GDPR initially came into force on 25th May 2018, but there was no sign of companies being ready for it in the preceding months. Research in late 2016 by the Chartered Institute of Marketing found that 41% of marketers were unsure about best practices or laws surrounding the handling of consumers’ personal data. Regardless, the EU wanted to make businesses accountable for the way they handled this data, giving individuals more say over how their details are used.
There’s no question that GDPR was overdue since previous regulations were based on a document dating back to 1980, which was last updated in the mid-1990s. In two decades, the way people interact and live their lives has changed beyond recognition. Prodigious use of smartphones and social media has created a gold mine of personal data for businesses to tap into. Emerging web technologies like AI and virtual reality are set to reveal more about who we are.
Complying with GDPR is a serious matter. Failure to do so invites huge fines of up to €20 million or 4% of global turnover, depending on the infringement. So what was it that companies had to do by May 25th 2018; the GDPR D-Day?
From the consumer end, the most visible change after GDPR was an increase in pop-up privacy policies and cookie consent forms. As frustrating as that might have been at the front end, there was a whole lot more to think about at the back end. Some marketers focused too much on their websites, leaving themselves exposed to GDPR violations by what they weren’t doing in the background.
Some of the key points of GDPR compliance include:
Companies also have to train employees in data protection and make them aware of their responsibilities. Businesses involved in prolific processing of personal data must employ a data protection officer (DPO) to oversee GDPR compliance.
A vital component of GDPR and one that has to be entered into by all parties is the data processing agreement (DPA). What is this? In a DPA, the “controller” is the person or business that determines the purpose of personal data and how it is to be processed. The “processor” is a third party who stores data on independent servers and/or processes it.
The GDPR made third-party processors more accountable so they couldn’t shirk responsibility for data breaches as was previously possible. A strict set of regulations now governs the relationship between these two parties. Controllers must enter into a written agreement with processors, who become equally liable for all stored and processed data under GDPR and can only act under the controller’s instructions.
New EU regulations are one thing, but compliance is another. By July of 2018, only 20% of companies believed themselves to be GDPR compliant. Fast-forward to late 2018, and industry experts still think many businesses are out of line with GDPR.
One potential hurdle to GDPR compliance is “data sprawl”, which describes the fragmentation of data (both corporate and personal) across many files, archives, analytical platforms, data silos, locations and management systems. For many companies, this problem stems from before GDPR and, unsurprisingly, continues beyond it.
The problem of data sprawl is a challenging one for IT teams, who might have to trace and clean up “data swamps,” and create a centralised data platform that is easily accessible to all employees. Controlling data is in the best interests of companies concerning their business, as well, since it establishes trust and shows clients that their privacy is taken seriously.
For many companies, complying with GDPR is no picnic. Aside from the fact that data might be spread far and wide, there are many in-house points to attend to. It requires excellent communication and team-work. What’s more, it needs constant attention; a company can fall out of compliance if it’s not careful. GDPR compliance is an ongoing process.
One way a company can get organised and eradicate mistakes is with purpose-designed software. For example, GDPR365 is a full-featured programme that helps with all aspects of GDPR compliance, including data risk assessments, built-in GDPR guidance, data-sharing contracts with other controllers, subject access management, managing data shared with external processors, data breach management and compliance assessment.
Online marketing tools such as chatbots, which are powered by AI, also have to comply with GDPR, so businesses still have to provide a clear consent form before using them to collect data. This data has to be accessible by the user, too, and can’t be used for covert distribution to other parties. A range of GDPR-friendly website plugins is available to marketers (e.g. online forms and GDPR compliance aids for controllers, processors or DPOs).
Companies and marketers that didn’t know it before will know by now; complying with GDPR is about much more than tweaking the front end of a website and keeping up appearances. It needs a whole new approach to the way personal data is used, stored and distributed. Those that get on board with it and are passionate about customer care will reap the rewards.