- On 25 May the EU’s General Data Protection Regulation began to apply.
- It affects any company that handles personal data, including small and family firms, with fines of up to 4% of worldwide turnover.
- A reasonable first step is to know what data is held, for what, where it is kept and who has access.
On 25 May 2018 the General Data Protection Regulation (GDPR) began to apply in the European Union, with new obligations for any company that handles personal data. Penalties for breaching it can reach 4% of worldwide turnover, a figure that made compliance a management priority even for businesses that had not previously considered the matter. It is a rule that forces one to think about the people whose data is handled, and not only about the interests of whoever processes it.
The rule changed the relationship between companies and people’s data. It is no longer enough to collect and store it: one must know why it is held, with what permission, for how long and with what protective measures. For business owners and families running a firm, the regulation was an invitation to put their house in order before an error, a complaint or a security breach does it for them. Doing so in good time is cheaper than correcting things under pressure.
What the regulation requires
The GDPR establishes that personal data must be processed lawfully, transparently and for a specific purpose. Individuals gain rights over their data, such as accessing it, correcting it or requesting its deletion, and companies must be able to show that they comply. The general principle is that every item of personal data must have a reason for existing and a limited duration.
That last requirement is important: it is not enough to comply, one must be able to prove it. That means documenting the processing, keeping evidence of consent where it is the legal basis and having procedures to deal with requests from those affected on time. The regulation thus places on the company the burden of showing that it acts responsibly, rather than waiting for the person concerned to have to complain. It is a logic of proactive responsibility that changes the way information is managed in the company.
For any company
It is not a rule intended only for large companies: it affects any business that handles data on customers, employees or suppliers, even a small family firm. The penalties, which can reach 4% of worldwide turnover, turned compliance into a matter of risk management.
A shop with a customer list, a clinic with patient records, a firm with data on its clients or a company with its payroll all process personal data daily. The difficulty usually lies less in the complexity of the rule than in routine: nobody asks why a spreadsheet of names and phone numbers is kept, until someone asks what is being done with it. Reviewing those routines is the first step to detecting what is surplus, what is missing and what is done without thinking.
Where to start
A reasonable first step is to know what data is held, what it is used for, where it is kept and who can access it. From there one reviews consents, contracts with third parties that process data and protocols for a security breach. A specialised legal adviser can guide the process.
It is best done in a practical way: a simple inventory, a review of who has access to what, clear contracts with the providers that handle information on the company’s behalf and a written procedure for acting if information is lost or leaked. The aim is not to turn the company into a bureaucratic office, but to have answers ready when someone asks for them. A specialised adviser can adapt the level of formality to the size and activity of each business.
Protecting customers’ data is now part of protecting the reputation of the business.
This article is general information. It is not legal, tax or investment advice, and it does not take anyone’s particular circumstances into account.
