A GDPR to-do list

The date GDPR takes effect (25 May 2018) is bearing down on us, and you should be paying attention to it too. GDPR will affect just about everyone who runs a business, or rather everyone who comes into contact with personal data.

You will certainly know that commonly processed personal data includes things like:

• first name and surname,
• permanent or temporary address,
• date of birth,
• email address,
• phone number...

The argument that an email address, say, is not personal data will certainly not hold up today. We might have an address such as andrej_danko@nrsr.sk and know immediately which captain it belongs to. So personal data today has to be understood as anything leading to the precise identification of a person. Incidentally, Andrej's email address is freely available here.

So let us look at a few points you should definitely work through. We will focus mainly on online business, though it can apply outside the online space as well.

1. Find your points of contact with personal data

Sit down with your colleagues and draw yourselves a "map" of everywhere you come into contact with personal data. A good technique is to have each colleague first sketch out only their own working day; the places where they reach personal data show up very quickly.

2. Make sure you collect data legally

All the data you process or use for marketing has to be backed by consent. Remember to add these consents to your forms and to the places where you obtain the data. Think about them right at the point of collection. Importantly, such consent must not be pre-ticked — the user has to tick it themselves. Do not combine consent to data processing with consent to marketing activities.

Nor should you forget the data you already hold. You need to be sure that this data was obtained legally and that you can pinpoint where it came from.

3. Let users know what data you collect and what you want to use it for

Let your users or customers know what data you collect, what you would like to use it for and how long you keep it. As a very good model I recommend Mall — though do not simply Ctrl+C and Ctrl+V, but write it to fit your own situation.

A user can also ask you to supply, or to delete, the data you hold about them. That can be no small task for developers, though. If you use WordPress, you are in luck, because there is already work under way to have WordPress offer this out of the box.

4. The option to opt out — newsletter, remarketing and marketing personalisation

The option to unsubscribe from a newsletter is a standard by now. GDPR, however, brings a small inconvenience with it. What sort? A user who previously accepted cookies can withdraw that consent. Which means that when such a user makes a request through your site, you should notify services such as Google Analytics, AdWords, Facebook, Adform and so on, so that the particular cookie is deleted at their end.

The result should be that they will no longer be shown your personalised ads or remarketing. All the services are still working on this, though, and the exact procedures are not yet known. For now Google offers only the option to turn off all personalised ads.

5. Prevent personal data breaches

Once GDPR takes effect you will have to report every personal data breach. If you discover one, you will have to report yourself within 72 hours of finding out. The aim, though, should be for nothing of the sort to happen in the first place. So make sure your system, or wherever you keep the data, is secure. With a website, for instance, check where the contact form is sent, whether it is saved into a database somewhere and who has access to it. With e-shops it is a little more complicated, but do not use a single login for the whole company — let everyone use their own personal access. Discuss the level of security with your developer or agency as well. Do not be fobbed off with a short answer; ask questions such as:

• Do we know who logged into the system's admin, when and from where?
• How are we protected against brute force attacks?
• Do we have an active restriction on which countries can log into the admin?
• Do we verify file integrity in any way, to see whether files have been tampered with?
• If you have any data exports — are those exports logged?

If you use an open source system such as WordPress, the Wordfence plugin will help you solve a great many things.

Pay attention as well to how you yourselves send credentials or data to others. If you are forced to send someone an Excel list by email, say, password-protect the file and send the password itself in person by SMS. That is an easy way to help keep your data secure.

6. Pseudonymisation

Introducing pseudonymisation will save you a heap of trouble. It is true that implementing such a solution can also be demanding for developers, but if a pseudonymised list leaks you do not have to inform anyone, because nothing has actually leaked. A pseudonymised export contains no data that would lead you to a specific person. For example, if you make something to order, it is enough to swap the personal data for an ID before it goes to production, which greatly narrows the circle of people who come into contact with personal data.

Here we have more good news for you if you use WordPress and WooCommerce. Pseudonymisation tools will also become part of the WordPress core.

7. Update your company's internal processes

Your company's internal processes should cover several important points:

• how you will train current and new employees on GDPR
• how you approach personal data protection — do not forget to keep this section updated on your website too
• the procedure you will follow in the event of a breach; here you will also have to inform the data subjects themselves, so be ready for it
• you also have to appoint a member of staff responsible for GDPR within the company

8. But it does not end with your website and e-shop

Remember that if you share your data with anyone, you should also have it covered that the data will be safe with your business partner. Every service, supplier or API connection you give data to in the course of your work should also meet all GDPR requirements. That might be a courier company, but equally cloud services such as Dropbox and the like.

Large companies will be ready for GDPR; it is smaller suppliers or less widespread services you should check instead. Ultimately it is your data and you are responsible for it.

9. Bonus point — SSL

An SSL certificate has nothing directly to do with GDPR, but we certainly recommend implementing one, because from the summer of 2018 Google will mark sites without an SSL certificate as "not secure".

We hope this article has helped give you a basic overview of what needs preparing for and paying attention to. The article is informative in nature only; follow the full subject at:

https://www.eugdpr.org/
http://sukromie.digital/
https://ec.europa.eu/info/law/law-topic/data-protection_sk
https://www.dataprotection.gov.sk/uoou/sites/default/files/nariadenie_2016_679_text_sk.pdf