Keep data flowing – check the rules
As the uK enters its new relationship with the eu, is your business ready?
if you receive personal data from the EU for business use, you need to act now to ensure you comply with new data protection requirements that may come into force on January 1.
Whether you receive details for payroll admin, or customers’ email addresses, you’ll find a host of helpful tools and information on the icO (information commissioner’s Office) website.
“We realise many companies won’t know data protection law in detail, and it might seem a bit daunting,” says the icO’s Steve Wood. “this is why we’ve produced guidance aimed at SMEs.
“Businesses that receive personal data from the EU may need to make changes by the end of the year if they want to keep receiving that information lawfully. therefore it’s important to start preparing now.”
the best way to prepare is to ensure you comply with the General Data Protection regulation. “GDPr asks businesses to be accountable for the personal data they hold and process,” explains Steve. “Knowing what information you have, and operating effective storage systems for retaining or deleting personal data, make good business sense, and will show customers you’re taking care of their data. Further changes may be needed depending on what is agreed between the UK and the EU.”
One business owner who has already made plans is Alex Stewart, founder of eco-conscious travel goods company OneNine5. “Germany is our second biggest market outside the UK, and we hold data from EU countries when we ship orders and when we ask people to sign up to our newsletters,” says Alex. “So we’ll take an extra step to make sure we’re EU compliant – we don’t want to fall short.”
Steve agrees it’s wise for SMEs like OneNine5 to take action now. “you may need to get in touch with your partner in the EU to agree on additional steps to protect personal data,” he says. “Again, the icO’s guidance talks through measures you may need to take, such as putting a standard contractual clause (Scc) in place.”
An Scc is a set of terms and conditions that the sender and receiver of personal data sign up to, which offers protection under GDPr for both parties. Find more at ico.org.uk.