The General Data Protection Regulation — the GDPR — seeks to unify data protection legislation across Europe. It is the successor to the EU Data Protection Directive [of] 1995 and came into effect on May 25, 2018.

A complex regulation composed of 11 chapters, 99 articles (which dictate the compliance requirements), 173 recitals (which provide context to the articles), and 88 pages, the GDPR might not be something you care to read.

I was inspired to write this book — designed to help anyone who needs to quickly and easily come to grips with the GDPR and related data-protection legislation — following the success of my Facebook group, GDPR for Online Entrepreneurs. (I tell you more about that topic later in this introduction.) In this group, the largest social media group on the topic of the GDPR, I have been able to help tens of thousands of small-business owners via my numerous video guides, online training sessions, and live Q&As.

Although the Facebook group has helped many thousands of small-business owners around the world understand the GDPR and how to implement compliance in their own organization, I know that many more still need help. Some aren’t on Facebook, some will never find my group, and some prefer a comprehensive book over watching videos.

It is my hope that, in writing this book, I can help many more tens of thousands (and maybe someday, hundreds of thousands) when dealing with the complex set of issues associated with the GDPR.

About This Book

The book explains the complexities of the GDPR in language that anyone can understand. It is practical, it is relevant, and it is comprehensive. If you’re processing personal data — whether you’re part of a company, a charity, or an association — this is the book for you.

Due to its ease of reading and the comprehensive nature of the book, the book may be not only a useful guide for small-business owners, charities, and associations but also a useful resource for Data Protection Officers (or anyone responsible for data processing) of larger companies.

Although reading this book might save you the headache of reading the entire text of the GDPR, you might still need to obtain legal advice concerning certain activities related to achieving and maintaining GDPR compliance.

Foolish Assumptions

If you’re reading this book, I assume the following about you (issues that relate to the material scope of the GDPR, which is a topic I discuss further in Chapter 2):

• You either run your own business (or an association or a charity) or work for one and are to some extent the responsible party when it comes to data protection.
• You process personal data in an automated way or as part of a manual filing system.

Note: If you process personal data purely as part of a personal or household activity, you need not read this book, because the GDPR doesn’t apply to you.

The following list shows what I’ll ask you not to assume, to help you begin to understand how the GDPR works and when it applies to you:

• Territorial scope of the GDPR: Don’t assume that just because you’re established outside of the EU that the GDPR doesn’t apply to you. If either of the following bullet items applies to you, the GDPR applies to you:
  • You offer goods or services (whether payment is required or not) to data subjects within the EU.
  • You monitor the behavior of data subjects in the EU — for example, by using tracking cookies.
• Size threshold for the GDPR: Don’t assume, because your company, charity, or association is very small, that the GDPR doesn’t apply to you. No threshold of size dictates whether the GDPR applies. There are derogations (exemptions) for certain GDPR obligations for organizations that employ more than 250 employees, but many people confuse this with an absolute exemption from the application of the GDPR. That is not the case.

• Compliance: If the GDPR does apply to you, don’t assume that you can play fast-and-loose with the rules and never be fined or that you can ignore the rules because your competitors aren’t compliant. Supervisory authorities respond to complaints; if they investigate you and find non-compliance, they have a wide range of sanctions at their disposal. (See Chapter 21 for more on this topic.)

  Equally, don’t assume the worst because a complaint has been made. If you cooperate with the supervisory authority and show that you have been trying to become compliant, you will in all likelihood be spared a fine. If you bury your head in the sand and ignore the GDPR, however, the supervisory authorities won’t hesitate to use the full sanctions at their disposal.

• Investment to become compliant: You may not be overjoyed about having to find the time to learn about the GDPR and then implement compliance, but it’s important, and it’s necessary. Yet you don’t have to spend a fortune on expensive lawyers and you don’t need to become an expert on the GDPR.

  If you put aside just a few days to read this book, buy my GDPR Compliance Pack (find out more about this later in the Introduction), and put in place the necessary documents, you will be in good shape to fend off complaints, cope with regulatory investigations, avoid fines, and develop customer loyalty by respecting their data.

• People don’t care about compliance: At a talk I gave at the Digital Marketer’s Internet marketing conference in San Diego about the GDPR and the new ePrivacy Regulations (see Appendix A for more on the ePD), I shared research from a report by Axciom, which surveyed over 10,000 people in ten different countries. The report shows that the vast majority of people are very concerned about the issue of online privacy.

  

  So, don’t assume that your prospects and your customers don’t care about your compliance with the GDPR. As public awareness increases about GDPR compliance, it’s in your best interest to comply; not doing so means that your prospects and customers’ concerns about how you use their personal data won’t be alleviated. By showing that you’re complying with the GDPR, you'll likely be rewarded by your customers with their loyalty, and your prospects will be more likely to become customers.

How This Book Is Organized

I’ve organized this book into several chapters divided into seven parts. In this section I briefly describe each part to give you a high-level look into what information is covered and where. You can find a more granular breakdown of the topics in the table of contents at the front of this book. And, if you’re searching for information on a specific issue, you can check the index to find where in the book it’s located.

Icons Used in This Book

Throughout this book, I use various icons to draw your attention to specific information — here’s a description of what they mean:

This icon highlights pointers to an easier way of doing something or a suggestion that can save you time. This icon may also point out where I give advice to help keep you out of trouble.

When you see this icon, you know that it highlights information to keep in mind — or a topic I’ve discussed elsewhere, and I’m reminding you of it.

I use this icon to point out pitfalls to avoid or actions (or a lack of actions) that can land you in legal trouble.

Sometimes I provide particularly sticky details about an issue, which can get technical and not exactly interesting. You can ignore any text marked with this icon and not miss it a whit.

What You’re Not to Read

Many small business owners are familiar with concepts such as consent and legitimate interests and the requirements to have a Privacy Notice and a Cookie Policy and to keep data secure. What many of them ignore, however, are matters such as using data processors and subprocessors, international transfers and data protection by design and by default.

If you’re familiar with basic concepts but haven’t ventured beyond that, I recommend that you skip Part 1 and most of Part 2 to start at Chapter 6 and then read on from there.

I see many business owners who took action when the GDPR came into effect by putting new documentation into place but haven’t revisited it since then. The supervisory authorities are clear that treating the GDPR lightly, as a one-off exercise or a tick-the-box exercise, is not sufficient. Compliance has to be ongoing, and privacy must be at the heart of the organization. If this is you and you need to revisit your ongoing compliance, I recommend skipping Parts 1–3 (for now) and paying particular attention to Chapter 14 onward.

If you’re an expert on the GDPR and are using this book as a reference point only, just dip in and out as you see fit.

Where to Go from Here

Unless you are an expert in the GDPR (and are using this book as a reference point), I suggest that you start at Chapter 1 and read the entire book from start to finish.

You can read chapters out of order if you need to focus on certain areas before others. I provide cross-references to relevant chapters on topics you might need to know more about.

If you are new to GDPR compliance or you haven’t kept on top of ongoing compliance, start with the GDPR checklist in Appendix C, which will highlight your areas of noncompliance.

If you receive a data subject right request, such as a Data Subject Access Request or a right to be forgotten, you can refer quickly to the relevant section in Chapter 14.

IN THIS PART …

Introducing the General Data Protection Regulation

A quick overview of data protection laws — in the EU and around the world

Taking on your ten most important obligations

Learning what happens if you don’t comply

Determining when the GDPR applies and when it doesn’t

Reviewing the GDPR’s most notable changes

Understanding Data Protection Laws

Data protection laws exist to balance the rights of individuals to privacy and the ability of organizations to use data for the purposes of their business. Data protection laws provide important rights for data subjects and for the enforcement of such rights.

This list describes a handful of additional points about these laws to keep in mind. Data protection laws:

• Protect data subjects: A data subject is an individual whose personal data is collected, held, and/or processed.
• Apply to organizations that control the processing of personal data (known as data controllers) and also organizations that process personal data under the instructions of data controllers (known as data processors): These include companies (both private and public), charities (not-for-profit, political, and so on), and associations (such as churches, sports clubs, and professional leagues, to name only a few).
• Apply throughout the world. The concept of privacy originated in the United States in the 1890s. Although the EU has been a front-runner in establishing the laws protecting data and sees itself as setting the gold standard of data protections laws, the vast majority of countries around the world have some form of data protection laws.
• Do not prevent organizations from using personal data: Organizations can legitimately use personal data to their benefit as long as they comply with applicable data protection laws. Every organization is likely to process some personal data — of its clients, employees, suppliers, prospects, and so on.
• Prevent common misuses of personal data: Organizations often fail to (i) put in place appropriate measures to keep personal data secure, (ii) inform the data subject at the point of data collection about what it is intending to do with the personal data and where necessary to obtain consent, and (iii) transfer personal data to third parties without the knowledge of the data subject. Data protection laws generally prevent these common misuses.

Countries hold to varying degrees of regulation and enforcement and some countries don’t have any data protection laws. Table 1-1 rates the strength of various countries’ efforts to protect data.

The Ten Most Important Obligations of the GDPR

The obligations I refer to in this section’s heading are the ten most important actions you need to take to comply with the GDPR; I’ve only summarized these obligations in the following list because I discuss them further throughout this book:

• Prepare a data inventory to map your data flows so that you can understand exactly what personal data you’re processing and what you’re doing with it. (See Chapter 7 for more on this topic.)
• Work out the lawful grounds for processing each type of personal data for each purpose for which you’re processing it. (Chapter 3 has more on this topic.)
• Ensure that your data security strategy is robust and that you have implemented appropriate technical and organizational measures to ensure a level of security appropriate to the risk of a data breach or other security incident. (See Chapter 16 for more about data security.)
• Ensure that an appropriate safeguard is in place whenever you transfer personal data outside of the European Economic Area (EEA). (See Chapter 6 for more about transferring personal data.)
• Update your Privacy Notice to ensure that you’re being transparent about the means and purposes of your data-processing. (See Chapter 8 for more on Privacy Notices.)
• Update your Cookie Policy to ensure that you aren’t relying on implied consent, that browsers of your website are taking affirmative action to consent to non-essential cookies being used, and that the cookies are fired only after consent is obtained. (For more on the concept of implied consent as well as details about cookie policies, see Chapter 9.)
• Ensure that your staff are appropriately trained in relevant areas of the GDPR. (Chapter 18 has more on this topic and Chapter 24 has tips for training employees to help you maintain GDPR compliance.)
• Ensure that you have reviewed the grounds on which you process employee data, and issue a revised employee Privacy Notice where necessary. (See Chapter 18 for more on this topic.)
• Determine whether you need to appoint a Data Protection Officer (DPO). If you do, take the necessary steps to hire a suitable candidate. (See Chapter 15 for more on DPOs.)
• Review all of your processor and subprocessor arrangements and ensure that appropriate contracts are in place. Ensure that the data processors (and subprocessors) are compliant with the GDPR and that they have adequate security in place to protect the personal data. (See Chapter 5 for more on this topic. Chapter 10 covers data processor and subprocessor contracts.)

Facing the Consequences

Think of this section as a description of not only the consequences you face if you aren’t compliant but also the reasons you should care about being compliant.

Being a Market Leader

By embracing the GDPR and showing your customers, prospects, and employees that you care about the protection of their personal data, you gain a competitive advantage.

Elizabeth Denham, the UK information commissioner, summed up this idea nicely:

“Accountability encourages an upfront investment in privacy fundamentals, but it offers a payoff down the line, not just in better legal compliance, but a competitive edge. We believe there is a real opportunity for organisations to present themselves on the basis of how they respect the privacy of individuals and over time this can play more of a role in consumer choice.”