Dealing with GDPR

It all depends on whether you store or use personal data on European citizens. That goes, whether those citizens are customers, prospects or employees. If you have European employees, you probably store their names, addresses and bank information. Data like that is considered personal data in the eyes of the European Commission and you need to implement parts of the regulation, for instance, employees must give consent to the use of their data and have rights such as the right to rectification and you need to be able to document all of this to authorities.

It depends on the type of data you are processing. Can the data be used to identify individuals? If yes – and for most B2B companies, the answer will be yes – you are processing personal data in the eyes of the European Commission and need to comply on the same terms as B2C companies.

The simple answer is: Yes, you are. If you process personal data of European Union citizens, you need to comply no matter where you’re located – EU member or not.

No, not necessarily. Although an early draft of the GDPR specified that the exact number of 250 employees was the trigger for whether or not you need a DPO, the final regulation does unfortunately not have quite as clear guidelines for this. DPOs are mandatory for all public authorities, for organizations that conduct large-scale processing of special categories of personal data (such as health data), and where the core activities of a business involve "regular and systematic monitoring of data subjects on a large scale". Most large retailers fall under this definition. If you are unsure whether or not this applies to you, we suggest you seek legal advice.

Yes. The GDPR sets out a so-called “Data Storage Limitation”, meaning that personal data cannot be stored longer than is necessary for the processing purposes. Personal data may be stored for longer periods as long as the data will be processed only for archiving purposes in the public interest, or scientific and historical research purposes or statistical purposes.

Yes. It’s now a consumer right called the “Right to Data Portability”. The GDPR explicitly says: “The data subject shall have the right to receive the personal data concerning him or her, which he or she has provided to a controller, in a structured, commonly used and machine-readable format and have the right to transmit those data to another controller without hindrance from the controller to which the personal data have been provided.”

The GDPR has for sure a big impact on the way you do your marketing not to mention who you can target, and that goes whether you’re in B2C or B2B. The consent requirements ask of you to collect clear consent from each targeted individual that makes it clear that he or she is happy for you to use their data and market to them. Before, you could collect contacts and put them in your database and then use their data to further market to them on platforms and with purposes differing from where and for what the data was originally collected. With the GDPR, the consent has to be specific to that particular processing operation, meaning that you cannot request open-ended or blanket consent to cover future processing. If you want to market to someone in a new way, you will have to collect a new consent for this specific purpose. Furthermore, you need to properly manage all of these consents to be able to document it towards authorities upon request.

Yes, but the receivers have to live up to certain data protection standards. The GDPR permits personal data to be transferred to non-EU organizations and countries which have been found by the European Commission to provide an “adequate” level of protection or under certain circumstances, such as by use of standard contractual clauses or binding corporate rules (BCRs).

The GDPR is also created to make it simpler for organizations to manage personal data in a multinational environment and to minimize the risk of businesses being involved in seriously damaging data breaches. The GDPR has in most aspects replaced different national laws, with the aim of harmonizing data protection rules throughout Europe. Additionally, With the introduction of a “Supervisory Authority” in each member state, organizations have one place to go to with all their personal data-related issues.

Not complying can potentially result in huge fines. Sanctions for offences relating to control and mitigation are up to 10 million Euros or 2% of the total worldwide annual turnover while offences relating to rights and obligations are as high as 20 million Euros or 4% of turnover.