GDPR and Small Business

by | May 30, 2018 | Business Insight, GDPR, Small Business, UK Business News

GDPR and Small Business

GDPR and Me. My Small Business Journey

The deadline for GDPR was 25th May 2018 and I am still working on making everything I do compliant.

Here are the steps I decided to take to be compliant. If this is too long skip to the bits you need using the links below.

How GDPR affected my business.

How I prepared.

Further resources to help you including free cookie policy info and a free privacy notice template.

Disclaimer: This is my personal understanding of the GDPR based on my research and only covers aspects related to my small business. To ensure that you’re compliant with all aspects of the GDPR, you should consult your legal advisor.

How GDPR Affected My Business

As a freelancer who has been in business a number of years, I have had a fair number of customers, many of whom are still clients of my web hosting. As such I do keep contact details such as name, email and phone numbers. These contact details are now deemed personally identifiable information (even though I am business to business). So with the new GDPR rules, I have to have several practices and policies in place to ensure I am compliant with them. When all is said and done, I would never have passed my customer details onto anyone else regardless of GDPR coming into force. As such it seems a little excessive that I have to jump through proverbial hoops just to be able to keep my customers’ contact details in a database or an address book.

Don’t get me wrong. I understand peoples right to privacy and protection, but some of the things I have had to put in place have been time-consuming. Whilst I am busy jumping through hoops I am not working and my backlogs are growing. Ultimately this has a financial impact.

The real data baddies just move their premises to Ireland or find sneaky ways to avoid the system. A few million here and there makes little difference to them. The threat of 4% of my annual turnover would put me under, so there are no sneaky hiding places for me. End of moan onto the practical stuff. Here is a word of warning if you think the new rules don’t apply to you – If you have a phone number stored in your phone or a contact form on your website you may need to make some modifications, this is a simple example of how GDPR affects you.

How I Prepared

Step 1 Establish if I am a Data Processor, Data Controller or Both?
I was not sure and to be honest, the act was all gobblygook to me. So I did the ICO test which actually relates to the Data Protection Act, but if you are a controller in one you will be in both. Inevitably I was both and had to register for the controller charge with the ICO.

You can take the questionnaire here. https://ico.org.uk/for-organisations/data-protection-fee/self-assessment/  I highly recommend you do.

The simplest explanation I found of this (not the official version below) was to ask yourself the question, “Do you keep or process any information about living people?” Then you are a data controller.

Here is the guide that provides more information. https://ico.org.uk/media/for-organisations/documents/1546/data-controllers-and-data-processors-dp-guidance.pdf

The definition they used is

Section 1(1) says that:
“data controller” means a person who (either alone or
jointly or in common with other persons) determines the
purposes for which and the manner in which any personal data
are, or are to be processed
“data processor”, in relation to personal data, means any
person (other than an employee of the data controller) who
processes the data on behalf of the data controller.
“processing”, in relation to information or data means
obtaining, recording or holding the information or data or
carrying out any operation or set of operations on the
information or data, including—
a) organisation, adaptation or alteration of the information
or data,
b) retrieval, consultation or use of the information or data,
c) disclosure of the information or data by transmission,
dissemination or otherwise making available, or
d) alignment, combination, blocking, erasure or destruction
of the information or data A data processor is a

Step 2 What Data Do I Process and What For?
This led to a data audit. Again I used the ICO for advice https://ico.org.uk/for-organisations/guide-to-the-general-data-protection-regulation-gdpr/documentation/how-do-we-document-our-processing-activities/. There are two spreadsheets within this article which I used to document what I collect and why. I also linked my agreements with my data processors. In my case this was Agile CRM and Wave accounts and Google, plus a few others. This actually led me to delete a few accounts with some software companies. I just wanted to strip it down, if I don’t need it, dont collect it and keep it simple.
Step 3 What are my Lawful Grounds for Processing?
I really do not collect a lot of data, but just what I need to carry out my business. In the main it is contact details. My lawful grounds for processing are quite clear-cut.

 

Mainly it involves a contract to deliver services, consent from my mailing list or keeping details for tax etc.

 

Article 6(1)(a) – consent Consent means offering individuals real choice and control. Genuine consent should put individuals in charge, build trust and engagement, and enhance your reputation.
Article 6(1)(b) – contract “processing is necessary for the performance of a contract to which the data subject is party or in order to take steps at the request of the data subject prior to entering into a contract”
Article 6(1)(c) – legal obligation “processing is necessary for compliance with a legal obligation to which the controller is subject.”

Again this led me to consider where I got my mailing list from. All bar one of them were subscribers via MailChimp. These are people I added to a promotion I was doing. I have collected around 300 business cards over the years and for this one campaign, I added them to MailChimp. The open rate was poor and the response was negligible. Could I be bothered writing out and asking them to resubscribe? Nope, I am only interested in loyal followers so I just deleted the list. Thus keeping it simple.

Step 4 Do I Pass Data Outside EU?
Actually, I do. I use various pieces of software. These companies actually do not do anything with it but they do store it. So they are my processors. The world went mad on the 24th and 25th of May and every company sent me reams upon reams of revised terms and conditions, privacy shields, privacy notices and contracts. The hard part for me was that they were all sent at the last minute. That meant I could not be compliant until I had waded through them all days after.
Step 5 Do I have a privacy notice is it on my website is there a clear link on each page?
To be honest at the time of writing this is still a work in progress. My main website word-shed.com I decided to take down and put into maintenance mode. If people cannot access it there is no risk. One good thing I have learnt from this exercise is that my own terms and conditions and other aspects of my business are lacking. It has made me wake up and smell the coffee. I am using this as an opportunity to up my game and make the whole website and my services better. So thanks for the wake-up call and the extra work Brussels.
Step 6 Do I Need to Send it to my Subscribers and Customers?
Well for me this is yes and no. It is also one of the reasons I chose to write this post. You see some of my subscribers and customers will ignore this or think it is not for them. I do not want to send out something along the lines of ‘here’s my new notice, unsubscribe if you like’ I want to add value. I want to help others comply by looking at my journey and seeing how they can learn from it. So the answer to that is yes I do but it must be valuable. Surely otherwise it makes a mockery of “consent”. ‘Here is a boring email you will never read and never asked for, we will not spam you and only send you things you want’. Err hello your boring me!!
Step 7 What are my Current Marketing Processes are They Compliant?
This was helped by my completing the spreadsheet the ICO provided, that I mentioned in step 2. Please go take a look at the excel spreadsheet especially the examples. If they were not before they most certainly are now.
Step 8 Data Security and Safety?
I found this in Suzanne Dibbles Facebook group which was a great resource for me.

1. Password protection on devices (PINs on phones and passwords on computers) Yep obviously
2. The policy of locking device screens when away from them. The dog hasn’t learnt to read.
3. A correctly configured business class router with guest WiFi enabled for non-business internet access (kids, visitors etc). I changed the password and username away from default and added a guest mode (virgin media, all free). I annoyed my husband for days with this one as he had to keep putting in the new password on his devices.
4. Anti-virus installed and kept up to date on devices. Obviously
5. Encrypted Hard Disk in devices and data backups which are encrypted – if your data is encrypted it can’t be read if it’s stolen. This was a nightmare. I bought a new hard drive and it took 5 days to back up my data encrypt it and re-back it up to the cloud. I was without a Pc for a day and everything had moved so I had to find all of my files again. Take my advice, do not change anything just back it up and then put BitLocker on. It may be free on a windows device.

The official advice is here https://ico.org.uk/for-organisations/guide-to-the-general-data-protection-regulation-gdpr/security/

Step 9 Do I Have Systems in Place to Allow Me to Comply with the New Rules? ?
What I mean by this is subject access requests and erasure request etc. Customer “hello Lynne I would like to know what data you hold on me.” Me “no worries here is your phone number, email and website address, oh I may have you on Facebook here you go.” To be honest this one is pretty easy. A line in my privacy notice saying call me or email me.
Step 10 Any Other Considerations e.g. Staff Training?

Thankfully other than appointing a member of my team to become my data protection officer (I work alone that will be me then). I am pretty sure I have covered my bases. But if you have staff you do need to bear this in mind

Further Resources to help you

There are a number of changes you should make to your websites to comply.

1 Add a Cookie Notice if you use cookies (not about GDPR but good practice)

2 Amend your website form. If you are collecting email and contact information, they must give you consent to use the information they give you for your business purposes. You must specify what these purposes are in your privacy notice.

3. Change any email opt-in forms on your site to state the purposes for which you will use the information they provide and link to your privacy notice.

4. Get an SSL certificate for your website. Transmitting information across the web is risky. If you are responsible for the information an SSL helps yo go that little bit further to make it secure.

5. If you have Google analytics or other tracking software make sure it does not track or record on shopping cart pages and anonymise the IP address.

If I have missed anything please feel free to remind me in the comments.

If you collect email addresses and use a MailChimp list for newsletters these two videos may help you add the required double opt in. Remember your users must now explicitly consent to join your email list.

Introduction. GDPR and Your Opt-in Form

Adding a Double Opt-in to MailChimp

With all the information I gathered using the processes above I used this generic template to write my privacy notice. The privacy notice they provide is in a word document format is for businesses only as other public bodies have different criteria.

https://www.nibusinessinfo.co.uk/content/sample-privacy-notice

You can see the privacy notice I created using the link at the bottom of my page. I have included it in the footer of my site so it appears on every page.

So this is where I stick my neck out. I want everyone especially my customers and followers to be compliant, so I am releasing my privacy notice under the Attribution 3.0 Unported (CC BY 3.0)

The text is free to use and modify – all I ask is that you provide me with appropriate credit and leave the link back to this website in. This was written with my business and processes in mind. You must do your own data audit and make this draft policy your own. If you are a charity or other public body this will not be suitable for you.

It goes without saying I am not a lawyer if you want a bulletproof notice that covers your business you should buy one of the template packs mentioned in further resources below, or consult a lawyer.

Disclaimer: This sample privacy notice does not constitute legal advice. The content is for general information purposes only. It is provided without any representations or warranties, express or implied. If necessary, seek appropriate legal counsel in relation to GDPR or your specific circumstances.

For definitive legal advice on providing privacy information under the GDPR, see the Information Commissioner’s Office guide on privacy notices.

You will find it as a google doc you can amend here click file make a copy as you will not be able to edit this one. Sample Privacy Notice Template

 

This video shows you how to generate a compliant Cookie Policy For your website. If you have a WordPress Video Part 2 shows you how to add the cookie bar.

Part 2 Cookie Notice for WordPress

Webinar prior to GDPR implementation. The Lovely Kevin Lovelady from Merseyside Connected tells us all about GDPR .

Link to free sample privacy notice

Acknowledgements

I may still not be compliant as I have work to do. I could not have got this far without the help of two online GDPR Gurus. The first is Kev Lovelady. He was kind enough to conduct a question and answer webinar with me where my Facebook group got to put questions to him. You can see the replay here.

He also has a compliance pack available which will probably take care of much of this stuff for you it is £27.00. You can find details here. https://merseysidedigital.org.uk/gdpr-starter-pack-order/

The second is Suzanne Dibble who created a facebook group and made loads of help videos. She also has a compliance pack which is around £127 (I think) https://suzannedibble.com/gdpr/

I Can Teach You How to Get More Customers From The Internet

I Can Teach You How to Get More Customers From The Internet

Subscribe now to receive my latest and greatest updates and grow your business.

Nice one, I can't wait to share with you, but you must check your email and click the subscribe link if you don't have it check your spam just in case!

I will not sell or pass on your details and you can unsubscribe at any time. See our privacy notice here



Pin It on Pinterest