Starting a business will take you on a long, arduous journey. It’s not as quick and simple as creating a plan and launching operations. You need to follow a set of rules, regulations, and pay a fair amount for permits and licenses. The process is blessedly fast in most cases, and everything is digitalized. However, the challenges don’t end at the grand opening of your business.
Once you’re up and running, you’d be subject to different laws. One of the most complex laws to follow is the General Data Protection Regulation law, or simply GDPR.
As businesses run on data now, the European Union has regulated data collection, security, and privacy. This ensures that no business will exploit data and break the trust of internet users. How exactly does this law work, and how will your startup avoid violating it?
Understanding GDPR
GPDR was enacted into law on May 25, 2018. Six months into its enactment, many companies either struggled to follow it or knowingly violated it. A survey in that period had found that only 56 percent of companies were fully compliant with it, and 19 percent said they would never be compliant.
As the toughest data security and privacy law in the world, it can indeed be tricky to abide by the GDPR. But now that almost four years have passed since its passing, all startups with a website must be compliant with it. The EU might have passed this law, but it doesn’t mean US-based businesses get a free pass. The regulation applies regardless of where a website is based. If people in the EU can access your website, you must follow the GDPR.
What Happens if You Don’t Comply?
Violating the GDPR can subject you to hefty fines and penalties. The EU has set fines of up to 10 million euros, which is more than $11 million. Violators may also pay 2% of their entire global turnover for the preceding fiscal year. The higher of the two is the automatic penalty.
Ways to Comply with the GDPR
Don’t feel intimidated or limited by this law. Chances are you already encounter it every day. When you visit a website, don’t you notice a small pop-up at the bottom of the screen, asking your permission to collect cookies? That’s the website following the GDPR. They are required to disclose information about collecting cookies, which you may not allow if you don’t want to.
That said, here are four ways your startup can abide by the GDPR:
1. Investigate the Data You Hold
If you use any website for business purposes, conduct a thorough investigation on the data it holds. Identify where it’s stored, and whether it’s personal or sensitive. Study also how the data is processed and who can access it. Then document your findings with as much detail as possible.
This is the minimum level of data record-keeping. You can use it to prove your compliance should a regulator check on your startup.
2. Issue a Software-as-a-Service (SaaS) Agreement to Customers
If your business is providing cloud services to other companies, seek out a reputable SaaS agency. They’ll help create a SaaS agreement, a document that lays out a software’s terms and conditions.
SaaS might be more user-friendly than Infrastructure-as-a-Service (IaaS) software. That’s because your customers can access and use SaaS without installing software or providing additional tech infrastructure. On the other hand, IaaS requires the user to install the software before it can be used. It’s dynamic and flexible, but not as convenient and cost-efficient as SaaS.
3. Have an Article 27 Representative
Per Article 27 of the GDPR, businesses outside the EU must appoint a representative whom the GDPR regulators can contact. That is if your business has customers in the EU. If not, you can skip this.
4. Ask for Users’ Consent Before Collecting their Data
This must be the most basic step in complying with the GDPR. As pointed out previously, websites always ask for your consent now before collecting your data. Do this on your own website or app, too. Not only that, but ensure that users can also choose what kind of data they wish to provide or keep to themselves.
Your website’s users can do this through the “Manage my Preferences” button on the pop-up. Your site visitors should be able to see that and choose whether to allow or not to allow your site to collect certain data.
Even if you’re not serving customers from the EU, don’t commit noncompliance with the GDPR. Take note of the hefty fines you might pay as a consequence. Also, internet users are a lot more conscious now. They wonder what is being done to their data on the internet. Hence, compliance with the GDPR can allow you to be more transparent. The permission you ask gives your customers a sense of security and relief.
