Whether your business is based within the EU or you have contacts in your database from the European Union, you should now have heard about the General Data Protection Regulation (GDPR) which comes into force on 25^th May 2018.

For those that haven’t heard about the new regulation, the GDPR is the replacement to the Data Protection Act and will alter the way that companies (of ALL sizes) can market to their contacts. The GDPR regulates the handling and processing of personal data belonging to citizens of the UK and European Union.

Any organisation that processes personal data of EU citizens will be affected by the new regulation which is set to have a substantial impact on organisations on a global level.

Under GDPR, companies in breach of the new law (which replaces the Data Protection Act (DPA) can be fined up to 4% of annual global turnover and up to the upper limit of €20 Million.

GDPR is a binding act which must be followed in its entirety for those processing data of EU citizens. It will modernise outdating data protection laws and will enhance the individual’s rights to data privacy.

The regulation will have a significant impact on businesses around the world and will regulate how organisation obtain, store and process personal data.

The GPPR was passed in April 2016 but becomes enforceable on 25^th May 2018, at which time, the new stipulations for data processing will become mandatory, there will be no ‘grace period’, the time between now and then has been put in place to enable companies to become ‘ready’ and compliant in time for the enforcement date.

The GDPR not only affects those companies based within the EU, it also impacts those that process data of EU citizens. To prepare for the 25^th May, all organisations need to put measures in place to ensure that all data is treated, handled and processed correctly moving forward.

Under the GDPR, ‘personal data’ is considered to be any information relating to an identifiable individual. If you collect names, addresses, email addresses, IP addresses, location data, financial information etc, the GDPR applies to your company.

Data capture and consent

The GDPR requires all companies to adhere to stricter ‘consent’ capture. As one of the fundamental changes to the data protection law, this is one of the primary areas to be addressed prior to the cut-off date for compliance.

Under the new, stricter regime, all organisations must ensure that they have obtained explicit consent from each subject that they hold data for. Take for example, the 500, 5000 or 500,000 contacts you have accrued over the years, this data will become null and void if the new level of consent is not acquired in advance of 25^th May and legally, you will not be able to continue to hold that information in any form, let alone process it via marketing emails, telephone calls or via any other transaction.

Additionally, separate consents must be obtained for different processing activities which means that your data and privacy policies will need to have clearer statements of intent.

All ‘subjects’ (from past and future data collection activities) will need to provide the processing organisation with consent for their data to be held, to be stored, to be processed (and in what capacity). Separate consents need to be obtained if you wish to

1. a) use their data for telephone calls,
2. b) use their data for you to email to them
3. c) for you to send them information via post etc.. One statement of consent will not be sufficient to cover all these bases.

The ‘subject’ will also have the ‘right to be forgotten’ and organisations that process data will need to have mechanisms in place to remove all trace of such data from their records and systems, should they wish to be ‘forgotten’.

If you are an organisation that is based in the European Union or one that is processing the personal data of EU citizens, the GDPR will apply to you.

There are two areas to focus on.

1. Adapting current processes so that the NEW data you collect is done so in accordance with GDPR – consent, consent, consent.
2. Put a plan in place to manage your historical data

Consent Management Solutions

Lead Consent is the latest data processing solution with auditable reporting and secure record storage. Lead Consent was devised with the new data protection regulation in mind to allow users to safely and securely manage their marketing data.

Lead Consent is a data processing solution that enables users to prepare their data for GDPR ‘readiness’.

Lead Consent’s entry level product ‘Lead Consent’ offers companies of all sizes, the ‘kit’ needed to bring their existing data into line with the new legislation which affects the way that the data of EU citizens is processed.

In advance of the GDPR enforcement date, this system will allow users to request the relevant consents from contacts within their historical databases. Proof of the consenting individuals is then stored safely and securely within Lead Consent, providing them with compliant marketing data for future processing.

The system provides a secure audit trail and storage of consents received and affords companies of all sizes the peace of mind that marketing data complies with the new GDPR stipulations. Once consent is received, organisations can continue to use this data for email, postal or telephone marketing purposes depending upon the level of consent supplied.

Once the cut-off date of 25^th May is reached, organisations that do not obtain the relevant consents stipulated by the GDPR will no longer be able to market to their existing databases, irrespective of how they came across the data.

To prepare your marketing data for GDPR compliance ‘readiness’, sign up to Lead Consent today.

*This post should not be relied upon as legal guidance. If you are unsure about your obligations under the GDPR, you should seek legal guidance regarding the full scope of your compliance obligations and requirements to ensure that you are fully aware of every eventuality and consequence for non-compliance.