On May 25th, 2018, GDPR became a key focus for sales and marketing teams, introducing stringent rules for handling personal data of EU individuals. This primer aims to help our customers at Vendi understand how to align their data practices with GDPR. We’ll provide insights into how Vendi has adapted and offer practical tips for leveraging sales and marketing intelligence solutions in compliance with GDPR.
Does the GDPR Apply to My Business?
Determining GDPR's Applicability: Scope and Extent
Establishment in the EU: GDPR impacts your business if you're established in the EU, which goes beyond mere physical presence and includes any substantial business activity within the EU.
Dealing with EU Data Subjects: The regulation also applies if you process data of individuals in the EU, especially in relation to offering goods or services. However, for B2B marketing, the scope may differ as the direct recipient is the business, not the individual employees.
Monitoring EU Individuals: If your activities involve tracking individuals in the EU to understand or predict their behavior, GDPR will likely apply. This doesn't mean processing general business contact data for outreach, but rather activities that delve into detailed internet behavior analysis.
Understanding the nuances of GDPR's scope is crucial in assessing its relevance to your business operations and data processing activities.
Lawfulness of Processing Under GDPR
Determining the Lawful Basis for Data Processing:
If GDPR applies to your operations, identifying a lawful basis for processing personal data is essential. GDPR Article 5(1)(a) outlines six lawful methods:
Consent from the data subject.
Performance of a contract involving the data subject.
Legal obligations of the data controller.
Vital interests of the data subject or another person.
Public interest tasks or official authority.
Legitimate interests pursued by the data controller or a third party.
Focus on Legitimate Interests and Consent:
Direct Marketing as a Legitimate Interest: Contrary to popular belief, consent isn't the only lawful basis. Direct marketing can fall under 'legitimate interests' (Article 6(1)(f)), which doesn’t require consent. However, transparency notices explaining processing activities are necessary.
Consent: When using consent as your basis, it must be explicit, freely given, and informed. GDPR mandates specific information to be included when obtaining consent, covering data usage, transfers, and the data subject’s rights.
Rights of Data Subjects Under GDPR
Data subjects (individuals whose data you're processing) have specific rights under GDPR (Articles 15-21). These rights include:
Access to Their Data: Subjects can ask what data you hold about them.
Correction and Deletion: They can request corrections to inaccurate data or its deletion.
Objection to Processing: Subjects have the right to object to data processing.
Notification of Data Transfer: If data is transferred, and a subject requests deletion, you must inform the recipients about the deletion request.
Implementing GDPR Compliance Protocols
GDPR mandates that organizations implement suitable technical and organizational measures to ensure compliance (Articles 24(1) and 32(1)). These measures should be proportionate to the data's nature and processing purpose. For instance, processing business contact information for B2B marketing might not demand as stringent protocols as would be required for sensitive data like health information.
Moreover, maintaining records of compliance is essential, although organizations with fewer than 250 employees may be exempt from this requirement (Article 30).
GDPR and Data Breach Notifications
Under GDPR, organizations are required to notify both the affected individuals and relevant authorities in the event of a data breach (Articles 33-34). However, this notification is contingent on the risk the breach poses to personal rights and freedoms. In cases involving strictly business contact information, the requirement for breach notification might be less stringent, depending on the risk assessment.
Understanding the Complexity of GDPR
The GDPR is a complex and extensive regulation. This guide aims to highlight key aspects, especially concerning the use of business contact information for B2B marketing. However, it doesn't encompass the entire 88-page regulation. The applicability and obligations of GDPR can vary greatly depending on the nature of data usage. For a comprehensive understanding of your specific legal obligations under GDPR, it's recommended to consult with a legal expert.
Crafting Your GDPR Strategy in Sales and Marketing
Data plays a crucial role in sales and marketing. With GDPR, it's important to view these new regulations not as a hindrance but as an opportunity to enhance your data management practices. This approach not only ensures compliance but also helps in building and maintaining trust with your customers. Here are some fundamental best practices to consider as you align your sales and marketing strategies with GDPR.
1. Establishing a Data Management Team
Create a team comprising key stakeholders to ensure the integrity and security of your prospect database.
2. Evaluating Current Data Practices
Assess the following:
Types and Nature of Data: What is collected and stored.
Collection Methods and Timings: How and when data is collected (e.g., via websites, trade shows).
Data Storage and Movement: Where data is stored and how it moves within your organization.
Access and Security: Who has access and what security measures are in place.
3. Assessing Data Protection in Sales & Marketing Systems
It's essential to understand how your Marketing Automation or CRM tools safeguard prospect and customer data.
Key areas to focus on include:
Vendor's Security Measures: Check how your vendor manages data security, including access controls and compliance with regulations.
System Functionality for Data Preservation: Look into features that help protect data, such as user roles and permissions, activity logs, data update histories, and controls over data capture.
Data Flow Documentation: Keep records of how data moves through your systems, ensuring clarity on access and usage.
In case of a data breach, GDPR requires notifying affected individuals and authorities, except if the breach poses minimal risk to personal rights and freedoms. This is particularly relevant for business contact information.
4. Understanding the Nature of Your Data
Recognize the type of data in your database. While B2B sales often involve basic business contact information, processing sensitive personal data brings additional GDPR obligations. Sensitive data can include:
Identifiers like government IDs or financial numbers.
Health, genetic, or biometric data.
Racial, ethnic, political, or sexual orientation information.
If your database contains such sensitive data, be aware that GDPR compliance requires stricter consent and security measures.
5. Maintaining Data Traceability
For GDPR compliance, it's important to document the lifecycle of your data:
Data Origin: Track where and how each data piece was sourced, such as forms, events, or third-party appendings.
Record Keeping: Expand your tracking to include multiple data sources for each contact.
Data Acquisition Details: Note the specific methods and timings of data collection.
Timestamping in Tools: Utilize MAT and CRM tools to timestamp when data is added or updated.
These steps ensure you can demonstrate an understanding and legal justification for your data processing activities.
6. Implementing a Database Health Program
For GDPR compliance, it’s crucial to establish a robust database health program:
Develop Data Policies: Create clear policies outlining your data practices and compliance plan.
Address Key Areas: Your plan should cover data collection methods, notification processes, usage purposes, data updating and purging, and security measures.
Vendi’s Commitment to Data Protection
Vendi has a strong focus on GDPR compliance, employing experts to ensure adherence to regulations. The company has a comprehensive approach to privacy management, including proactive notifications to all contacts in the database about their data usage and opt-out rights. This commitment extends globally, not just in the EU.
Vendi focuses on processing only business contact information for EU contacts, such as company details, job titles, email addresses, and work phone numbers. This approach avoids handling sensitive personal data, aligning with GDPR standards. The information Vendi processes is akin to what is typically found on business cards or professional profiles.
Disclaimer: This guide is for informational purposes only and is not legal advice. For a complete understanding of GDPR and its impact on your business, consult with legal counsel.