What Businesses Should Know About GDPR Legislation

Cecily Giancaterino

May 25, 2023

∙

12 min read

CRM

Welcome to our blog where we shed light on an important topic for businesses - GDPR (General Data Protection Regulation). In today's digital landscape, data privacy and protection have become critical concerns for organizations. Understanding the impact of GDPR and implementing necessary measures can help businesses ensure compliance, build trust with customers, and safeguard sensitive information. In this article, we will delve into the key aspects of GDPR and its implications for businesses. Let's explore how you can navigate the GDPR landscape and prioritize data privacy in your operations.

Key Takeaways:

GDPR at a glance: GDPR is a regulation enacted by the European Union (EU) to protect the privacy and personal data of EU citizens. It sets strict guidelines and requirements for businesses handling personal data, regardless of their location.
Scope of GDPR: GDPR applies to any organization that collects, processes, or stores personal data of EU citizens, irrespective of its size or location. It encompasses various data protection principles and rights that businesses must adhere to.
Consent and transparency: GDPR emphasizes obtaining explicit and informed consent from individuals for processing their personal data. Businesses must provide clear and concise privacy notices, informing individuals about data processing activities and their rights.
Data subject rights: GDPR grants individuals several rights, including the right to access, rectify, erase, and restrict processing of their personal data. Businesses need to have mechanisms in place to handle such requests and ensure compliance.
Data protection measures: GDPR mandates implementing robust data protection measures, such as pseudonymization, encryption, and regular data backups, to safeguard personal data from unauthorized access, breaches, and loss.
Data breach notification: In case of a data breach that poses a risk to individuals' rights and freedoms, businesses are required to notify the relevant supervisory authority and affected individuals without undue delay.
Data protection impact assessments (DPIAs): DPIAs are conducted to assess and mitigate risks associated with data processing activities that could result in high risks to individuals' rights and freedoms. Conducting DPIAs demonstrates a commitment to privacy and helps identify and address potential vulnerabilities.
Non-compliance consequences: Non-compliance with GDPR can result in severe penalties, including fines of up to €20 million or 4% of global annual turnover, whichever is higher. Reputational damage and loss

What is it and when will it be applicable?
What are the rules of GDPR?
What do companies need to do?
Conclusion
FAQs

What is it and When Will it be Applicable?

The General Data Protection Regulation, known as GDPR (or to give it its proper name, "Regulation (EU) 2016/679") is a new piece of European legislation which governs the data protection rights for all individuals within the EU. It serves to strengthen and unify all data protection rules and practices across the European Union.

The new regulation comes into force on the 25th May 2018, but was brought into law on the 27th April 2016. A 2-year grace period was awarded to allow businesses to get up to speed.

The GDPR gives European citizens clear rights to access, amend, and restrict access to personal data held by companies about them. Companies who deal with such data need to be compliant with the new rules as of the 25th May 2018, or potentially face a hefty penalty; fines could go up to EUR20 million or 4% of the company's worldwide annual turnover from the preceding financial year (whichever of those figures is greater).

What Are the Rules of GDPR?

The Importance of Consent

Consent is an important concept within GDPR, and revolves around individuals providing companies with specific permission to use and store their personal data. Consent must be knowingly and willingly given by the user, with companies making their intentions for data use made clear. Soft opt-ins, implied consent, and hiding data policies within confusing T's and C's are all against GDPR rules.

An auditable trail of consent needs to be kept in case a claim of GDPR infringement is made against the company. Businesses must be able to prove that an individual has actively provided their consent to use their data for a given, clear purpose and nothing else.

Individuals will also have the right to retract that consent at any time, and also have the "right to be forgotten," which means that if they request a company delete their data, the company should do so immediately.

The Right to Object

EU citizens will have a legal right to opt out of marketing communications. If a customer withdraws consent from an activity - such as receiving marketing materials or phone calls - that activity must cease immediately unless the individual consciously and willingly opts back in again.

The ruling also provides protection with regards to automatic profiling. If you use systems that make automated decisions about people with no human input, and those decisions present a significant legal or financial effect on the person, they will have a right to opt out of this process and get a second opinion from a human decision maker.

Rights of Access, Rectification and Restriction

Every EU citizen will have the right to ask and be informed about how any company uses their personal data, where it's used and why. If they find that a company holds incorrect information on them, they have a right to contact the company in question and have that information put right. Individuals are also now able to object to certain uses of their data, for example when companies sell personal data for profit.

Citizens will also have a "right to access" which means that they have the right to request a digital copy of any information a company has about them. Consumers will also be able to request limits to the access of their data.

The focus here is on transparency and fairness. If a citizen finds out that their data is being used in a way that they do not consent to, it is within their right to object to that use and have it stopped.

Notification of Breaches

In the event that you suffer a breach of personal data that results in the loss, alteration, access or unauthorised disclosure of people's data; and the breach is significant enough to "result in a risk to the rights and freedoms of individuals"; you will need to notify those individuals directly as soon as possible. These individuals must be advised of how they may be affected and told what the company is doing to remedy the situation and minimise further risk.

The company must also inform their relevant supervisory authority within 72 hours of the company becoming aware of any breach. For more information about dealing with data breaches under the new legislation, check out this page from the ICO.

Rights to Portability

The GDPR grants individuals the "right to portability", which is the right to move data and services to another provider with no hassle or strings attached. For example, if an individual wants to change banks, they have the right to do so without any fuss or complications.

Increased Protections for Children

The GDPR also contains provisions enhancing the protection of data belonging to under 16's. If your services are directly offered to children, privacy notices need to be explained in a way that a child would understand. Online services provided to under 16's may need consent from someone holding "parental responsibility". However, a guardian's consent is not required when offering counselling services to those under 16.

What Do Companies Need to Do?

The first important step is to become familiar with the legislation itself and the nature of your existing client data. Establish what consent has already been given, what elements of that consent can be proven, when it was given, and what this allows you to do with their data.

Next, take a look at how you are currently using existing data. If you are sending marketing materials to people who have not provided consent, stop immediately and obtain consent before you market to them further. Marketing to previous customers and parties who have registered general, vague interest without giving explicit consent to receive marketing materials is also a breach of GDPR.

Then, take a look at new data that's flowing into the business. Consent needs to be proven, so make sure that any consent is properly sought in an auditable way, down to the time and date they opted in. Any objections to marketing or to the transfer of data to a third party will need to be noted accordingly, and that data needs to be ring-fenced so marketing communications can't go to non-consenters by accident. The ruling applies to any kind of acquired data; online or offline. If someone wants their data to be deleted from your systems, make sure you can do so immediately and effectively.

Every single person in your company who receives or processes client data will need to be aware of the new ruling, as well as their revised confidentiality, access and portability responsibilities. Assign someone the role of Data Protection Officer to handle compliance with the new rules, to keep an eye on ongoing data handling practices, and to deal with any data breach issues should they arise.

Perform your own research into the new legislation and become familiar with what will be required of you.
Establish what auditable consent has been provided for the data you currently hold and establish systems to request consent in future.
Implement an auditable trail of consent for marketing and data usage from both your existing database and from new contacts going forward.
Know what data you hold on individuals and businesses. This isn't just client and prospect data; it also includes internal things like employee details and HR records.
Know how that data is accessed, who by and what for.
Know whether that data passes to a third party and whether the individual is aware of this.
Know where individuals' data is stored; whether that's on a standalone PC, your internal network, or in cloud storage; and assess the security of that storage medium.
Implement a system to deal with data amendment and deletion requests in keeping with GDPR rules.
Appoint a Data Protection Officer within your company who can be responsible for compliance, preferably someone who has knowledge of IT security and data protection.

Conclusion

In conclusion, GDPR is a game-changer in the realm of data protection and privacy, requiring businesses to prioritize the security and rights of individuals' personal data. By embracing GDPR and implementing the necessary measures, organizations can build trust with their customers, mitigate risks, and avoid hefty penalties. At FiveCRM, we understand the importance of data privacy and compliance. Our CRM solutions are designed to assist businesses in managing customer data securely and efficiently, ensuring GDPR compliance throughout the customer journey. With advanced features, seamless integrations, and robust security measures, FiveCRM empowers businesses to navigate the complex landscape of data protection and privacy effortlessly. Don't miss out on the opportunity to streamline your data management processes and safeguard your customer relationships. Book a demo today and discover how FiveCRM can be the trusted partner you need for GDPR compliance and beyond. Take the first step towards data protection excellence and unlock the full potential of your business.

FAQs

What is GDPR?
- GDPR stands for General Data Protection Regulation. It is a regulation enacted by the European Union (EU) to protect the privacy and personal data of EU citizens.
Who does GDPR apply to?
- GDPR applies to any organization, regardless of its size or location, that collects, processes, or stores personal data of EU citizens. It applies to both data controllers and data processors.
What are the key principles of GDPR?
- The key principles of GDPR include lawful, fair, and transparent processing of personal data, purpose limitation, data minimization, accuracy, storage limitation, integrity and confidentiality, and accountability.
How does GDPR impact businesses?
- GDPR imposes strict requirements on businesses, such as obtaining explicit consent for data processing, implementing robust security measures, conducting data protection impact assessments, and promptly reporting data breaches. Non-compliance can result in significant penalties.
What are the rights of individuals under GDPR?
- Individuals have various rights under GDPR, including the right to access their personal data, rectify inaccuracies, erase data in certain circumstances, restrict processing, data portability, and object to processing.
How can businesses ensure GDPR compliance?
- Businesses can ensure GDPR compliance by understanding the regulations, conducting privacy impact assessments, implementing appropriate data protection measures, training staff, and maintaining ongoing compliance efforts.
How can FiveCRM help with GDPR compliance?
- FiveCRM offers CRM solutions designed with GDPR compliance in mind. The platform provides secure data management, consent management, data subject request handling, and features to support data protection impact assessments.
How can I get started with FiveCRM?
- Getting started with FiveCRM is simple. Book a demo to explore our CRM solutions and see how they can help your business achieve GDPR compliance and streamline data management processes.

Michael King says...

"I can’t think of a time where a client has requested something that we weren’t able to do with FiveCRM. Unlike most systems, it has a lot of flexibility."

Managing Director, Senior Response

JAINE HUSBANDS SAYS...

“Each client, and each of their campaigns, has its own unique specifications. We essentially needed to set up mini CRMs on one platform to meet those requirements.”