Transform: GDPR compliance for marketing purposes
The following recommendations relate to actions required to comply with the new data protection regulations (GDPR) for marketing purposes and are based on:
- General research and our current understanding of the GDPR regulations that come into force on 25th May 2018
- Various publicly available guidance documents and guidelines (see list of links and references below)
- Information provided by MailChimp about the functionality of their platform as it applies to collecting data via sign-ups through your website, storage of data and their role in processing your data, along with their guidelines and tools to facilitate best practice and to comply with GDPR (see attached)
- Our understanding of your status as a data controller in relation to data collection, management and use, focusing on email and digital marketing/transactions
It should be noted that advice and recommendations are provided by B&H in good faith, based on our current knowledge, but it does not constitute legal advice and shouldn’t be relied upon as such.
In focusing on data collection and processing, and gaining consent, we have noted that the ICO states:
“The first principle of data protection is that personal data must be processed fairly and lawfully. The DPA says that in order for the processing to be fair, the data controller (the organisation in control of processing the data) has to make certain information available to the data subjects (the individuals whom the data relates to), so far as practicable:
- who the data controller is
- the purpose or purposes for which the information will be processed
- and any further information which is necessary in the specific circumstances to enable the processing to be fair.
This applies whether the personal data was obtained directly from the data subjects or from other sources.”
Suggested steps to compliance
There are a number of key steps to be implemented in order to:
- Assess future compliance of your existing data against the requirements of GDPR
- Take appropriate steps to achieve GDPR compliant data by requesting existing contacts to ‘re-subscribe’ where this is necessary to gain the appropriate consents before the deadline of 25th May 2018
- Ensure that your e-marketing data collection, storage, processing and management systems are reviewed and updated to be GDPR compliant
- Adopt best practice in achieving consent (through website sign-ups and any other data collection methods that you might use)
- Adopt best practice in ensuring that subscribers/customers can ‘unsubscribe’ as easily as possible
.
