How to be GDPR compliant while collecting data

The General Data Protection Regulation — commonly referred to as GDPR — which the European Union passed in 2016, set new rules for how companies manage and share personal data. While the GDPR technically only applies to EU citizens’ data, the internet is a global entity, which means that nearly every online service is affected. The regulation has caused countless organizations to put in lots of time, effort, and money to comply.

The main goal of the legislation is to protect the freedoms and rights of individuals in the digital landscape. Data protection rules were first introduced in Europe during the 1990s, but they failed to keep pace with technological advancements. Enter GDPR, which in simple terms, alters how businesses and public sector organizations can handle their customers’ information. It also gives consumers more control over their information.

To make sure you comply with the GDPR — and stay that way — here are a few steps to follow.

1. Understand the terminology and legal framework

The GDPR is a legal document that uses specific terminology over the course of 11 chapters and 99 articles. To ensure compliance, you need to understand what the GDPR requires of you.

That might mean hiring a data protection officer to specify how you can meet the standards. Professionals with a combined background in both law and technology may be the best resource for understanding the technical specifications and regulatory framework set forth in the legislation, says Information Age.

Some popular terminology in the GDPR that’s important for your organization to understand includes

• Personal data: This refers to any information relating to an identified or identifiable person. An individual can be identified by name, an identification number; location data; or factors specific to the physical, psychological, genetic, mental, economic, cultural, or social identity of that person, says CIO.
• Controller: This refers to any actor that determines the purposes and means of processing data.
• Processor: This term refers to a third party, such as a vendor, that analyzes data in ways approved by the controller. It’s the controller’s responsibility to guarantee that the vendors they work with stick to the rules set by the GDPR.
• Data subject: This is an individual whose personal information is being processed by controllers and processors. GDPR sets out to protect the rights of data subjects located in the European Union.

2. Keep a record of the process

Once you understand what the GDPR requires of organizations, you need to keep a data register or a GDPR diary. Each country in the EU has a Data Protection Association that enforces the GDPR. When investigating potential breaches, this organization determines if a business has been compliant. A data register shows your progress toward compliance and can prove to the local DPA that your organization was making strides in the process.

A fine for failing to comply can be between 2 and 4 percent of a company’s revenue.

3. Classify your data

Organizations must know what data they need to protect and how they’ll do it. First, they need to find personal identifiable information, which refers to information that can directly or indirectly identify an EU citizen. Not only do they need to identify where this data is stored, but they must also pinpoint who has access to it and how it’s shared.

Based on the classification of your data, you can determine what’s most vital to protect.

4. Ask for consent

An important factor of GDPR is guaranteeing that you keep your data subjects (customers) well informed about how you’re using their information.

Companies need to directly state that they collect and process data, which means that collecting information is not a default setting. Because data subjects must be aware that their data is being used, companies need to state when and how the data will be used by third parties.

To ensure that data processing is lawful, data subjects must consent to the use of their personal information.

5. Use a data map

A data map can go hand in hand with data classification. According to the GDPR, all controllers should collect only the data necessary for performing their services. They should also reach an agreement with processors to destroy data as soon as they accomplish their specific task.

This means companies need to demonstrate how they handle data in a conscious manner. They need to show that they use data protection methods — like data encryption, secure storage services, and beyond — that guarantee data safety.

A data map can keep track of these processes. You can create a data map either with specific software or graphic editors. Mapping your data can help classify it as sensitive, confidential, or public, and track how it flows through internal systems.

6. Always keep the consumers’ rights in mind

From now on, individuals will be much more aware of their rights when it comes to accessing their data.

Data subjects, for instance, can contact any company and ask them to delete or change their information. Per the legislation, data must be modified or removed immediately. These GDPR stipulations are known as the right to rectification and the right to be forgotten.

Customers must also be notified immediately in case of a personal data breach.

Organizations need to be aware of what rights consumers are now entitled to and respond accordingly to their requests in order to ensure compliance.