether your physical files are locked away with only the necessary people having access to them.
- Data Audit: Look at your data collection and processing as a self contained system. What is the greatest threat to it? If your data is stored digitally, is it encrypted and password protected? Are you processing sensitive data that requires extra security and do members of staff require a Disclosure and Barring Service (DBS) check?
You will also need to have plans for incident response and breach notification, which under GDPR requires a 72-hour turnaround. This is unless the breach is unlikely to result in a risk to the rights and freedoms of data subjects.
Completing an adequate preliminary risk assessment will enable you to identify your level of risk. This is particularly important because if you are at a high risk you are required by GDPR to conduct a Data protection impact assessment (DPIA).
As a small business do I need to conduct a DPIA?
If you are a small business your level of risk is unlikely to be high enough to warrant a DPIA. The three conditions that necessitate a DPIA are:
- A systematic and extensive evaluation of personal aspects relating to natural persons, which is based on automated processing, including profiling, and on which decisions are based that produce legal effects concerning the natural person or similarly significantly affect the natural person.
- Processing on a large scale of special categories of data or of personal data relating to criminal convictions and offences.
- Systematic monitoring of a publicly accessible area on a large scale.
An example which may require a DPIA could be a hospital that is processing its patients’ genetic and health data on its information system. If you’re a small local landscaping business then the information you hold and process probably doesn’t meet the DPIA conditions.
The right to process
We have now covered a basic overview of what the GDPR is. We have gone over the preliminary steps you should take before you actually change your current data processing system as well.
From this point onward we will be getting into the detail of the legislation and specifically what you have to do to comply with it.
The foundation of compliance is that you need a lawful basis for processing personal data. The GDPR provides six lawful bases for processing. No single basis is a stronger justification for processing than the other and what matters is which bases are most appropriate to use for the purpose(s) of the processing that you intend to do and your relationship with the individual whose data you intend to process.
The lawful bases for processing are set out in Article 6 of the GDPR. At least one of these must apply whenever you process personal data:
Consent: The individual has given clear consent for you to process their personal data for a specific purpose.
Contract: The processing is necessary for a contract you have with the individual, or because they have asked you to take specific steps before entering into a contract.
Legal obligation: The processing is necessary for you to comply with the law not including contractual obligations.
Vital interests: The processing is necessary to protect someone’s life.
Public task: The processing is necessary for you to perform a task in the public interest or for your official functions, and the task or function has a clear basis in law.
Legitimate interests: The processing is necessary for your legitimate interests or the legitimate interests of a third party unless there is a good reason to protect the individual’s personal data which overrides those legitimate interests. However, this does not apply if you are a public authority processing data to perform your official tasks.
As a small business only a few of these lawful bases will apply to you when processing data, the most likely of which will be consent which we will focus on next.
How to gain consent
The GDPR defines consent in Article 4(11) as “any freely given, specific, informed and unambiguous indication of the data subject's wishes by which he or she, by a statement or by a clear affirmative action, signifies agreement to the processing of personal data relating to him or her”.
Consent is appropriate if you can offer people real choice and control over how you use their data, and want to build their trust and engagement. But if you cannot offer a genuine choice then you should not use consent as a lawful basis for processing personal data.
Clear affirmative action means the individual must take deliberate action to opt in, even if this is not expressed as an actual opt-in box. For example, other affirmative opt-in methods could take the form of signing a consent statement, oral confirmation, a binary choice presented with equal prominence, or switching technical settings away from the default.
Conditions for consent
Article 7 describes the conditions for consent but they can be summarised as your consent mechanism being specific, granular, clear, prominent, documented and easily withdrawn:
- Unbundled: Consent requests must be separate from other terms and conditions. Consent should not be a precondition of signing up to a service unless necessary for that service.
- Active opt-in: Pre-ticked opt-in boxes are invalid. You should use instead unticked opt-in boxes or similar active opt-in methods such as a binary choice given equal prominence.
- Granular: Give granular options to consent separately to different types of processing wherever appropriate.
- Named: Name your organisation and any third parties who will be relying on consent. Even precisely defined categories of third-party organisations will not be acceptable under the GDPR.
- Documented: Keep records to demonstrate what the individual has consented to, including what they were told, and when and how they consented.
- Easy to withdraw: Tell people they have the right to withdraw their consent at any time, and how to do this. It must be as easy to withdraw as it was to give consent. This means you will need to have simple and effective withdrawal mechanisms in place.
- No imbalance in the relationship: Consent will not be freely given if there is imbalance in the relationship between the individual and the controller.
When consent isn’t appropriate
As stated earlier if you can’t offer people a genuine choice over how you use their data then consent is an inappropriate lawful basis for processing. This may be the case if for example:
- You would still process the data on a different lawful basis if consent were refused or withdrawn. For example, a company that provides credit cards. They ask their customers to give consent for their personal data to be sent to credit reference agencies. If the customer were to refuse they could still send the data to credit reference agencies on the basis of ‘legitimate interests’.
- If consent to the processing is a precondition of accessing your services. In some cases this might not even constitute valid consent. Instead if you believe processing is required for the service then the better lawful basis for processing would be processing for the performance of a ‘contract’.
- If you are in a position of power over an individual like their employer then they obviously cannot freely give consent as they may fear adverse consequences or feel like they have no choice but to agree. In this case the better lawful basis for processing could be processing for the performance of a ‘public task’.
In each of the above examples, consent is not the most appropriate lawful basis for processing data. Think about the nature of the data that you are processing and whether another lawful basis is more suitable than consent.
Implied vs Explicit Consent
You must make it clear to the individual what the purpose of the processing that you intend to do is. You must then restrict your processing to only that which you have stated in the consent documentation.
For example, if an individual drops their business card into a prize draw box in a coffee shop, this can be seen as an affirmative action that clearly indicates they consent to having their name and contact number being processed for the purposes of the prize draw. It does not entitle the coffee shop to use those same details for marketing or any purpose other than the prize draw that the individual entered. This example is a case where we have implied consent which is inferred from someone’s action, in this case dropping their business card in the prize draw box.
In the example below, an individual must give consent explicitly by ticking an opt-in box to receive emails about products and special offers. The ‘explicit’ element of any consent statement should be separate from any other consent you are seeking and it should clearly refer to the exact processing for which you are seeking consent. If relevant, you should state the nature of the special category data you are trying to collect as well.
RealtimeCRM can aid you in recording consent by allowing you to create a custom field which records the specific processing they have agreed to and when they agreed to it. Using the example above you could as ‘We do Hairdos’ scan the filled in consent form and have it linked to the appropriate Contact record via RealtimeCRM’s Documents feature. In that way you have the nature of the consent and proof of the consent all in one place associated with the relevant individual.
How often do I have to revisit my consent?
The GDPR does not put a time limit for consent. Context is far more important. If your processing operations or purposes evolve then your original consent may no longer be specific or informed enough to be valid. If this happens you will need to seek fresh consent or identify another lawful basis.
What about Children and Consent?
Article 8 of the GDPR describes when a child can and cannot give consent. It states that if that child is at least 16 years old then they are capable of consenting to their personal data being processed. Otherwise, if they are under 16 years old you must gain consent from the holder of parental responsibility over the child.
However, member states can choose to lower the minimum age at which a child can provide consent, and in fact the UK may choose to lower the minimum age to 13. If you do choose to rely on children’s consent you’ll have to implement age verification measures and make reasonable efforts to verify parental responsibility for those under the relevant age.
Document your Consent
Ensure that you keep records to evidence consent. They should clearly state who consented, when, how, and what they were told. We have already discussed how software such as RealtimeCRM can help you achieve this. You should also make it easy for people to withdraw consent at any time, preferably in the same manner as they first consented.
This means that, ideally, if they consented via an online form they should be able to withdraw consent via an online form that is easy to find and use.
You should not leave it to the last minute to review your current consent documentation. If it is insufficient then you need to get the proper consent now. It would be very unwise to wait until the last minute because you will not be the only business playing catch up. We can imagine around the month of May inboxes filling up with businesses trying to get consent.
If you’re ahead of the game you’re less likely to annoy and therefore more able to get the proper consent.
If you’d like more information regarding consent then take a look at the ICO’s guidance below:
The rights of the data subject
Articles 13 through to 22 of the GDPR describe certain rights that data subjects are entitled to. In this section we will be covering each one in turn and looking at how they may affect your small business.
It may seem like a sisyphean task to ensure you uphold each right, but as before it needs to be seen as a process rather than a product. Some of the rights will be less relevant to smaller businesses as they are designed to deal with large corporations instead.
Your data processing system should be designed by default to comply with each of these rights. We will also discuss how RealtimeCRM can help you comply with each right where relevant.
The rights of the data subject are as follows:
- The right to be informed
- The right of access
- The right to rectification
- The right to erase
- The right to restrict processing
- The right to data portability
- The right to object
- Rights in relation to automated decision making and profiling
The right to be informed
Put simply, you need a privacy notice which transparently and simply explains who you are, what data you are collecting, for what purpose (especially if the data will be used in profiling), for how long will you hold onto the data and finally if you will pass it onto a third party.
You must also clearly state where you got the personal data from if you did not get it directly from the data subject, as well as how the data subject may withdraw consent or complain to the relevant supervisory body.
The right of access
Individuals have the right to access the personal data which you hold on them and any supplementary information. The primary reason for this right is that it allows individuals to be aware of and verify the lawfulness of the data processing which you are doing.
The time limit from the request being made by the data subject to the information being obtained by them is 1 month. For some businesses this could be difficult if they have many customer information requests or a very complex data management system (say, multiple spreadsheets without an efficient reference system) to gather the required information in a timely manner incurring a cost to the business. Unfortunately, under GDPR guidelines you are not able to charge a fee for dealing with an information request so streamlining this process to be as efficient as possible is in your interest.
With RealtimeCRM we want to make complying with the right to access component of the GDPR as simple as pushing a button, in fact that’s what we’ve done. We’ve introduced the GDPR button on all Contact records. In clicking this button you can download a text file with all the information you hold on that Contact. This allows you to quickly and painlessly send this information to the customer, allow them to check its accuracy and whether they consent to you continuing to hold this information. Your data management system shouldn’t be a hindrance to compliance but an aid to it.
As you can see having your data stored electronically in a CRM system like RealtimeCRM can save you a significant amount of time and make compliance a lot easier.
The right to rectification
The GDPR enables individuals to rectify their personal data if it is inaccurate or incomplete. Furthermore, if you have disclosed this inaccurate personal data to third parties you must inform the data subject of these third parties and also inform the third parties that the data is to be rectified and thus made accurate.
Once again if you receive a rectification request from an individual you have one month to comply. Our GDPR feature within RealtimeCRM can quickly enable you to provide the information requested.
The right to erase
The underlying principle of this right is to enable an individual to request the deletion or removal of personal data where there is no compelling reason for its continued processing.
For most small businesses it will likely apply if the personal data is no longer necessary for the purpose it was originally collected or if the data subject withdraws their consent to process their data, or if the data was unlawfully processed i.e. in breach of the GDPR.
As before, if you have passed their personal data onto a third party you must inform them of the erasure request too unless it is impossible or involves disproportionate effort to do so.
If you have the right system in place you can comply with this requirement of the GDPR without too much trouble. In this case storing your data electronically such as in RealtimeCRM allows you to quickly search for the individual’s record and simply click the Delete button. Their data will be removed from the CRM system permanently.
The right to restrict processing
This right enables individuals to stop you from processing their data but you are still allowed to store their personal data.
An example of when this might apply for a small business is if the individual questions the accuracy of the data you hold on them. In this case until they have verified its accuracy you must not do any processing with this data.
The right to data portability
The right to data portability allows individuals to obtain and reuse their personal data for their own purposes across different services. Put simply, they can move, copy or transfer personal data easily from one IT environment to another.
In order to comply with this the data has to be provided in a structured and machine readable format such as a CSV file. From the initial request you have 1 month to comply. If it is particularly complex or you receive many such requests then you may request an extension to 2 months in order to comply. You will also not be able to charge for this service. If you’re not storing your data electronically or if it is stored across many complex spreadsheets this task can be very arduous and time consuming.
With RealtimeCRM however you can simply select the Contact record you want and export it. It will automatically export it as a CSV file, enabling you to pass this onto the data subject who made the initial data portability request without much fuss.
The right to object
Individuals have the right to object to you processing their data on grounds “relating to his or her particular situation”. If you receive such an objection you must cease processing their data unless:
- You can demonstrate compelling legitimate grounds for the processing, which override the interests, rights and freedoms of the individual.
- The processing is for the establishment, exercise or defence of legal claims.
You must also inform individuals of their right to object in your first contact with them or in your privacy notice. The GDPR states that the right to object must be “explicitly brought to the attention of the data subject and shall be presented clearly and separately from any other information”.
Rights in relation to automated decision making and profiling
This will unlikely be relevant to small businesses. This is more for your Google’s of the world. Basically, automated decision making means making a decision without any human involvement and profiling means automated processing of personal data to evaluate certain attributes of an individual for example their interests.
If this applies to you then you must:
- Give individuals information about the processing.
- Introduce simple ways for them to request human intervention or challenge a decision.
- Carry out regular checks to make sure that your systems are working as intended.
Documenting your data processing
Article 30 describes in detail the records of data processing which businesses are required to keep. As we have discussed previously there is a less rigorous requirement for smaller businesses but due to the as yet undefined meaning of “data processing is not occasional” in this guide we will assume the full documentation standard applies to small businesses as well.
If you recall back to the section in this guide titled “Thinking about your current data processing”, we went through how to do a data audit of your current data processing system and provided you with a template “The Controller data processing documentation template” with which to record all your data processing activities.
That’s what documenting your data processing is in a nutshell: It’s filling in that template. As we covered in that section, and the template demonstrated, you must document the following things:
- The name and contact details of your organisation and where applicable, of other controllers, your representative and your data protection officer.
- The purposes of your processing.
- A description of the categories of individuals and categories of personal data.
- The categories of recipients of personal data.Details of your transfers to third countries (countries outside the European Union) including documenting the transfer mechanism safeguards in place.
- Retention schedules.
- A description of your technical and organisational security measures.
You can also record additional data such as the location of where the personal data is stored and records of consent if you desire but when documenting your data processing ensure that it is is granular and meaningful.
The purpose behind it is not only to enable you to prove compliance but also get you thinking about whether your current data processing system meets the required GDPR standard. Then to think about what can be improved to ensure it does meet the standards set out in the legislation.
How RealtimeCRM can help you keep an eye on your data processing activities
With RealtimeCRM you can easily increase the granular detail of your data processing . You can use the Activity Notes and Event Log feature which allows you to create an audit trail of your data processing. This could be useful as an extra layer of evidence to help prove compliance with GDPR, should the ICO ever decide to look at your data processing activities.
The Activity Notes appear in every record when you do something to that record. For example, let us imagine you create a new project for a customer. Obviously, you will need to use the customer’s personal data to complete the project. The activity note will appear on the Customer’s record detailing the date, time and other details of the newly created Project, automatically recording this new data processing which has taken place.
Furthermore, the Event Log feature records any activity which has taken place in RealtimeCRM including who did it and when. This might be when a customer record is deleted. In this way you can keep an eye on your data processing activities and make sure you remain compliant and, if needed, prove compliance with the inbuilt data audit trail tools within RealtimeCRM.
Secure by design and default
The GDPR legislation requires you to implement technical and organisational measures to show that you have considered and integrated data protection into your processing activities.
In plain language, have you made the personal data you have secure? One of the key features of a secure system would be that it ensures privacy by design. Some of the ways in which privacy risk can increase is if the data you hold is:
- Excessive or irrelevant.
- Kept for too long.
- Used in ways that are unacceptable to or unexpected by the person it is about.
- Not kept securely.
For a small business to ensure your data processing system is secure by design and default is to first describe your information flows.
Next, how do you store your data? If it is kept physically in a filing cabinet then is it locked and who has access to it? What about backups in case of physical damage to the data?
If it is stored electronically, is the data encrypted and once again who has access to the data and are you regularly updating your security software?
The three fundamental questions to ask when thinking about this problem are:
- How is my data secured?
- Who has access to the data?
- What protections are there against damage or unauthorised access?
As a small business you may find it useful to use third party software so you can take advantage of its inbuilt security measures. For example, RealtimeCRM enables you to restrict what different users can see and access. In that way you can protect your customer’s personal data and only allow staff members the absolute minimum access they need to carry out their work. Plus with the Event Log feature you can see if any unauthorised access has taken place adding an extra layer of security.
In addition, all communication between your browser and Realtime is encrypted with SSL. This is the same technology used to secure internet banking.
Do you need a Data protection Officer (DPO)?
As a small business you probably won’t need to have a Data Protection Officer (DPO) unless:
- You carry out large scale processing of special categories of data or data relating to criminal convictions and offences.
- You carry out large scale systematic monitoring of individuals. For example, online behaviour tracking.
If you do decide to employ a DPO their minimum tasks will include:
- To inform and advise the organisation and its employees about their obligations to comply with the GDPR and other data protection laws.
- To monitor compliance with the GDPR and other data protection laws, including managing internal data protection activities, advise on data protection impact assessments; train staff and conduct internal audits.
- To be the first point of contact for supervisory authorities and for individuals whose data is processed
Compliance need not be a nightmare
Hopefully, having read this guide and understood the principles behind GDPR you can see its efficacy and that it is not a terrifying iceberg you will run into in May. It’s a process not a product, it will require you to think about the way you process data currently and then ensure that security remains at the foundation of any system you implement. Keeping your customer’s data secure and in that way building trust with them in the long term.
We hope this guide has been useful in untangling what seems like an overwhelming subject. This is not a legal document but our interpretation of the new legislation and how it will likely impact small businesses. The GDPR is not a one size fits all solution and should not be read without the context of the type and size of business you are interpreting it for.
At the end of the day only you know exactly how your business processes data and it will be up to you to incorporate the principles of GDPR into your data processing system.
Try RealtimeCRM free for 30 days
Instant access No credit card required