- \n
- Indemnifying Campaigns against Regulatory Hurdles<\/li>\n
- Collecting and Storing Consent<\/li>\n
- Managing Data Securely<\/li>\n
- Protecting Subject Privacy<\/li>\n
- Processing Data Lawfully<\/li>\n
- Establishing Legitimate Interests<\/li>\n
- Aligning Communication Platforms<\/li>\n
- Handling Sensitive Data<\/li>\n
- Complying with Subject Rights (objection, erasure, rectifications, data transfer etc.)<\/li>\n
- Employing Dedicated Compliance Teams<\/li>\n
- Conducting Effective Information Audits<\/li>\n
- Launching Opt-in\/Opt-out Campaigns<\/li>\n<\/ul>\n
<\/p>\n
<\/p>\n
<\/p>\n
Know\u00a0Lake B2B’s Vigilant Data\u00a0Licensing\u00a0Procedure to Save Your Data from Decay<\/a><\/h2>\n
<\/p>\n
<\/p>\n
1.\u00a0\u00a0\u00a0\u00a0\u00a0 Do\u00a0the final data audit a week or two before 25th May<\/h3>\n
GDPR takes data protection to new level. While it does protect subject rights, the rules are flexible to each user group. Launch your final data audit within the last two weeks prior to implementation for the most effective compliance.<\/p>\n
Check whether your final audit can answer the following questions convincingly and comprehensively: <\/strong><\/p>\n
- \n
- What data do you hold and why?<\/li>\n
- How do you collect the data?<\/li>\n
- How and where is the data stored?<\/li>\n
- What do you do with the data?<\/li>\n
- Who owns and controls the personal data?<\/li>\n
- Retention and deletion<\/li>\n
- Who is responsible for the data and processors associated with data?<\/li>\n
- Do you have adequate technology \/ process to adequately manage data processing?<\/li>\n<\/ul>\n
Results from your audit should culminate into an Information Asset Register<\/strong>.<\/p><\/blockquote>\n
<\/p>\n
2.\u00a0\u00a0\u00a0\u00a0\u00a0 Make consent seeking a regular exercise from now on<\/h3>\n
- \n
- Keep record of all privacy notices and emails during consent, for future reference<\/strong><\/li>\n<\/ul>\n
Companies involving in lawful data processing through \u201clegitimate interests\u201d are obliged to document the consideration of data subject rights pre-processing, and are required to produce all privacy notifications and emails sent to concerned subjects to regulators during data audits and in cases of data breaches.<\/p>\n
- \n
- Set an opt-in incentive budget (suggested: 2 \u2013 4 GBP per consent)<\/strong><\/li>\n<\/ul>\n
While you are asking for consent from subjects to process their data, it does not have to be on pure goodwill. In fact, to make it a win-win for all, you can offer sign-up bonuses like gift cards, discounts , etc. This way, subjects are also encouraged to do an honest exchange and share more information.<\/p>\n
It is proven that adding incentives for opt-ins attract more sign-ups and referrals. 2 \u2013 4 GBP per consent is the standard incentive budget for B2B campaigns.<\/strong><\/p><\/blockquote>\n
- \n
- \u00a0<\/strong>Add opt-out options in all B2B communications<\/strong><\/li>\n<\/ul>\n
While emailing to businesses, the best practice is to notify opt-ins at the beginning (data capture point) and provide opt-out options in all communications henceforth. This is called a soft opt-in. GDPR compliance\u00a0policies regarding opt-ins are less stringent in terms of individual business emails, but the opt-out options are a must.<\/p>\n
- \n
- Enable single or (preferably) double opt-in options<\/strong><\/li>\n<\/ul>\n
Organisations must ensure their subject\u2019s consent through unambiguous, explicit and transparent opt-in requests during the first point of contact. Post consent, each communication from the provider is obligated to contain a chance to opt out from said consent.<\/p>\n
To ensure complete GDPR compliance, controllers\/processors must ensure:<\/em><\/strong><\/p>\n
- \n
- Requested consent is not based on silence, inactivity or pre-opted boxes<\/em><\/li>\n
- Consent clause is not \u201cbundled\u201d with other agreements or declarations<\/em><\/li>\n
- Consent is not contingent with supply of services, when not required<\/em><\/li>\n
- Data subjects are clearly informed about their consent withdrawal rights<\/em><\/li>\n
- Consent withdrawal is as simple as providing it, ideally the same medium<\/em><\/li>\n
- Separate consents are obtained for distinct processing operations<\/em><\/li>\n<\/ul>\n
![\"GDPR](\"https:\/\/www.lakeb2b.com\/blog\/wp-content\/uploads\/2018\/04\/GDPR-Email-Consent-Template-Graphic-1.png\" "\\"GDPR")
Email Consent Sample; Source: B2BInfoChampions.com<\/em><\/p><\/div>\n
<\/p>\n
![\"GDPR](\"https:\/\/www.lakeb2b.com\/blog\/wp-content\/uploads\/2018\/04\/GDPR-Compliance-Blog-Graphic-1.jpg\" "\\"GDPR")
GDPR Email Consent Template; Source: WeWillThrive.co.uk<\/em><\/p><\/div>\n
3.\u00a0\u00a0\u00a0\u00a0\u00a0 Maintain a black and a white list of contacts<\/h3>\n
- \n
- Make separate baskets for opt-in and opt-out contacts<\/strong><\/li>\n<\/ul>\n
UK\u2019s supreme data regulator Information Commissioner\u2019s Office (ICO) issued the following guideline regarding emailing businesses:<\/p>\n
\u201cYou can send marketing emails or texts to companies. However, it is good practice to keep a \u2018do not email or text\u2019 list of any companies that object.\u201d <\/em><\/p>\n
Maintaining a white-list and black-list of contacts enhances campaign efficiency and checks the quality of your marketing database first-hand.<\/p>\n
- \n
- Maintain a field for \u2018consent qualification status\u2019 in the database<\/strong><\/li>\n<\/ul>\n
GDPR requires organisations to record and manage ongoing consent. Apart from maintaining a contact white list and black list, the vital addition of a dynamic consent status to your master database enables your CRM in tracking and following up on your opt-in requests. Automation tools can integrate consent extraction as part of the lead nurturing process.<\/p>\n
<\/p>\n
4.\u00a0\u00a0\u00a0\u00a0\u00a0 Do not upload any sensitive* data on the platform<\/h3>\n
Information related to minors, criminal or other conviction records, bio-metric data, health records are given special status under GDPR. Such information can only processed (even stored) under special circumstances and require authorization from public authorities.<\/p>\n
*Genetic data, biometric data, data regarding health are some of the sensitive data categories mentioned under GDPR.<\/p><\/blockquote>\n
- \n
- Remove data related to criminal or any other convictions<\/strong><\/li>\n<\/ul>\n
Sensitive Information Processing<\/em><\/strong><\/p>\n
- \n
- Check whether you process data falling under \u201cSpecial categories of personal data\u201d<\/em><\/li>\n
- Ensure consent taken for \u201cSpecial categories\u2026\u201d data follow the specific GDPR compliance protocols <\/em><\/li>\n
- Check Member States\u2019 impositions for storing biometric, genetic and health data<\/em><\/li>\n<\/ol>\n
<\/p>\n
<\/p>\n
Increase Your Campaign Deliverability by 85% By\u00a0Leveraging Lake B2B’s Compliance-Proofed Data<\/a><\/h2>\n
<\/p>\n
<\/p>\n
- \n
- Be very careful while seeking information on minors<\/strong><\/li>\n<\/ul>\n
Children Online Data Protection<\/em><\/strong><\/p>\n
- \n
- Check whether children online data rules affect you<\/em><\/li>\n
- If Yes, ensure:<\/em>\n
- \n
- Applicable national rules are being adhered<\/em><\/li>\n
- Parental consent mechanisms and verification processes are implemented<\/em><\/li>\n<\/ul>\n<\/li>\n<\/ol>\n
(for organizations offering information via society services directly to children)<\/em><\/strong><\/p>\n
- \n
- National legislation for processing for offline data processing is being adhered<\/em><\/li>\n
- Notices are drafted in understanding of the child (for offerings directly to children)<\/em><\/li>\n
- Carefully document the balance between organization goals and the interest of the child<\/em><\/li>\n<\/ol>\n
(for organizations processing child data through \u201clegitimate interests\u201d)<\/em><\/strong><\/p>\n
<\/p>\n
5.\u00a0\u00a0\u00a0\u00a0\u00a0 Pre-approve B2B communication template(s) from legal firms specialized in GDPR<\/h3>\n
Transparency and user-friendliness are the two pillars of marketing communications under GDPR. While these are to thwart unfair practices, but certain guidelines have been set for messaging, media and designs by the new law. These are finer lines in the GDPR compliance procedure and require expert help.<\/p>\n
<\/p>\n
- \n
- Optimize sign-up forms for Individual Business Domain Emails \u2013 not personal ones<\/strong><\/li>\n<\/ul>\n
There are two ways to communicate with businesses under GDPR \u2013 without consent (for role accounts; e.g.: info@, contact@ etc.), and with consent (for business email addresses of individuals). Sending marketing communications to Individual Business Domain Emails <\/strong>require soft opt-in (opt-out option in each communication) for old acquaintances,\u00a0while new\u00a0contacts have to be opted-in at the point of data capture.<\/p>\n
Personal email IDs, on the other hand, enter the realm of private data and require intense consent seeking exercises.<\/strong><\/p><\/blockquote>\n
\u00a0<\/strong><\/p>\n
- \n
- Log-in portals for accessing particular websites or services must have exclusive sub-domains to the service provider\u2019s main site<\/strong><\/li>\n<\/ul>\n
To clear the ambiguity regarding ownership over exclusive digital services, GDPR demands the service provider to enable exclusive member logins under their respective website domains.\u00a0 While this establishes the service provider\u2019s authenticity, but it also excludes the hassle of obtaining additional consent for other third-party sites.<\/p>\n
<\/p>\n
![\"User](\"https:\/\/www.lakeb2b.com\/blog\/wp-content\/uploads\/2018\/04\/User-Data-Access-Platform-Template-Graphic-2.png\" "\\"User")
Inside your user-exclusive portal, add a communications page with access to their respective data and communication choices<\/em><\/p><\/div>\n
<\/p>\n
- \n
- Qualify GDPR compliance for email marketing platforms used for B2B communications<\/strong><\/li>\n<\/ul>\n
GDPR makes communications between companies simpler. But your email marketing platforms should be optimised to deal with the different sets of recipients you send emails to. Segment the tasks for non-customers, customers, and business houses, as each set demands separate consent mechanisms and messaging formats under GDPR.<\/p>\n
<\/p>\n
- \n
- Update your company\u2019s Emergency Response Systems to GDPR\u2019s data breach guidelines<\/strong><\/li>\n<\/ul>\n
Under Article 17 (Data Erasure), GDPR provides users the authority to \u201chalt third parties from processing [their] data\u201d. Additionally, they also will have the right to object on the usage of their personal data at any point they deem fit. Companies (processors and controllers) must facilitate this by setting up an easily accessible medium to register their complaints, grievances and objections in real-time.<\/p>\n
Under one the following clauses, like when the data no longer is relevant to the original purpose, or due to subjects\u2019 withdrawal of consent to storage, the data controller would be obliged to:<\/em><\/p>\n
- \n
- Erase all information of the particular individual<\/em><\/li>\n
- Cease further dissemination of the data<\/em><\/li>\n
- Halt third parties from processing the data<\/em><\/li>\n<\/ul>\n
<\/p>\n
![\"Automation](\"https:\/\/www.lakeb2b.com\/blog\/wp-content\/uploads\/2018\/04\/Automation-Workflow-Graphic-3.png\" "\\"Automation")
Automating the B2B Communication Flow<\/em><\/p><\/div>\n
<\/p>\n
- \n
- Apply a user-friendly automated medium for data subjects to express their objections<\/strong><\/li>\n<\/ul>\n
In cases of data breaches that can \u201cresult in a risk for the rights and freedoms of individuals\u201d, awareness notifications to customers (subjects) and controllers will become a mandatory obligation for data processors. Notifications have to be issued \u201cwithout undue delay\u201d within 72 hours of becoming aware of the breach.<\/p>\n
- \n
- Update your organizations\u2019 data breach notification procedure. Include:<\/em>\n
- \n
- Incident Identification Systems<\/em><\/li>\n
- Incident Response Plans<\/em><\/li>\n<\/ul>\n<\/li>\n
- Develop systems to encrypt data in case of breach or unauthorized access<\/em><\/li>\n
- Assess your insurance coverage in case of data breaches<\/em><\/li>\n
- Data Protection clauses and tender documents should be updated by customers. Include:<\/em>\n
- \n
- Suppliers\u2019 utmost responsibility to notify breaches<\/em><\/li>\n<\/ul>\n<\/li>\n
- Emphasis on cooperation between the parties<\/em><\/li>\n<\/ol>\n
<\/p>\n
6.\u00a0\u00a0\u00a0\u00a0\u00a0 Appoint a Data Protection Officer (DPO) from within the organisation who has thorough understanding of the company\u2019s inner workings.<\/h3>\n
Instead of going back and forth on obtaining permits from local Data Protection Authorities (DPAs), GDPR keeps the onus of record keeping within the controllers and processors. Such organisations, with core operations relating to \u201cregular and systematic monitoring of data subjects on a large scale\u201d, will have to appoint Data Protection Officers (DPOs) to fulfil their data protection duties.<\/p>\n
DPOs will not be liable to obtain approvals from DPA of data processing activities under the Model Contract Clauses (MCCs).<\/em><\/strong><\/p><\/blockquote>\n
<\/p>\n
Was this blog useful? Let us know in the comments below. For your very own GDPR compliance consultation, contact our data experts<\/a><\/strong>.<\/em><\/p>\n
<\/p>\n
- Emphasis on cooperation between the parties<\/em><\/li>\n<\/ol>\n
- Incident Response Plans<\/em><\/li>\n<\/ul>\n<\/li>\n
- Incident Identification Systems<\/em><\/li>\n
- Update your organizations\u2019 data breach notification procedure. Include:<\/em>\n
- Cease further dissemination of the data<\/em><\/li>\n
- Erase all information of the particular individual<\/em><\/li>\n
- Update your company\u2019s Emergency Response Systems to GDPR\u2019s data breach guidelines<\/strong><\/li>\n<\/ul>\n
- Qualify GDPR compliance for email marketing platforms used for B2B communications<\/strong><\/li>\n<\/ul>\n
- Log-in portals for accessing particular websites or services must have exclusive sub-domains to the service provider\u2019s main site<\/strong><\/li>\n<\/ul>\n
- Notices are drafted in understanding of the child (for offerings directly to children)<\/em><\/li>\n
- Parental consent mechanisms and verification processes are implemented<\/em><\/li>\n<\/ul>\n<\/li>\n<\/ol>\n
- If Yes, ensure:<\/em>\n
- Check whether children online data rules affect you<\/em><\/li>\n
- Ensure consent taken for \u201cSpecial categories\u2026\u201d data follow the specific GDPR compliance protocols <\/em><\/li>\n
- Check whether you process data falling under \u201cSpecial categories of personal data\u201d<\/em><\/li>\n
- Remove data related to criminal or any other convictions<\/strong><\/li>\n<\/ul>\n
- Maintain a field for \u2018consent qualification status\u2019 in the database<\/strong><\/li>\n<\/ul>\n
- Consent clause is not \u201cbundled\u201d with other agreements or declarations<\/em><\/li>\n
- Requested consent is not based on silence, inactivity or pre-opted boxes<\/em><\/li>\n
- Enable single or (preferably) double opt-in options<\/strong><\/li>\n<\/ul>\n
- \u00a0<\/strong>Add opt-out options in all B2B communications<\/strong><\/li>\n<\/ul>\n
- Set an opt-in incentive budget (suggested: 2 \u2013 4 GBP per consent)<\/strong><\/li>\n<\/ul>\n
- Keep record of all privacy notices and emails during consent, for future reference<\/strong><\/li>\n<\/ul>\n
![\"Subscribe!\"](\"https:\/\/www.lakeb2b.com\/blog\/wp-content\/uploads\/2017\/10\/Subscribe.png\" "\\"Subscribe!\\"")
<\/a><\/p>\n","protected":false},"excerpt":{"rendered":"