How will GDPR impact your eCommerce business?

By now you have most likely been seeing references to GDPR all over your social media timelines. If you own a business that offers products or services through an eCommerce site you should be aware of what GDPR is and how it will impact how you conduct business with your customers in the EU.

What exactly is GDPR?
General Data Protection Regulation is a data protection law which was passed back in 2016 and derives from the 1995 Data Protection Directive focused on protecting the personal data of EU citizens and residents.

With recent events such as the Equifax breach and Facebook’s cambridge incident, the information being collected about us involuntarily is disturbing, especially when you find out that hackers now have your information that you did not give explicit consent to being collected.

The deadline for compliance is May 25, 2018, I am not sure if it is a strict deadline but your organization should be able to demonstrate steps are being taken to at least meet compliance.

Consequences
Currently the penalty for GDPR compliance is up to 4% of your organization’s global turnover or $20 million whichever is more.

What is your organization's responsibility?
Ignorance of the law is never an excuse, this information is not legal advice, the best advice I will give you is to contact a lawyer for guidance on what your organization should be doing to meet compliance.

Your business is defined as a data controller, your hosting company would be defined as a data processor.

A part of your organization's due diligence would be to reach out to your email marketing vendor, shopping cart vendor and email hosting company to find out what actions have been taken to make sure that the services you are utilizing meets compliance. Also check out each vendor's website maybe they have a section dedicated to GDPR specifically or updated their privacy policy.  

Steps your organization can take for compliance

1. Review HOW data is being stored and WHERE data is being stored
   
   1. Review all assets within the company to find out where PII (personal identifiable information) such as customer emails, address, phone number, usernames are being stored. Your organization should be able to account for everywhere information is being stored along with the business justification and length of time of storage.
      
2. Update Privacy Policy
   
   1. Be sure to review your organization’s Privacy Policy to address GDPR compliance.
      
3. Be Transparent
   
   1. Be completely honest with your customers on what information is being collected when visiting your website (IP address, cookies, name, address, etc.).
      
   2. How and where personal information is being processed (Marketing, Sales, Billing, etc.).
      
   3. Explicitly state where customers can reach out to your organization to submit a request to access their personal data stored and/or request removal. Make sure your employees are properly trained on how to handle removal requests.
      
4. Consent
   
   1. Customers should be giving explicit consent to any web forms on your website. No more pre-checked boxes agreeing to subscribing to emails, agreeing to terms and services, or use of cookies. Any current opt-in options on your site should be removed or simply unchecked by default.
      
5. Create a data breach plan
   
   1. Have a plan if your site is compromised and personal information is leaked. Know the laws of your state and the EU for disclosing data breaches.
      

General Tips

• Contact a lawyer for legal advice for your organization meeting GDPR compliance.
  
• Abandoned cart emails should only be sent if the customer explicitly checks a box giving your website permission to remind them of their shopping cart.
  
• Have a process in place on how to remove customer information if they request ‘to be forgotten’. You have 30 days to reply to customers requesting their information to be removed.
  
• GDPR requires all data breaches to be reported within 72 hours.
  
• Check your web hosting provider's website for GDPR compliant modules (Wordpress, Opencart, etc.).
  
• Only collect information your organization needs, nothing more, nothing less including backups.
  
• Review any contracts you have with third parties, check for privacy notices, and GDPR information.
  
• Seek legal advice on whether your organization needs a Data Protection Officer.
  
• If your website is geared towards kids, be sure to review the laws of consent for storing personal information for kids.
  

Helpful Links
Guide to the General Data Protection Regulation (GDPR)
General Data Protection Guide
Data Protection in the EU