GDPR: Things to Do NOW to Safeguard Your Small Business
Has the GDPR got your head spinning?
Before you roll your eyes at yet another message about GDPR, in this video I share the fundamentals of what ALL business owners must have in place with their online presence, regardless of where you do business.
Firstly, this is not official legal advice being given. It is my intention to help clarify what you need to do to protect your business not just from the GDPR but from CanSpam and other international laws that are in place to protect the data you are collecting of other people. If you are unsure on what to do, consult with a lawyer who is proficient in GDPR laws.
Are You Affected by The GDPR?
Yes. If you have any kind of form submission or tracking codes on your website that has the possibility of someone from the EU visiting or entering their name and email address, then you must be GDPR compliant.
This means if you have any of the following present:
- Newsletter signup
- Free giveaway or download
- Webinar/teleseminar offerings
- Contact form
- Digital program for sale or download
- Potential clients who live in the EU
- A physical product that gets shipped
You are also affected if you have any tracking codes on your website. Either Google, Facebook or affiliate links where data is being compiled about who is visiting your site and what links they are clicking on.
This is especially relevant if you or your marketing company uses re-targeting as part of a marketing campaign.
What does this mean to you?
The people living in the EU must have a clear understanding of what you are doing with their data. How that data is being used, how it's being stored and they must also have an easy option to tell you to stop storing/using it.
What you need to do
First of all, don't panic.
The GDPR is mostly concerned about the big corporations that collect and use data for their operations. Think Google, Facebook and the like.
But that doesn't mean you can't be help liable if someone filed a complaint about you. Therefore, you should do the following to protect yourself:
- Ensure everyone in your current newsletter mailing list gave explicit permission to be there.This means:
- They added their name/email address to the form knowing exactly what they were getting and you are not delivering anything different than promised.
- They were not manually entered by you via import from as an example, LinkedIn contacts, a purchased list, a webinar they attended that you didn't host and you were given their names, or even after meeting someone at a networking event.
- Ensure it is clear WHY they are in your list. If you are giving a free giveaway, you must also be clear they will also receive regular newsletters, promotions etc. from you
- Have a GDPR compliant privacy policy on your website. Even if you only have a contact page form, this is absolutely necessary.
- On any form on your website, whether it's your newsletter list or a contact form, have a link to your privacy policy page stating the submitter agrees to the privacy policy terms upon submission.
Some say you need to make a check box but it will suffice to add consent-centric text under the submit button with a link back to your privacy page. - If you have affiliate links or any other kind of tracking codes being used for marketing purposes, it's a good idea to have a pop-up telling your visitors your site uses cookies and they can click to view your privacy policy and/or click to continue to explore your site
About Sending Privacy Policy Changes Email Notices
You may have noticed an onslaught of companies sending an email advising you of their privacy policy changes and are wondering if you should do the same.
If you are a small business or solo entrepreneurship, then the odds are that you don't.
These are only big data-collecting companies that should do this and are doing so to cover themselves legally.
About Sending Re-Opt In Email Notices
You may have also noticed some people are sending out emails asking you to re-opt into their list.
You do need to do this if there are people in your list that did not give explicit consent to be in that list and could be located in the EU.
Ideally, you would want to work with your list service provider and be able to segment out these people with an EU IP address and send that double opt-in notice only to those. But if it's unclear on their origin, they also need to be included.
© 2018 Daniel Simmons
