Do not assume GDPR does not apply to you

Customers and channel firms could be caught out if they dismiss GDPR talk as simply hype, claims CIF board member Ian Moyse

You may have heard the term GDPR (General Data Protection Regulation) and if not, you certainly will. As we approach 25 May 2018, when it becomes law, the noise around this regulation will grow.

Don't stop reading now as the acronym seems boring and not relevant to you, because it is. A new law will come into play across Europe - yes, the UK is included too, Brexit or no Brexit. This is not another year-2000 hype where there was no impact or pain. The impact is already happening and the pain will increase.

GDPR is a new law which from May 2018 requires any business that operates in the EU, or handles the personal data of people who reside in the EU, to implement a strong data protection policy to protect this client data. It is the EU's way of giving customers more power over their data and less power to the organisations that collect and use such data for monetary gain. Businesses that fail to meet the new standard will face fines of up to four per cent of global turnover or €20m,whichever is larger. Businesses that suffer from a data breach without having adequate measures in place will suffer the same.

See this not as a threat but as an opportunity to get your ship in shape and proudly state to customers that you have been on GDPR training and are taking action with processes to be a good and caring supplier. Consider putting a GDPR and 'how we care for your data' section on your website, alongside 'contact us' and 'about us'.

If you're not sure how GDPR will affect your business, now is the time to start paying attention. It's all about companies' legal liability to protect data they hold on staff, customers and anyone whose personal details are stored. The law will also apply to organisations based outside the EU that are active in the EU market and offer services to EU citizens.

So this encompasses cloud, on-premise, IOT and mobile, no matter where you store data, if it meets the criteria of personally identifiable and relevant information then you need to comply. Ignorance will not be an excuse and will in fact put you in a far worse position. It is better if you can demonstrate your diligence of action and how you have tried to mitigate any risk as a defence. It is good practice to be able to demonstrate that you have attended training, acted on the process recommended from it, and tried to do the right thing. You have a far better chance of being treated leniently and worked with, rather than against, should the worst happen.

A wealth of information and articles on GDPR are available, but they mostly quickly defer to complex, detailed information and do not give clear and plain guidance as to what it means and what needs to be done.

So let's make this simple. Every EU company or organisation that operates in the EU and that handles any personal data has to do something about ensuring their compliance. For example, do you have a CRM system with customer and prospect data in it? This will count. So there will be few organisations that do not need to comply.

For the channel, the question is, have you taken action yourselves and what duty of care are you showing to your customers to ensure they are aware and doing something about it?

To ensure GDPR compliance will involve education, process and, yes, some technologies.

As a channel player you need to become aware of and understand the implications of the new regulations. You need to help make your customers aware and educate them on the impact and requirements of the GDPR. You can then help advise them on best practice solutions to aid their compliance and mitigate the risk of their being caught out and having large fines imposed on them.

It is not simply about preventative security any longer; customers need to think about protection of data integrity and data destruction. The more you can mitigate, the more your regional data commissioner will be willing to work with you and protect you against the full weight of the fines that could be imposed.

The power is being put in the hands of the consumer - you hold their data and if you lose it, they will want retribution and the law will now support them to get it.

Data dilemma

Data breaches hit all-time record high in 2016 with an increase of 40 per cent over 2015. You may have already heard about some of the high-profile names that have experienced such breaches in recent times, such as Three Mobile, French naval defence contractor DCNS, Vodafone Germany, and Tesco Bank, and there will be more of these stories coming for sure.

Data protection laws are long due an overhaul. For example, most Data Protection Acts have not been revisited since the late 90s and the world has changed radically since then, with the internet, cloud, and mobile changing the volume of interactions and data exchanges taking place. Make sure you and your customers are covered.

Ian Moyse is a board member of the Cloud Industry Forum and FAST