New data protection rules for small businesses

The General Data Protection Regulation (GDPR) is a data privacy law that aims to protect the personal data of consumers in the European Union (EU). It applies to all companies that process the information of EU citizens.

Businesses must comply whether they are local or international, including small and medium enterprises (SMEs)—even those with fewer than 250 employees (under certain criteria). Therefore, almost all businesses must comply with the GDPR.

Compliance involves being transparent about data practices and providing consumers channels to control the personal data that was collected, stored, used, or sold.

What Is The GDPR?

GDPR is a comprehensive data privacy law that affords rights to EU residents, giving them more control over the data that businesses process from them. These include:

• the right to be informed about a business’s data practices
• the right of access to personal data, plus information on how and why it’s used
• the right to rectification of personal data
• the right to erasure of personal data collected
• the right to restrict the ways in which businesses may use personal data
• the right to obtain personal data in an accessible format (data portability)
• the right to object or prevent a business from processing personal data
• the right to non-automated decision-making—in other words, to not have legally relevant decisions made about them based on automated processing

Does The GDPR Apply To Small Businesses?

If a business has more than 250 employees, it must comply with the GDPR as it applies to all other companies. Businesses with fewer than 250 workers are technically exempted from maintaining records of their data processing practices, unless:

• data processes may jeopardize individual rights or freedom
• processed data involves sensitive information
• personal data is processed regularly

Since most businesses, especially those with an online presence, process data in some form (e.g. email addresses, website cookies, etc.), then it’s safe to say that all businesses, no matter how small, must comply with the GDPR.

Non-compliant small businesses, then, are also subject to the same penalties, which can result in fines amounting to up to €20 million or 4% of a business’s global annual turnover, whichever is higher.

How Can Small Businesses Comply With The GDPR?

The GDPR includes regulations that guide small businesses to be compliant. Here are some examples:

Conduct Regular Data Audits

Review your data processes to specify the kind of personal information collected as well as the method and purpose of collecting, storing, using, or selling personal data. Assess the level of risk of your practices and ensure that these do not interfere with consumer rights.

For instance, the GDPR and marketing sectors often clash since the latter tends to be invasive with respect to personal data. Check that you only collect the data that you need and that it is processed on a legal basis.

Audit service providers, too. Write contracts stating the limitations of data processing under the GDPA.

Be Transparent

Disclose your data practices to consumers to satisfy their right to be informed. You can do this by creating a GDPR-compliant privacy policy.

Do Data Protection By Default And Design

Design processes with data protection as your guide. From the get-go, make sure that your practices comply with the GDPR—this sets the foundation for proper data privacy and protection processes.

Obtain Consent

Obtain consent wherever necessary, whether it be in a pop-up cookie message as a user visits your website for the first time, in your privacy policy, or in your application settings.

Provide Channels For Access And Deletion Requests

The GDPR stipulates that consumers can request to access or delete the personal data obtained from them. Your business is required to provide channels for consumers to submit these requests, set up procedures to process them, and give compliant data privacy solution.

Assign Responsibility

Your business will likely need a Data Protection Officer (DPO) who is knowledgeable about the enforcement of the GDPR. This individual, who may already be an existing employee, is also responsible to report any data anomalies or breaches to relevant enforcers.

If a DPO is not required, a small business can consult data privacy solution services to guarantee compliance.

Small Businesses Aren’t Exempt From Data Protection Rules

The GDPR is concerned about the what’s, why’s, and how’s of a business’s data practices. So, regardless of size, all businesses that fall under its scope must comply with its regulations. SMEs should then keep informed about the GDPR and regularly review and update their practices to be compliant with new data protection rules.

‍