Data protection laws have become incredibly tight, particularly since the introduction of GDPR in 2018. For small businesses, it’s a huge mistake to neglect these laws. It’s worryingly easy to be in breach of data protection policies, so it’s very important that you implement a data policy for your business. While you should always seek advice from an appropriate party such as a lawyer or business advisor, you can set the foundations in place using a few simple steps. Here’s a short and simple guide to help you get started with formulating your business’s data policy.
Get Clued Up
Before starting any of the groundwork for your data policy, we’d recommend doing some research. Study the legislation. This includes the UK GDPR, the Data Protection Act 2018 and the PECR. This will inform you about how you should handle, collect and store data properly. Failure to comply with these laws can result in enormous fines, so please do take the time to read and understand these policies.
Register With The Information Commissioner
The Information Commissioner, or ICO, is set up to protect personal data. If your business handles any personal data, you’ll need to register with them. This includes customer data as well as employee data, such as registering them with payroll. Pretty much every business will handle personal data in some format. Whether that be your customer’s name, contact details or anything else, if you’re handling, storing or using that data in any way, you need to be registered with the ICO.
Registration costs around £40 per year for a typical small business. The fees do rise in line with the size of your business and its turnover, so you may have to pay a little more than that if you’re larger in size. You’ll get a certificate to prove you’re registered and your business’s information will also be available on the ICO’s website for anyone to view. Registering doesn’t provide you with legal protection or coverage, but it does reassure customers that you are managing their data responsibly.
Set Up Secure Data Storage
You should be storing your customer’s data securely. This means that any digital systems should be password protected, preferably with two-factor authentication (2FA), with access only given to approved parties. If possible, the data should be encrypted, so that if there were a security breach it is less likely that the data can be leaked. If the data you hold for your clients could cause them harm (such as financial or health-related data), it’s much more important to consider encryption.
If you’re holding data in a physical format, it should be locked away securely. As with digital data, only authorised individuals should be able to access these files.
Data Deletion
Each company can set up their own policy for how long they want to store customer data for. The guidelines only dictate that you cannot store data for any longer than reasonably necessary. As long as you can justify the reasoning behind your retention policy, it should be fine. However, if a customer requests that you delete any data that pertains to them, you must comply. This is called their ‘right to erasure’, and is detailed as one of the key rights under GDPR law.
Any data which you are removing from your systems needs to be destroyed securely. For digital data, the files need to be deleted and overwritten – you can use software to do this if you’re going to be getting through a lot of data. Physical files should be shredded, incinerated or destroyed beyond recognition.
The only exception to this would be if the data were pertaining to tax records, anti-fraud measures or something else which might be legally required to be retained.
Obtaining Consent
The laws state that explicit consent needs to be sought from your customers for you to collect their data. This means that you can’t force or coerce them into agreeing to your policy, the consent must be freely given. You should also have a clear and easy to understand privacy policy available. This privacy policy should inform your customers about how their data will be used.
Get Help
Once you’ve got the basics in place, it’s time to get some extra help to ensure your small business’s data policy is compliant. The ICO can help by offering guidance, templates and self-assessment tools. We would also recommend consulting with a legal advisor to ensure your policies are watertight. Remember, staying compliant not only protects your business from fines and legal action, it also helps you to build trust with your customers and safeguard your reputation.
Written by Alice Farley
