What are my obligations?<\/h2>\n\n\n\nRegister with the ICO<\/h3>\n\n\n\n
If you process personal information, you must be registered with the ICO \u2013 it’s not too expensive for small businesses (\u00a335 a year).<\/p>\n\n\n\n
Question your data<\/h3>\n\n\n\n
It’s important to know what data you need and why you need it. To make sure you’re only getting the necessary data, ask yourself some of the questions below about the data you hold.<\/p>\n\n\n\n
Questions to ask<\/h2>\n\n\n\n\n- What personal data do I hold and why?<\/strong> (that includes clients, audiences, HR\u2026) e.g. where did I put that Zealous submissions report with 2,000 email addresses in it?<\/li>\n\n\n\n
- Who has access to it?<\/strong> e.g. should your accountant have access to all candidates contact information who submitted to your competition?<\/li>\n\n\n\n
- Do I need this data for the sake of the services I supply?<\/strong> e.g. holding next of kin information may be of relevance to a hospital, but not for a cinema<\/li>\n\n\n\n
- How long do I need the data for? What is in place to remove that data when it is no longer useful?<\/strong> e.g. is it valuable to have emails for audience members that haven’t visited in 5 years?<\/li>\n\n\n\n
- Did I get permission to hold that data from users\/clients?<\/strong> e.g. if they didn’t check that box to sign up to your newsletter themselves \u2013 then they didn’t agree to receive it in the first place.<\/li>\n\n\n\n
- Do users\/clients know what I hold about them?<\/strong> e.g. is it clear in your privacy policy what data you hold, why and how long for?<\/li>\n<\/ul>\n\n\n\n
Be transparent<\/h2>\n\n\n\n
The whole purpose of the change in the law is to allow individuals to be able to control their data and be aware of what data you hold about them at any time.<\/p>\n\n\n\n
A good start is by updating your privacy policy and making it clear what you hold data for; also make sure anyone with a question has someone to contact quickly, to solve issues quickly.<\/p>\n\n\n\n
Key tips<\/h3>\n\n\n\n
Your data must:<\/p>\n\n\n\n
\n- have a purpose<\/li>\n\n\n\n
- the individuals you are holding information must be “legitimately interested”<\/li>\n\n\n\n
- only be kept for the length of time it is necessary to keep it for<\/li>\n\n\n\n
- only be accessible by people who need that data in your organisation<\/li>\n<\/ul>\n\n\n\n
Don’t worry<\/h2>\n\n\n\n
If you’re ethical with your users, you don’t spam them, misplace 1,000’s of email addresses on the train, or surprise them with data they don’t think you should have about them (e.g. an automated entitled “Hi Dave, I noticed you visited Starbucks yesterday, why don’t you come visit us today since you’re in town”)\u2013 there should be no reason to worry.<\/p>\n\n\n\n
React to queries quickly, let people know what you hold about them from the onset, and don’t hold data you don’t need.<\/p>\n\n\n\n
Extra reading<\/h2>\n\n\n\n
The ICO has a very complete article about GDPR here<\/a>.<\/p>\n\n\n\n
Be transparent<\/h2>\n\n\n\n
The whole purpose of the change in the law is to allow individuals to be able to control their data and be aware of what data you hold about them at any time.<\/p>\n\n\n\n
A good start is by updating your privacy policy and making it clear what you hold data for; also make sure anyone with a question has someone to contact quickly, to solve issues quickly.<\/p>\n\n\n\n
Key tips<\/h3>\n\n\n\n
Your data must:<\/p>\n\n\n\n
- \n
- have a purpose<\/li>\n\n\n\n
- the individuals you are holding information must be “legitimately interested”<\/li>\n\n\n\n
- only be kept for the length of time it is necessary to keep it for<\/li>\n\n\n\n
- only be accessible by people who need that data in your organisation<\/li>\n<\/ul>\n\n\n\n
Don’t worry<\/h2>\n\n\n\n
If you’re ethical with your users, you don’t spam them, misplace 1,000’s of email addresses on the train, or surprise them with data they don’t think you should have about them (e.g. an automated entitled “Hi Dave, I noticed you visited Starbucks yesterday, why don’t you come visit us today since you’re in town”)\u2013 there should be no reason to worry.<\/p>\n\n\n\n
React to queries quickly, let people know what you hold about them from the onset, and don’t hold data you don’t need.<\/p>\n\n\n\n
Extra reading<\/h2>\n\n\n\n
The ICO has a very complete article about GDPR here<\/a>.<\/p>\n\n\n\n
![\"\"](\"http:\/\/mused.co\/wpadmin2\/wp-content\/uploads\/sites\/5\/2023\/11\/guy-armitage-zealous-1.webp\")
<\/figure>\n\n\n\n