You won’t be immune to GDPR. And you shouldn’t be. Especially if you’re a small business owner.
Unfortunately, fewer than one in 10 small businesses in the UK are fully prepared, according to a recent survey. That comes down to both complacency and a lack of understanding about its impact.
The legislation’s ambition is to encourage companies to think more proactively about data protection and to reinforce the need to consider how you as a small business are protecting sensitive personal information.
No matter your organisation’s size, you must comply with new regulations under the General Data Protection Regulation that governs the collection, storage and use of information about citizens, or face the EU’s hefty fines.
You’ll know in the connected world companies record and hold secure information about their customers creating a new kind of digital paper trail. It means the chances of sensitive personal information leaking is unfortunately more likely.
The easiest way to check you’re compliant is to work backwards, taking into consideration both past and present employees, suppliers and customers. Understand the data you’re holding, why you hold it, whether users opted in to sending it to you, where it might be going, and the difference between personal information (names, addresses, bank details) and sensitive data (health or religious views).
Most importantly, check that your security and policies surrounding the use of such information is compliant with GDPR. Broad use of encryption is a starting point to reduce the chance of data breach.
With GDPR overseeing the protection of that sensitive data, companies, even the smallest businesses, must ensure they put in place compliant security protocols and that data that users consented to giving you is stored securely.
Principally, it’s crucial that your organisation implements strong data security measures to keep your data stored safely, which is also part of regulatory compliance. Based on your systems infrastructure, these can include locating database vulnerabilities, data masking and real-time ransomware protection.
A data breach could be catastrophic for a small business. That means the security of personal information is absolutely critical.
Larger firms might have already appointed their Data Protection Officers to oversee policy updates but GDPR governs all commercial enterprises including sole traders working from their kitchen table.
The regulations underline the need to be more vigilant regarding data security and privacy, and that’s something that should be embraced, even for small companies.
Imagine, for instance, customers from bigger organisations refusing to work with non-complying smaller businesses? That’s the reality now.
Indeed, compliance should be welcomed. In fact, GDPR is good for small businesses. That’s because it will protect the privacy of citizens, reinforcing trust and security for consumers, but also opening up commercial opportunity.
It’s valuable to earn GDPR compliance sooner rather than later. It’s true that regulators will be more lenient with non-compliers in the first instance, and during the new regulation’s infancy, allowing time for corrective action to be taken.
And Article 30 of the regulations states that businesses with less than 250 employees will not be bound by the rules in the same way as large organisations. But stipulations could still mean problems for companies not recognising their obligation.
And with hefty fines a potential penalty for those failing to comply, small businesses could be hit the hardest with margins already squeezed. The safest option – indeed the one that protects the future of your business – is to act now.
You might wonder if leaving the EU will affect your need to comply with GDPR. The fact remains that any information about EU citizens’ data or information that can potentially identify an EU citizen means you must comply, whether your business is based inside or outside the European Union.
Government has also stated that it intends to update the 1988 Data Protection Act and will seek to mirror regulations with those of the GDPR. Therefore, compliance is still necessary.
But complacency remains dominant as so many small companies in the UK have failed to prepare properly for GDPR’s introduction. That fact remains: customers will be increasingly vigilante of where their data is stored.
Companies that don’t secure the information they process properly could see their bottom line severely damaged on top of regulators breathing down their necks.
There’s a lot to consider but the fact remains that companies must strive for best practice security measures. Solve the issue now before it becomes a problem.
