GDPR essentials

Three quick questions so we only ask what's relevant to you. These aren't scored.

1. Do any outside companies handle personal data for you? For example a payroll bureau, accountant, cloud CRM, email marketing tool or IT provider.
2. Do you send marketing emails, texts or newsletters to customers or prospects?
3. Do you employ staff (including part-time or seasonal staff)?

People have a right to know what you do with their data and to ask for a copy of it.

1. Do you have a privacy notice that tells customers (and anyone else whose data you hold) what you collect, why, who you share it with and how long you keep it? Knock-out Owner or data protection lead
2. When did you last review your privacy notice? Data protection lead
3. If someone asks for a copy of their data, or asks you to correct or delete it, do you know what to do and who handles it? Office manager

From the help text

Being open with people is a core GDPR duty. 'Yes' means an up-to-date notice on your website and available wherever you collect data, in plain language.

GDPR expects security that fits the risk. For most small businesses that means solid basics done consistently.

1. Where is customer and staff personal data kept? Tick all that apply. Owner or IT provider
2. Can people only see the personal data they need for their job, each using their own login? IT provider
3. Is multi-factor authentication (a code or app prompt as well as a password) switched on for email and your main business systems? IT provider
4. Are laptops, phones and any portable drives that hold business data encrypted and protected with a PIN or password? IT provider
5. Is important data backed up regularly, with at least one copy kept separate from your main systems? IT provider

From the help text

Data spread across personal phones, USB sticks and unlocked drawers is hard to protect. We're looking for business systems with proper access control.

Breaches happen to careful businesses too. What matters is spotting them and acting quickly.

1. Do you have a written plan for a data breach, including how you'd decide whether to report it to the Data Protection Commission within 72 hours? Knock-out Owner or data protection lead
2. Do you keep an internal log of every breach or near miss, even ones you decided not to report? Data protection lead
3. Would your team know to report a misdirected email, lost phone or suspicious login straight away? Manager

From the help text

A breach that poses a risk to people must be notified to the DPC within 72 hours of becoming aware of it, and people must be told if the risk is high. 'Yes' means a short plan naming who decides and how.

When another company handles personal data for you, you're still responsible for choosing them well and having the right contract.

Asked only if you answer “Yes” to: Do any outside companies handle personal data for you? For example a payroll bureau, accountant, cloud CRM, email marketing tool or IT provider.

1. Do you have a list of the suppliers who handle personal data for you? Office manager
2. Do you have a data processing agreement (DPA) in place with each of those suppliers? Owner
3. Do any of your suppliers store or access personal data outside the EU/EEA? IT provider

From the help text

Payroll, accounting, cloud software, IT support and email tools all count. 'Yes' means you could name them all and what data each one handles.

Emails and texts to customers are covered by the ePrivacy rules as well as GDPR.

Asked only if you answer “Yes” to: Do you send marketing emails, texts or newsletters to customers or prospects?

1. Does everyone on your marketing lists either opt in, or fall under the narrow exception for your own existing customers? Marketing lead
2. Does every marketing email or text include a simple, free way to unsubscribe, and are opt-outs acted on promptly? Marketing lead
3. Can you show when and how each person on your list gave permission? Marketing lead

From the help text

Electronic marketing generally needs prior consent. There's a limited exception for your existing customers about similar products, as long as they were given an easy chance to opt out. Bought-in lists are a common problem.

Good data protection is mostly about people knowing what to do, and someone keeping an eye on it.

Asked only if you answer “Yes” to: Do you employ staff (including part-time or seasonal staff)?

1. Is there a named person responsible for data protection day to day? Owner
2. Have staff had data protection training in the last year, including new starters? Manager
3. When someone leaves, is their access to email and systems removed on their last day? Manager or IT provider
4. Do staff get a privacy notice explaining how you use their personal data (payroll, HR records, any monitoring or CCTV)? HR lead
5. I confirm these answers are accurate to the best of my knowledge and that we'll act on the gaps identified. Owner or director

From the help text

Most small businesses don't need a formal Data Protection Officer, but someone needs to own it. 'Yes' means staff know who to go to with questions.