As of the 25th Of May 2018, All businesses that have any data used to identify an individual MUST be GDPR Compliant.
GDPR (The General Data Protection Regulation) is designed to harmonize data and privacy laws across the entirety of Europe and give power to the citizens of the EU to the control of their digital footprint.
What Does This Mean For My Business?
It’s important to understand that the goal of GDPR is not to punish businesses, but instead to protect every individual’s personal information and make their rights more known.
This means that your business must comply with the laws to avoid some of the monstrous fines that follow should the your business fail to comply.
According to GDPR, companies will have to pay anywhere from 10 to 20 million euro or 2-4% of their worldwide annual turnover. Ouch.
On top of that, users can file lawsuits against your business if it’s not GDPR compliant and request compensation due to the wrongful acquisition of their personal information and data.
Not only is this a massive monetary hit on your business, but it also tarnishes your reputation massively.
How Do I Make My Business GDPR Compliant?
Here are the 3 basic steps that you need to take in order to make your business GDPR compliant.
- Map Your Users’ Data
- Update Privacy Notices
- Employ New Processes (Internal) For Data Protection
Map Your Users’ Data
This is the very first step that should be undertaken. Therefore you can start your data processing changes with an internal overview of all the data you store on your users. Organize everything by type of data into folders and categories.
Having everything organized will give you a much clearer picture of how data enters your business and how it should flow with all the necessary adjustments to make your company meet the EU regulation.
Update Privacy Notices
This is no less important than the first step. You need to review all of your privacy notices (internally and externally)
Your privacy notices should inform the user of the following:
- Which data is collected
- What it will be used for
- How long will it be stored for
- How can users access it
- What is the basis (lawfully) for this data collection
Employ New Processes (Internal) For Data Protection
Unfortunately, it’s not enough to just give an external appearance that make your business “look” GDPR Compliant. Personal data protection should become part of your company’s day to day operation and training should be supplied to all staff members to help prevent breaches and theft of data in the future.