GDPR for SME Are Fast Approaching. Are You Ready?
Big businesses the world over have whole fleets of legal advisors and compliance experts to help them navigate the world of data protection in the face of the new General Data Protection Regulation (GDPR). What about GDPR for SME?
But what about the rest of us?
Most companies don’t have a huge legal department to advise them on new legislation. They have their solicitors, of course, and probably someone on the team who has made it their business to know about these things, but there’s a lot of work needed to get a business ready for the changes due out next month.
All this work on top of the normal day-to-day operations. It’s a dizzying prospect and one that some SMEs have been avoiding for several months.
With the deadline (25th May) fast approaching, however, the time to face the music has come.
But where to begin? It can feel overwhelming, but we’ve got four steps you can take that will help kick you off on your journey towards GDPR compliance.
Step 1: Learn the Lingo
The language surrounding GDPR is complicated. I’m not talking about the legalese the document itself uses, I’m just referring to the words they use to describe data and the people who use it! Here are the key ones:
Data subject
The person the data is about.
You have an email address for Bob Smith, he’s the data subject. Important to remember that companies can also be data subjects.
Data processor
The person (or company) that actually handles the data.
Mary in marketing sends emails via OpenCRM — both Mary and OpenCRM are data processors.
Data controller
The person who decides what should happen with the data — the one who makes all the rules.
Your MD, for example, is probably the person who ultimately decides whether or not Mary should be emailing Bob at all.
Then you’ve got all the rights that the data subjects will get with GDPR…but hold on, we’re not quite there yet.
Identify the Data You Currently Have
This is a big one — you can’t protect data you don’t know exists. So an audit, I’m afraid, is in order.
And don’t forget, this includes data about people regardless of whether it’s held on paper, on your computer, in the Cloud, or even chiselled into stone…although I don’t know many businesses who use stone for record keeping.
Getting a feel for how much data you have and what it actually is (emails, names, addresses, bank account numbers, etc.) is a vital part of protecting it.
Do we have what it takes?
We don’t restrict which features you have access to in OpenCRM based on how many users you have. You get everything right out of the box. Click to find out if we’ve got the features you need.
Find out more →Write Down a Plan for What You Want to Do With This Data
Do you want to keep it? For how long? When do you think is “long enough” to hold onto a data subject’s information?
You’ll of course need to take into account your other legal obligations (HMRC springs to mind), but having a documented data retention plan is essential.
After all, how else are you going to start implementing it?
What Will You Do if Someone Makes a Request?
There are a number of new rights that data subjects will get under GDPR. Several of them give them the right to make some requests from you. Specifically, the right to amend incorrect data you are holding (maybe their name is spelt wrong), the right of access (so they can see what data you do hold), and the right to be forgotten.
You need to make a plan for what you want to do in these cases. Check out the ICO’s guide on preparing for GDPR, they’ll explain each of these and what your responsibilities are with them.
But once you know what you want to do, write it down. Document your policies. This is an important element in making sure that everyone on your team and suppliers (your data processors) are made aware of them.
And that’s not really the end, but it’s a good start. The important thing is to get started…especially as the deadline is almost here!!
Ready to get GDPR-ready?
See how OpenCRM can help you manage consent, retention, and data requests.
Start your free trial