What is personal data under GDPR
Are you a business in the EU or are you hoping to conduct business in this region? If you’re worried about GDPR compliance and don’t know where to start, you’ve come to the right place.
Topic GDPR
GDPR
In this guide, you’ll learn how to get started on looking for the right tools, platforms, software for GDPR compliance.
Overview of this article
In this guide, we’ll tell you how to get started on looking for the right tools or platforms for GDPR compliance. More, specifically, you’ll learn more about:
What does GDPR mean?
GDPR stands for General Data Protection Regulation. It is a regulation in EU law on data protection and privacy, which mandates how personal information of “data subjects” or individuals should be transferred and handled.
The European Parliament adopted the GDPR in 2018, replacing an outdated data protection act from the ‘90s. It carries provisions that require businesses to protect the personal data and privacy of EU citizens for transactions that occur within EU member states. The GDPR also regulates the exportation of personal data outside the EU.
Why is GDPR important?
Why should you comply with GDPR? Well, GDPR is important because it protects the valuable and oftentimes sensitive information of data subjects in the EU. By clarifying what companies can and cannot do in terms of acquiring, handling, and storing of data, it protects the fundamental privacy rights of people.
You cannot do business with any company in the EU if you’re not complying according to GDPR standards. You cannot transact with any person living in the EU if you don’t have the necessary software or procedures in place. If you try to violate the regulations, you can be subject to fines of up to 4% of your global annual turnover.
Moreover, your reputation will also be at risk. No company wants to be known for breaching the privacy of its customers. It can affect a company’s trust rating. And a company's ethics when conducting business have been known to affect the bottom line.
According to Edelman Trust Management, ethical drivers such as integrity, dependability and purpose drive 76% of the trust capital of business, while competence accounts for only 24%. Basically, trusted companies have stronger buyers and advocates.
What's the difference between GDPR and Data Protection Act?
The GDPR and the UK Data Protection Act of 2018 have main differences that could have an effect on the UK 's relationship with the EU post-Brexit. As a regulation strictly enforced throughout the EU, it is in effect across EU Member States, ensuring that all UK entities must also comply with it.
While they do share similarities in terms of protecting one’s data, they also have subtle differences, such as:
|
GDPR |
DPA |
|
|
Who is GDPR applicable to?
The question on everybody’s mind is — Should I be compliant to the GDPR? If you’re a company working within the EU or with non-EU organisations providing products or services to consumers or companies in the EU, then yes.
You may think that this is only applicable to large companies, but the truth is, in our digitally-connected world, even small to medium-sized businesses may have EU customers. For example, a local news website based in the US may have readers from the EU. An e-commerce store from Asia may have EU shoppers too.
In our ever-evolving digital landscape, it’s good practice for any business to have a GDPR compliance plan.
What are the requirements under GDPR?
The entire GDPR document may be long and daunting, so let us condense it for you.
First, companies who are planning to obtain customer or client data must first get their explicit consent. Second, companies must have legitimate reasons why they need this information. Third, customers or clients have the right to request that their data be destroyed. Fourth, they must alert customers of data breaches or any changes to how their data will be managed. Finally, they must also appoint a data protection officer to oversee compliance.
That’s our summary, but we still encourage you to read the official legal text.
How do you comply with GDPR?
Complying with the GDPR entails several organisational and procedural changes. It can start with educating your whole company about the finer details of the GDPR. This is applicable to all employees but especially those who are handling customer or client information.
After making sure that the necessary people are well-informed of GDPR and what it takes to follow it, you can inspect your existing resources or structures if they fit the bill. Sadly, you may be faced with the reality that you need to upgrade your systems or choose another software provider for tools you are currently using. You may need to shell out some cash but the price is nothing compared to fines you have to pay if you disobey the law.
How do you choose a software or digital platform adherent to GDPR? We’ll be discussing that in a while, but first, let’s discuss the most basic principles of this EU regulation.
What are the 7 principles of GDPR?
These principles make it easier to remember how to respond to the demanding requirements:
-
Lawfulness, fairness, and transparency: You have to let your data subjects know why you’re collecting their data and how you plan to process and use your data.
-
Purpose limitation: Be very clear and honest about your intentions with their data.
-
Data minimisation: Your company should only store the minimum amount of data required for their purpose.
-
Accuracy: The data collected must be updated and truthful. This means that organisations holding this information must also be responsible for reviewing the information they have on a regular basis.
-
Storage limitation: Once the data has been used for the purpose for which it was collected, it must be removed from storage or the possession of the company holding that information.
-
Integrity and confidentiality: All measures must be taken to secure the data you hold.
-
Accountability: Companies that acquire, process, and manage data will be held responsible in case anything happens, such as data breaches. They should be able to provide evidence that they are adhering to GDPR requirements.
What types of data does GDPR protect?
What specific pieces of data are covered by the GDPR? It includes identifiable or traceable information about data subjects such as:
-
Name
-
Address
-
ID numbers
-
IP addresses
-
Location log-ins
-
Browser or web cookies
-
Radio-frequency identification (RFID) tags
-
Health-related data
-
Genetic data
-
Biometric data
-
Racial or ethnic data
-
Political opinions
-
Sexual orientation
How do you manage data privacy?
The handling of data privacy starts with the software you use. Especially if you’re handling large volumes of data, it’s possible for things to fall into the cracks.
This is why you must make sure that you are acquiring and storing your data correctly. Everytime you communicate with your customers, you are exchanging information with them. And in turn, they may be sending sensitive information. Are you simply using an email? Or are you using a specialised software or platform that facilitates secure digital communication?
What is a GDPR software?
What is a GDPR compliant tool? Is there such thing as a “GDPR software” that companies can easily access?
You may come across many software or platforms claiming to evaluate GDPR. Some may also advertise themselves to be an implementation tool. So what exactly do they mean and what if you’re already using another software? Should you switch?
First, let’s take a look at your current roster of tools and decide whether or not it should be compliant to the GDPR.
What are examples of tools that should be compliant to GDPR?
In this digital age, companies are surely using software and platforms to handle their customer or client information. If you’re using any of the tools listed below, then you have to make sure that you’re following GDPR protocols.
-
Data acquisition and deletion tools
-
Data inventory tools
-
Customer communication platforms
-
Customer or client information storage / databases
-
Marketing tools
-
Content management systems
-
Data mapping tools
-
Cookie notice and privacy platforms
-
Data discovery tools
-
Redaction tools
-
Search tools
-
Scanning tools
-
Survey tools or software
-
Open source tools
-
Data scanning tools
-
Training software
When you’re using any of the platforms listed above or any other tool that deals with data, then you have to assess how it operates under the lens of compliance. You can use an assessment tool or you can also migrate your data to a compliant software.
What are GDPR assessment or management tools?
These compliance platforms can generally be divided into three categories: assessment, implementation, and maintenance.
-
GDPR Assessment tools: These are tools that evaluate your current systems or processes to find gaps and suggest solutions. According to the technology media company CSO, assessment tools have these common attributes:
-
Flag devices that do not have GDPR security controls
-
Often uses AI or artificial intelligence to analyse protocols
-
Passive scanning of access points in networks
-
GDPR Implementation Tools: As the name suggests, these platforms help you be compliant. They help you implement the much-needed changes, as suggested by your auditor or an assessment tool. To be more specific, these are digital platforms which help you process communication between you, your customers, or your clients.
These tools usually come with these features:
-
Identity masking or encryption
-
Allowing users to opt-in or opt-out
-
Data breach alert features
-
Tracking or controlling of data
-
GDPR Maintenance or Management Tools: Often, maintenance or management tools can have features of both assessment or implementation tools. However, most of these programs have features that are built for long-term purposes. For example, certain software can periodically audit your processes.
How should you compare “GDPR tools and software”?
With many tools for assessment, implementation, and maintenance to choose from, how do you choose the ones that fit you the best? When you’re doing your research on which tools or software to use to be GDPR compliant, you have to consider several things.
Here are some tips when selecting and comparing tools:
-
Find out if they have a good reputation: The company that created the software should be well-known in terms of efficiency and security. One way to verify their reputation is by looking at their awards. You can look at surveys done by Caliber, which recognises the most trusted and well-liked brands.
-
Evaluate if the platform’s features can tie in seamlessly with your operations: Each company has its own unique needs. Make sure that the software you will be using will tie in seamlessly to your business processes.
-
Compare the pricing and features: These tools are built differently and that’s also why their pricing is varied. One software may be less expensive however another one may have more functionalities. Inspect each of their features and evaluate how often you need it. Is it worth the additional price?
-
Get a sense of their customer service: Frictionless integration isn’t limited to hardware and software. This is also about customer service. When you are liaising with these software providers, have you found it easy or difficult? The quality of communication of their customer or sales representatives is an indication of how your relationship will be. Remember that for something as important as GDPR compliance, they are not just your software providers, but they are also your partners in business.
What are the characteristics of a top “GDPR platform”?
A “top” GDPR tool, platform or software does not simply refer to what is popular. For any software you use that should be adherent to GDPR, you must remember that they should contain these attributes:
-
Boosts your productivity: An efficient digital platform improves efficiency and productivity within the team and your market.
-
Ultra-protective: Since GDPR is very strict about the handling of personal data, the dispatching of personal documents should be highly-protected and safe.
-
Sustainable: You need a platform that is also sensitive to the needs of the environment.
-
Increased engagement: A simple-to-use platform will facilitate smooth communication between you and your customers, clients.
-
Easy to maintain: Security upgrades or maintenance should be given for free as part of client services.
-
Lowers operational costs: Because of its efficiency, your GDPR platform should also reduce your costs for distribution, transaction, etc.
Where do you download GDPR tools, software?
After assessing your needs, are you ready to find your partner in compliance? Do you simply “download” a tool or software? It’s not that easy. The best way to go about it is to talk to a sales representative of a tool provider and see if your corporation is a good match for what they can provide.
A company that ticks all the boxes of a top “GDPR platform” is e-Boks, a provider of secure digital postboxes and platforms. With over 19 years of experience in the field of digital infrastructure, e-Boks has helped the public sector and businesses digitise their communication flows. As one of the most trusted brands on the market, e-Boks is leading the way towards a more secure digitised world.
Want to be 100% GDPR compliant?
- For more than 20 years, we have helped public authorities and businesses securely digitise their communication flows.
- We proudly provide the governments of Denmark, Greenland, Norway, Sweden and Ireland with national digital post solutions
- Well-renowned international banks, insurance companies and energy service providers have chosen to use the e-Boks platform instead of pursuing their own solutions.
Explore more insights & success stories
