We’ve come a long, long way since the days of being solely dependent on brick and mortar stores for all our needs, with eCommerce really transforming the face of how things work in the business world. However, evolving digital technology and business advancements bring along a growing risk of data privacy issues, especially since the customers’ personal information is at risk.
The General Data Protection Regulation (henceforth referred to in this article as GDPR) spells a new beginning and a definite change in strategies for enterprises – especially eCommerce businesses around the globe.
Understanding GDPR
So, what exactly is the General Data Protection Regulation and why should you be concerned about it? The GDPR is basically a European Union (EU) regulation that acts as the new data privacy law. It is, by far, the most comprehensive and well-structured data privacy law globally and has been created to monitor and regulate how companies gather, use, share and handle customers’ personal data. The GDPR will require a thorough review of how you process customer data.
What qualifies as personal data?
Personal data includes pictures, electronic mails, bank details, IP addresses, social media posts, behavioral data or anything that makes it possible to directly or indirectly identify a person.
Why was the GDPR introduced?
From a business point of view, the GDPR’s aim was to enable businesses to enhance their customer service levels, inspire greater customer loyalty and confidence in the company, engage in advanced sales and marketing, and help gain a competitive advantage in the market by approaching customer data differently.
From a layman’s point of view, the whole idea behind the new regulation was to ensure that every individual has greater control over their data (or the right to know what happens to his/her data). The GDPR now empowers individuals to ask a business for any personal data, question and demand a free copy of the same. As a consumer, one can even request an organization to delete all personal data.
When will the GDPR come into force?
The GDPR is all set to be in action from May 25, 2018.
Whom does it apply to?
The new regulation will primarily have an impact on all businesses operating within the EU, or those who have customers in the EU. The latter part of the aforementioned statement should matter to you (eCommerce businesses) because irrespective of your location, you will need to comply with the new rules if you collect, use or share EU residents’ personal data. It is highly likely that you, as an eCommerce business, have (or will have) European customers – the GDPR, then, should matter to you.
In simple words, if your eCommerce website is available/accessible in Europe, you have to comply with GDPR.
GDPR has unique consequences for eCommerce companies
Here’s a complete breakdown of how you are required to maintain customer data May 25 onwards:
Opt-in only
Before gathering any personal data, it is mandatory to obtain the customer’s consent. It is also required for organizations to make the data available at their request.
Granular consent
The GDPR makes it clear that in cases where customer data is to be used for multiple sales or marketing activities, the approval for each one has to be taken separately – and you are obligated to maintain records of what, when and how each individual has consented to.
Privacy
Having duly signed privacy agreements is a must for third-party vendors who have access to your customer data. It is essential that you are clear about what happens to the data collected (including secure storage, management, and processing).
App security
Anything that you intend to do with the data of an EU resident needs to be registered (including information about where the data is stored). Applications that contain sensitive data will need to be secured and certain data breaches will have to be reported to data protection authorities if required.
Data storage, retention, and transfer
The data must be stored only for as long as necessary and the GDPR does not allow the transferring of data to any area outside the European Economic Area (unless that nation has an ample protection for the rights/freedom of the data subject with reference to the processing of personal information and erasing it on request).
How can you ensure GDPR readiness?
There are a few ways in which you can be sure of riding this wave of change smoothly.
People and systems
Are you equipped with tools or software that can take care of these new demands? Also, do you have a data protection team (or an individual) to handle any such requests or compliance problems?
Privacy policy and opt-in process
Have you updated your consent forms, privacy policies and disclosures to ensure GDPR readiness? To obtain consent from your customers, you may need to make certain changes to your opt-in processes.
Pro tip: Most noteworthy, you could think out of the box and offer rewards or incentives to obtain their consent!
Data audit
Have you thought about the existing data that you have?
How can you preserve it?
Have you obtained explicit consent for storing this data?
Where is it stored?
How is it stored?
Is there redundant data that you can get rid of?
Are there any potential security challenges?
It is the right time to conduct a thorough data audit and then take a call on what you need and what you don’t.
Third-party assets
Do you use any third-party services (applications, cloud solutions, themes, etc.)? If the answer is yes, you must ensure that all sub-processors are GDPR compliant.
Communication process
Develop a clear, concise, transparent, intelligent and easily accessible communication process that keeps the consumer in the loop (with reference to obtaining their consent, allowing them to raise complaints or requesting removal).
Cost
Businesses that are not compliant with GDPR would have to pay fines up to 10 million Euros or 2% of the annual global turnover for the previous year (whichever is higher). What is even more concerning is that non-compliance can lead to a loss of trust in the company (from a consumer’s point of view) and cause major damage to the goodwill of the brand. It’s best to evaluate your business strategies and take into consideration the cost of regulatory compliance now.
Data Breach
Do you have a well-defined process in place to handle data breaches? 72 hours is the deadline that GDPR has set for a company to notify any affected user(s) about an incident that compromises the security of personal data. Your business is liable to pay fines of up to 4% of your annual revenue (global) or 20 million Euros (whichever is greater) in case you suffer a data breach. The call is yours!
Website security
If your entire website has an SSL certificate, you are GDPR compliant. Furthermore, it is also essential that the database itself is encrypted. Hence, it is not only vital to have full HTTPS for search engine optimization (SEO) purposes, but for GDPR as well (as opposed to partial HTTPS).
Here’s the complete guide to the legislation: https://ico.org.uk/for-organisations/guide-to-data-protection/
How we can help
Finally, GDPR is around the corner and if you aren’t ready for it, you need a trusted partner who can ensure that your online business continues to run without any hiccups and adapts to this paradigm shift smoothly. QualDev is that partner.
With comprehensive solutions for all types of eCommerce businesses, QualDev takes a tailormade approach to each client, and take care of their specific needs in the most hassle-free and cost-effective manner.
Get in touch with our experts to put all your GDPR worries to rest.
Disclaimer: GDPR is a complex regulation. We urge you to read it in its entirety and consult with legal counsel to ensure compliance.
Data source: https://searchdatabackup.techtarget.com/tip/Being-GDPR-compliant-is-not-just-a-concern-for-the-EU