On May 25, 2018, the European Union’s (EU) General Data Protection Regulation (GDPR) goes into effect. This new set of regulations mandates “Privacy by design” for every EU citizen. This means that under the GDPR, individuals have the right to choose how their personal data is stored and used. Their personal information will become as sensitive as credit card information with massive fines if it is inappropriately handled within your business system.

How does this effect you as a U.S. company? Even if your business in not in the European Union you may still be required to comply. Any U.S. company that collects the "personal data" of an EU citizen will be subject to the GDPR. For instance, you may receive a business card at a convention and want to enter that information into your business system. Think again. You have to document the permission to add the information to your database. And you have to give them the option to have their personal data removed at any time. If you don’t comply, the fines will be huge, up to 4% of annual global revenue or 20 million Euros, whichever is greater.

Organizations must prove that consent was given in a case where an individual objects to receiving the communication. This means that any data held must have an audit trail that is time stamped and contains details about what the contact opted into and how.

Many people think that the GDPR is just an IT issue, requiring an update of your ERP/CRM or online systems, but it has broad-sweeping implications for the whole company, including the way companies handle marketing and sales activities.

How should your company prepare for this? First, read our White paper  “GDPR and how it affects you”. Then we suggest you start with these steps:

1. Organize your data
2. Review your data collecting processes
3. Create new methods for handling personal data
4. Protect your data from breaches

Feel free to give us a call anytime. We can help you create a plan to make your system GDPR compliant.

Donavan D. Lane, CEO