The General Data Protection Regulation (GDPR) is the new privacy law that goes into effect on May 25, 2018. Every company that sends commercial email to the European Union must comply with it, even if you’re not located in the EU. The purpose of this law is to obtain consent before using a person’s personal data and to adequately protect it.
Protection by Design and Default
The GDPR requires that you take adequate precautions to protect the personal information entrusted to you. The law does not specify exactly what you must do protect this data beyond the requirement that you take the appropriate technical and organizational measures considering the cost, available technology, and why you are processing individuals’ data. The level of security should correlate to the level of risk related to the nature of the data and what you’re doing with it. Additionally, you should only process the necessary data to fulfill your purpose for doing so.
Another requirement of GDPR is that the people who have access to the data subjects’ information are only permitted to process it per the data controller’s instructions. This is a rule that every organization should have: only those who need access to the data subject’s information should have it, and it should be limited to only for the tasks for which they need it.
You can learn more about these requirements here:
Maintain a Records of Processing Activities
The GDPR requires certain companies to maintain a record of all their processing activities. These companies fall into one of two categories:
- Companies that employ 250 or more persons.
- Companies whose work with data subjects’ information presents a high risk to the data subjects’ rights, or the companies process data that falls into one of the following special categories:
- Racial or ethnic origin
- Political opinions
- Religious or philosophical beliefs
- Trade-union membership
- Genetic data
- Biometric data for the purpose of uniquely identifying a natural person
- Data concerning health
- Data concerning a natural person’s sex life or sexual orientation
As a company with no employees (just me running this show) and the only information people give me are their email address and name, I don’t have to maintain this record. If I did, it would only be a list of newsletters I sent and the service I use keeps my list protected behind a password.
If you want more information about GDPR, please watch this site and my YouTube channel because I’m creating a substantial amount of content on this topic. You can also send me an email (Note: I can’t give advice to non-clients). I use my mailing list to I share my thoughts about being a lawyer/entrepreneur, updates about projects I’m working on, upcoming speaking engagements, and I may provide information about products, services, and discounts. Please add yourself if you’re interested.
You can also connect with me on Twitter, Facebook, YouTube, or LinkedIn.