The Impact of the GDPR on SMEs
How has the law changed since the Data Protection Act, and how does the GDPR affect SMEs?
The GDPR concept is not new. We have already touched on it in our article covering some details of the General Data Protection Regulation and HIPAA (the US regulation in the healthcare sector). However, you need to know more about GDPR, even if you have a small or medium-sized business (SME).
The GDPR applies to all kinds of business, with small and medium ones being no exception. The GDPR has replaced the Data Protection Act, and now all companies that work with the personal data of EU-based citizens are required to comply with GDPR rules.
This article will be helpful for anyone who wants to quickly learn the difference between the DPA and GDPR, but also for valuable insights into users' rights, the benefits of the GDPR, and how to prepare your business for the GDPR. Nevertheless, if you want to learn more, Go Wombat is available to help you!
From DPA to GDPR: A new era of privacy regulation
The central aspect of the GDPR is that it is an improvement on the Data Protection Act. Companies must follow GDPR requirements. They cannot ignore them, and they must prepared to prove that they follow it rather than simply say it.
Let's list the primary differences between the GDPR and the DPA.
More companies must comply
Now, even if businesses are located outside the EU but still collect, store, or process the data of EU residents, they must be GDPR-compliant. So, for example, if your company is in the USA, but people in the EU visit your website, you should follow the GDPR. If you sell services or products to the EU, GDPR compliance is a must. If you monitor the behaviour of EU citizens who visit your website, the GDPR cannot be ignored.
Much higher fines
The regulator may punish companies which ignore GDPR compliance with up to 4% of global turnover, or EUR 20 million — whichever is greater. The regulator under the General Data Protection Regulation is the Information Commissioner’s Officer (ICO). Previously, under the DPA, the largest fine couldn’t exceed GBP 500,000.
Companies must prove their compliance
Upon any request from the regulator, organisations must demonstrate that the personal data of users meet diligent record keeping. Whilst under the DPA, companies could just say that they comply with data protection laws.
Mandatory notifications
Under DPA, if there were any data breaches, companies were recommended to notify users about them. In contrast, the GDPR requires all organisations to notify users about a data breach within a set period. Otherwise, fines will be imposed.
More specific consent
The processing of personal data must be performed on a legal basis, i.e. consent. Consent was necessary under the DPA but became more specific under the GDPR. For example, companies now need more separate consent for marketing by phone, email, etc. Moreover, companies must notify users that such consent can be withdrawn upon request.
Ensure your business complies with the GDPR — contact Go Wombat for a detailed consultation!
What small and medium-sized companies must know about the GDPR
The impact of the GDPR on small businesses and medium-sized enterprises is significant, and it doesn’t matter how many employees your business has. But unfortunately, some small companies think the GDPR is a regulation they don’t need to comply with. This is a big mistake. The General Data Protection Regulation details a few differences for small and medium-sized businesses with less than 250 employees.
Companies with less than 250 employees do not need to keep records of processing activities unless they process personal information regularly or the information includes sensitive data or criminal records or it threatens individuals’ rights.
Small and medium-sized enterprises need to appoint a Data Protection Officer only if data processing is their primary field of activity and may threaten individuals’ rights.
SMEs need to spend more time on training since they often underestimate the importance of the GDPR, and they need to take time to look through all relevant legal bases to ensure compliance with the GDPR.
Does Brexit have any impact on GDPR compliance?
This is the question many entrepreneurs are asking. Yes, a small business (and medium-sized businesses as well) still should be GDRP-compliant. The UK government has confirmed that all GDPR requirements will be implemented despite Brexit. Thus, if you do your business in the UK, you must comply with all GDPR rules.
What rights do individuals have under the GDPR?
Compliance with the GDPR means that you should consider all the rights of individuals and respond to all their requests. There are eight principal rights under the GDPR which we want you to know when you do your business where personal data from EU residents is collected, kept, or processed.
Right to access
All individuals have the right to request access to their personal data and clarify how this data is going to be used once it is collected. Therefore, your company should quickly provide users with this information in the requested format (paper or electronic).
Right to be forgotten
All users have the right to delete their personal information if they demand it. They can remain your customers, but if they want their data to be removed from your records, you must do it. As well, if they are no longer your customers, you must remove this information as well.
Right to be informed
If data about users is going to be collected, we should inform users before it happens. Users should opt-in for their data to be gathered, and they should give their consent freely for data collection.
Right to data portability
Users may transfer their data from one provider to another. All data must be transferred in a machine-readable format. You must always ensure a smooth transfer of information upon request.
Right to rectification
If any piece of the user’s information is inaccurate or incomplete, he or she may request to have this information corrected according to the updated data. Therefore, your company should implement it without undue delay.
Right to restrict processing
Under the GDPR, users have the right to restrict their data processing to a specific limit. Users’ information will still be stored in your records, but you can’t use it or use it only partially.
Right to be notified
If a data breach occurs, and the data of all or part of users are compromised, users must be informed of it within 72 hours from the moment when the data leakage was detected.
Right to object
Individuals can stop their data processing for direct marketing. You should stop any processing once you receive the user’s request. Users must be informed of this right at the very start of every data processing case.
Summing up this section, users have more rights over their data than your company does. User’s interests prevail, and so you must take them into account.
Why the GDPR is important for SMEs
First, small and medium-sized enterprises need to ensure the data privacy of all their consumers. Businesses must be acquainted with the responsibilities related to the processing of data of EU residents. The GDPR shouldn’t be perceived as an obstacle or an issue. The GDPR must be understood as the way to transparent data storage and trusting relationships with customers.
Nowadays, most businesses provide online services that process and store large amounts of data. These data include sensitive personal information that becomes a target for cyberattackers. Then, they strive to steal this information, sell it, or use it in other fraudulent ways.
Personally identifiable information (PII), such as social security numbers, driver’s licenses, passports, etc., is the first target for attackers, so the loss of sensitive information can be dangerous both for your company and customers.
Data protection for small and medium-sized companies is especially critical since breaches and information loss can run into large amounts of money. As a result, small companies may not be able to carry this financial burden and go bankrupt. Not to mention, it can damage their reputation.
Do you need GDPR project development? Go Wombat are GDPR and Cybersecurity specialists.
Benefits of the GDPR for your business
The strong sides of the GDPR for customers are evident. Moreover, the GDPR is customer-oriented first and foremost. However, your business also benefits from the General Data Protection Regulation, so let’s consider the main advantages of the GDPR for your enterprise.
Cybersecurity enhancement
The GDPR requirements motivate your business to enhance cybersecurity and take data privacy seriously. Therefore, you adopt relevant security measures to protect the personal data of residents from the European Union. As a result, you change and improve your cybersecurity approach, do everything to make it up-to-date, find weak points in your system, and streamline current security-related processes.
Improved data management
GDPR compliance requires your business to know exactly what sensitive information you store and process. That means you will need to audit all the data you have, put it in order, and improve the overall data management process. It will help you identify unnecessary data that can be already erased and increase the productivity of your staff in order to let them focus on critical things, saving precious time.
Better SEO
Compliance with GDPR provides your website with a higher ranking in Google since the website becomes more reliable.
Cost-efficiency
Of course, if a data breach occurs, you can show that your website is GDPR-compliant and that you have all policies, cookies, and terms and conditions on your website. In this instance, you can avoid a significant fine. You will even receive insurance payouts if a cyberattack is proven.
Higher loyalty and trust from users
When users see that your business complies with GDPR requirements, and you want users to feel trust and confidence in your service, it makes them more loyal to your services. Users know how their data is used and processed, they know that it can be erased upon request, and vendor-customer relationships are taken to the next level. You demonstrate your concern about users’ data privacy.
New business culture development
Respect for the security of your business environment and the privacy of your customers creates a new business culture inside your organisation. Following the GDPR, you motivate your employees to understand the value of security and become more responsible and determined. Thus, GDPR compliance helps change the mindset of employees and takes a step forward in competitiveness. Become better than your competitors.
How Go Wombat can help you
Finally, we want to demonstrate services related to the GDPR that Go Wombat may provide you with.
Consultancy
We can help you understand GDPR, how it works when you need it, and when you don't. Of course, it is possible that you won’t need GDPR compliance. Still, the assistance of our Chief Information Cybersecurity Officer, certified as a DPO, can be indispensable for you to know all the General Data Protection Regulation details.
Documentation preparation
We can prepare five primary documents required for your website to make it GDPR compliant: terms and conditions, privacy policy, cookie policy, privacy notice, and consent forms.
Create a data asset register
This is a kind of Excel document where we add categories of personal data capable of keeping inventory of them. It will help us identify whether your small or medium-sized business needs a Data Protection Officer or not.
Also, we can help find the right person for a DPO position if you need one. In addition, we can help with budget estimation for GDPR compliance and data breach assessment so you will know all the risks sensitive data may be subject to. Our specialists have the experience to put it into action.
Moving forward
Compliance with the GDPR is not straightforward, so you will need to get to know many more details and particularities to ensure you are covered.
This is what we do — we help you follow proper steps and ensure that your software is compliant. Go Wombat carefully creates secure software that meets your region's security standards.
Contact Go Wombat to make your software in line with all security requirements.
