GDPR - 10 Things You Must Know –

GDPR - 10 Things You Must Know If you email your customers. On 25th May 2018, the new General Data Protection Regulations (officially (EU) 2016/679) comes into action. Remember the date: 25th May 2018 

This is kind of a big deal for all companies who send emails to their customers with news, offers, events, promos – well, any sort of email communication!

It’s pretty serious too, maximum fines for non-compliance with the GDPR is 20 Million Euros or up to 4% of a business’s annual worldwide turnover, whichever is the greater.
 

So, you’ll agree that it’s worth making sure that your business is GDPR complaint when it comes to communication to your customers via email, right!?

Where to start!
If you’ve already started looking into this in preparation for next May, well done you! If like us, you started off by looking at the content on the Information Commissioner’s Office (ICO) website then you probably curled up in a ball and hoped you were having a nightmare! Yes, it’s not exactly light reading is it!
So, after trawling the net and reading some excellent third-party resources, we’ve put together, in our opinion, the most important 10 things you need to know about GDPR relating to emailing your customers and contacts.

1. Your email contacts must of double opted-in to your lists – oh yes!
Under the new GDPR regulation, all the contacts you have in your email database for communication and marketing MUST have double opted-in to your lists. 
So, that means they actively ticked a box or selected an option and then, checked their email and clicked on a link to confirm (that’s the double bit…). 
This then ensures that the owner of the email address absolutely 100% wants to receive emails from your company, no question.

2. You need tell subscribers what they are signing up for and what they will be receiving
This is important! You need to let people know what you will be sending them and how often this is likely to be. Be as clear and transparent as you can. Give people as much control as possible when they sign-up to your marketing list. Perhaps you send customers offers, news and event promos, why not let people choose what they do and don’t want to receive when they sign up – give them full control!

3. You have to keep a record of consent from the email contacts you have on your database
This is a biggie! So, under new GDPR rules you need to be able to prove that you have had consent from each person to use their email address, and, this needs to include a statement that explains to them what you will be using their email address for. Key data to collect here would be Name, Permission Statement, Date, Time and IP Address, but, the more the better. Make sure that this data is not only collected but is securely stored and can easily be called upon if/when needed.

4. GDPR also applies to existing data. 
OK, so if you thought you can continue to use the data that you’ve already got and that you just need to play by the book form now on, nope. If you have email addresses in your database for which permissions have not been collected according to the GDPR’s rule book, or if you can’t provide any firm evidence of consent for your contacts, then you can’t use them. To repeat that, you can’t use them.

5. You need to make sure your Privacy notice is GDPR compliant
So, you’ll need to make sure that when a user signs up to your website, blog, offers page or whatever they are interested in – you need to be telling them exactly what you are going to be sending them, what you are using the data for, how you are storing the data etc (there is lots to include).

6. Permission to use an email address for marketing cannot be inferred from silence, pre-ticked boxes or inactivity
No more, sneaky tricks to get people subscribed to your email database. We need to be clear, transparent and put the control 100% into the hands of the email address owner. So for example, tick boxes for email newsletter sign-ups can’t be pre-ticked and we can’t just ‘assume’ they want to receive emails because they’ve bought loads of products from our shop or given us a nice review.

7. Make sure you have a procedure in place to detect, report and investigate any breaches in personal data that you hold
Do a review of the contact data that your company holds and make sure that if someone complains about the misuse of their data that you can quickly find out why this happened and importantly, quickly resolve the issue to make sure it never happens again.

8. You can’t hide data collection and privacy policy information in your main terms and conditions
When providing people with sign-ups to your mailing lists, you can’t just hide this information in your general terms and conditions any more – you need to make sure you have a separate statement specifically for how you are going to use their email address.

9. Get it right, as it’s not worth the risk. Fines could reach 20 Million Euros!
Although, in our opinion, GDPR will only really hit the ‘big boys’ if they don’t follow the rules, it’s important to make sure you have a legal and responsible email delivery procedure at your business, after all, it’s going to be EU Law from May 2018!

10. There is still time – what are you waiting for?
Don’t panic – we’ve still got time to get our email data up to scratch and legal. Why not start with a new ‘Email Consent’ campaign to target all your contacts (whilst you still can) and ask them to sign-up and double-opt in to continue to receive awesome emails from your business.

You should give them as many options as possible, including an option to opt-out… you may as well, after all, this is the whole point of new GDPR regulation. If people don’t want to receive emails from you – they shouldn’t have to! 

Summary
At the end of the day, if you’ve got a sound database of contacts that do want to hear from you, you’ve got nothing to worry about, right?  It’s only those contacts who don’t want to hear from you that you’ll lose, and to be honest, if they don’t want to know what you’re up to, the marketing impact on those people will be minimal. 

LinkedIn Pulse: 

Matt O'Byrne is Managing Director of Dolia Design Ltd
 

 

« Russia's US Election Hacks More Persistent Than First Thought
Cybersecurity Rules For Autonomous Vehicles »

CyberSecurity Jobsite
Perimeter 81

Directory of Suppliers

CYRIN

CYRIN

CYRIN® Cyber Range. Real Tools, Real Attacks, Real Scenarios. See why leading educational institutions and companies in the U.S. have begun to adopt the CYRIN® system.

BackupVault

BackupVault

BackupVault is a leading provider of automatic cloud backup and critical data protection against ransomware, insider attacks and hackers for businesses and organisations worldwide.

CSI Consulting Services

CSI Consulting Services

Get Advice From The Experts: * Training * Penetration Testing * Data Governance * GDPR Compliance. Connecting you to the best in the business.

Alvacomm

Alvacomm

Alvacomm offers holistic VIP cybersecurity services, providing comprehensive protection against cyber threats. Our solutions include risk assessment, threat detection, incident response.

IT Governance

IT Governance

IT Governance is a leading global provider of information security solutions. Download our free guide and find out how ISO 27001 can help protect your organisation's information.

DoSarrest Internet Security Ltd

DoSarrest Internet Security Ltd

DOSarrest is a fully managed security firm specializing in cloud based DDoS protection services to a worldwide client base.

National Response Centre for Cyber Crime (NR3C)

National Response Centre for Cyber Crime (NR3C)

National Response Centre for Cyber Crime (NR3C) is a law enforcement agency in Pakistan dedicated to fighting cyber crime.

Avatu

Avatu

Avatu specialise in providing clients the advice, technology and tools they need to fight cyber and insider threats.

PSC

PSC

PSC is a leading PCI and PA DSS assessor and Approved Scanning Vendor.

Cyber Craft

Cyber Craft

CyberCraft is an innovative and dynamic software development, outsourcing and consulting company. Services offered include penetration testing.

Tech-Recycle

Tech-Recycle

Tech-Recycle was formed to help companies and individuals securely, ethically and easily recycle their IT and office equipment. We destroy all data passed to us safely and securely.

SignalSEC

SignalSEC

SignalSEC provides vulnerability intelligence, malware analysis, penetration testing and associated training services.

InfusionPoints

InfusionPoints

InfusionPoints is your independent trusted partner dedicated to assisting you in building your secure and compliant business solutions.

RMRF Tech

RMRF Tech

RMRF is a team of cybersecurity engineers and penetration testers which specializes in the development of solutions for early cyber threat detection and prevention.

Arcanna.ai

Arcanna.ai

Using a wide range of out-of-the box integrations, Arcanna.ai continuously learns from existing enterprise cybersecurity experts and scales your team’s capacity to deal with threats.

Logically.ai

Logically.ai

Logically combines artificial intelligence with expert analysts to tackle harmful and manipulative content at speed and scale.

KATIM

KATIM

KATIM is a leader in the development of innovative secure communication products and solutions for governments and businesses.

Willyama Services

Willyama Services

Willyama Services is a certified Information Technology and Cybersecurity professional services business providing services to government and private sector clients.

Brightworks Group

Brightworks Group

BrightWorks Group offer comprehensive technology operations and security operations consulting services, tailored to meet your specific needs.

SignMyCode

SignMyCode

SignMyCode is a one-stop shop for trusted and authentic code signing solutions to safeguard software.

Box

Box

Box is the Cloud Content Management company that empowers enterprises to revolutionize how they work by securely connecting their people, information and applications.