Who Needs To Register Gdp Ico

Unless y'all live on the moon, I'm sure you lot've heard of the European Union'due south General Data Protection Regulation. Unremarkably known every bit the GDPR, these regulations affect every business whether information technology is based in the European union or not – so you AND your clients need to comply with information technology. Here'south what you need to know about global data protection and how to stay compliant.

What is GDPR?

The General Information Protection Regulation (GDPR) is a legal framework that sets guidelines for the drove and processing of the personal information of individuals in the European Union (European union).

These guidelines were created to enable the EU to provide their citizens with more control over how their personal data was used as the quondam legislation was enacted before the Internet and cloud technology created new ways of exploiting data.

GDPR (which I'll refer to as EU GDPR from now on to make this post a little less confusing!) concerns the drove, storage and treatment of personal data flowing from the EU.

So if a product or service is offered to the Eu, and so the business organisation offering it has to comply with GDPR.

What is personal data?

The European Commission website defines personal data every bit: "any information that relates to an identified or identifiable living individual. Different pieces of information, which collected together, tin pb to the identification of a particular person, also constitute personal data.

Personal data that has been de-identified, encrypted or pseudonymised merely can be used to re-place a person remains personal information and falls within the scope of the GDPR."

Personal data can include:

Proper name and surname
Dwelling address
Date of nativity
Email address (although name.surname@company.com is considered personal data while info@visitor.com is non)
Telephone number
Number plate
IP address and website cookie identifier
Location data, for example, the location data function on a mobile phone
Identification number such every bit a passport, National Insurance No, social security No etc.

Anybody responsible for using personal information has to follow strict rules called 'data protection principles' and must make certain the data is:

– Used fairly, lawfully and transparently.
– Used for specified, explicit purposes.
– Used in a fashion that is adequate, relevant and limited to only what is necessary.
– Accurate and, where necessary, kept upwardly to date.
– Kept for no longer than is necessary.
– Handled in a way that ensures appropriate security, including protection against unlawful or unauthorised processing, access, loss, destruction or damage.

To be honest, the definition of personal information is non-exhaustive and also includes actually random things such as concrete advent and beliefs. It also depends on other factors such equally how the info is presented and whether it's used in combination with other data.

Because we're supposed to comply with regulations with, quite bluntly, sketchy criteria, I just ensure that:

All the personal data I obtain is gathered with the explicit permission of the individual involved.
I am transparent about what data I hold.
I proceed personal information only as long as it meets its purpose.
I store the data as securely as possible.

Recall you lot don't control or process EU data?

Lamentable doll, you probably exercise.

Do you lot or your clients have a website?
Do you or your clients accept a mailing list?
Do you lot have contacts on your phone?
Practise you or your clients employ a CRM organization?
Practice you or your clients have an e-mail address volume?

And then you command and/or process personal data and some of that is probable to belong to a person in the EU. Every bit data cannot be transferred to not-Eu countries unless they can offer the aforementioned level of information protection, you need to comply with EU GDPR.

Data Controllers and Data Processors

When reading about the handling of personal data you may come up across the terms Information Processors and Information Controllers.

As a Virtual Banana, yous are a Data Controller AND a Information Processor.

You're the Controller of whatever personal data you take collected from your clients and prospects. This is info from your website in the form of IP addresses, cookie identifiers and your contact class and directly in the grade of names, email addresses, physical addresses and phone numbers of clients, contacts or prospects.

Equally a Controller, you must collect and store personal data in a compliant mode and be able to explain how you're doing this if asked past your clients.

You're the Processor when you lot handle personal data held by your clients. You need to ensure the client has nerveless and is storing this data in a compliant mode because, equally the Processor, you lot may be liable if they haven't.

This is why you need a contract, a Data Processing Agreement and insurance!

Basically, you need to know the source of any personal data you have collected or are processing and how any data service providers (CRM and e-mail marketing platforms etc) are storing it on your behalf.

United kingdom of great britain and northern ireland GDPR (new as of 2021)

As information cannot be transferred to some other country outside the EU unless the receiving visitor guarantees the aforementioned degree of protection as the EU requires, postal service-Brexit, the provisions of EU GDPR have at present been incorporated direct into U.k. law as "UK GDPR".

In practice, in that location is little change to the cadre data protection principles, rights and obligations. They follow the same guidelines as Eu GDPR but simply go by a different proper name.

The but change that applies to you is that, depending on the location of you lot and your clients as well as the location of any personal information your client is asking you to process, you will need to reference UK GDPR and the Information Protection Act 2018 and/or European union GDPR in your Freelancer Agreement, Associate Contract, Data Processing Understanding (DPA) and website Privacy Policy.

However, if y'all buy my legal contracts or policies, all the hard work has been done for you. The options have been included in the template and you just keep the one/s you demand and delete any that do not employ.

All of these documents take been written past an international contracts lawyer called Janet Alexandersson and are updated and resent to buyers gratuitous of charge any fourth dimension the law changes. Janet is too in the VA Handbookers Facebook group to answer your legal questions.

Okay, let's cheque out the data protection requirements you need to adhere to depending on where you lot and your clients practice business.

I'g a Great britain VA and/or I have Britain clients

If you operate inside the UK or are Simply processing Uk data, you need to comply with and reference UK GDPR (which currently mirrors Eu GDRP in all the ways that matter) and the Data Protection Act 2018.

If your client is request y'all to process data that may contain EU data (which, is highly likely) then you also need to reference EU GDPR.

I'm an Eu VA and/or I have EU clients

If y'all operate within the EU or are processing European union data (which, as mentioned we about likely all are), you need to comply with and reference EU GDPR.

I'm not in the Eu and nor are my clients

Because EU information protection laws extend to all foreign companies processing the data of Eu residents, GDPR volition affect you even if you don't live in the EU.

So even if you're in a non-Eu country and none of your clients is in the Eu, you lot still need to be aware of and comply with GDPR considering:

Your client could physically motility to the European union or move the registration of their company to the European union.
You might accept on an European union client.
Your customer may have on an European union client or client and yous may process their personal data.
Someone in the EU might sign up for your newsletter.
Someone in the European union might sign upward for a client'due south newsletter and you may process their personal information.
Someone in the EU might join a client's membership group that you help manage.
Someone in the EU might visit your website or your customer's website.

Considering IP addresses count as personal data, GDPR applies regardless of where the website is based and must exist heeded by all sites that attract European visitors fifty-fifty if they don't specifically market appurtenances or services to European union residents.

And so, unless you or your clients are going to restrict the access of every European union IP address, you need to comply with EU GDPR.

How information protection affects your role every bit a VA

Data protection affects Virtual Administration in a number of ways considering they undertake many tasks for many people and they process data obtained from many locations. Hither are some of the fundamental areas to be aware of:

Information collection and storage

GDPR requires businesses to have a defined purpose for data drove which should ever be supported by a "legal ground". The legal basis can exist a contractual obligation, legitimate interest for storing and using information, or that explicit consent has been given.

Every bit a business concern owner, you lot must assemble and shop personal data in a compliant manner.

Drove – basically, the personal data must take been given consensually or for the purpose of doing business together and the owner should be able to obtain, correct, erase and object to the processing of their personal information.

Storage – if you use a professional person platform to shop data (such as a CRM, Gmail, Outlook, MailChimp etc) then information technology should already support the collection, direction and processing of personal information in a secure way.

When it comes to data that you are property on your own devices you need to ensure that it is held equally securely as possible. It's a good idea to encrypt, pseudonymize, or anonymize personal information wherever possible.

Website

To comply with the regulations governing cookies under the GDPR and the ePrivacy Directive yous must:

– Receive users' consent before you use any cookies except strictly necessary cookies.
– Provide accurate and specific information about the information each cookie tracks and its purpose in obviously language before consent is received.
– Certificate and store consent received from users.
– Allow users to access your service even if they refuse to permit the use of certain cookies
– Brand it as easy for users to withdraw their consent every bit it was for them to give their consent in the showtime place.

So in order to meet the "legal ground" criteria mentioned above, you should add one of those (really annoying tbh) cookie consent notifications to your site. A WordPress plugin such as Cookiebot should practice the chore.

Yous also need to reference the website user's data protection rights in your website Privacy Policy and tell them what personal information you are collecting, your reason for collecting it and how long it is being stored.

All of this info is in the Website Policies Packet that I sell.

Contracts

Depending on your location, the location of your clients and the location of the people whose data you are processing, you need to reference the appropriate data protection laws in your Freelancer Agreement, Data Processing Agreement (DPA), Associate Understanding and Website Policies.

As mentioned, if you buy my legal contracts or policies, all the hard piece of work has been washed for you. The options take been included in the contract templates and you merely go along the one/southward you need and delete any that exercise non apply.

Email marketing

I of the biggest areas of information protection is around email marketing because subscribers have to actively give their consent to exist added to a mailing list and they must exist able to easily unsubscribe.

This is important to know considering, if you send out emails for a customer and they had added someone to their mailing listing without permission, as the Data Processor it's you and not your client who will be prosecuted if someone complains.

This is why your clients should sign a Data Processing Agreement (DPA).

A DPA is required for GDPR compliance and basically confirms that the Information Controller (your client) has obtained permission to collect personal data and is storing that data securely.

Information technology also indemnifies the Data Processor (you) of all claims and actions by anyone who has non consented for their data to be used or any repercussions if your client has non obtained, stored or is using that personal data in a GDPR-compliant style.

If you're not sure if your client has gathered emails for their mailing list in compliance with GDPR then inquire them how they obtained them.

Here are some practical examples of compliant and non-compliant mailing lists from Mailchimpbut basically, someone needs to have actively given their permission to exist added to the list. This is why double-opt-ins are recommended.

If y'all're thinking of adding newsletter creation and/or management to your services, my newsletter course covers GDPR and compliance so you don't fall foul of the law.

The Information Commissioners Office (ICO)

The ICO is the United kingdom'southward independent torso set upward to uphold information rights and they have a lot of in-depth GDPR information and resources on their website.

Unless exempt, every UK system or sole trader who processes personal information has to pay an annual data protection fee to the ICO.

This fee was £40 for VAs equally of August 2021.

If you're a UK VA, the ICO should be your main source of data and I highly recommend subscribing to their newsletter for updates so you don't miss any changes.

You tin can utilise the ICO'south free online checklist to better your understanding of data protection and to notice out what y'all demand to practice to make sure you're keeping personal data secure. A short report with suggested deportment is provided at the end.

What happens if you or your customer experiences a data alienation?

In this 15 minute interview with international contracts lawyer Janet Alexandersson, I ask what a information breach is, how information technology might happen and what yous should practice if you experience one.

Although information technology could be you lot who experiences the information breach, a client might besides enquire you lot to accept care of the admin side of things if they experience 1 themselves. So it pays to exist prepared and know what to exercise.

The video covers

What is (and isn't) a data breach
Why a data breach isn't just about being hacked
Which data breaches need to be reported – and which ones don't
What to practice if your password managing platform is hacked
What y'all need to study and how much time you have to written report it
Why you could be in problem if you don't report a data breach
Why someone's electronic mail address is worth thousands of pounds
How to prevent a data breach

This is how to report a breach to the ICO. You tin can discover an editable Data Alienation Notification template on the legal docs sales folio that I link to beneath.

Summary

I won't prevarication, GDPR is a purple pain in the backside, but information technology has to be understood and adhered to if you're going to run a business organisation.

The adept news is that not simply will your ain data be more secure, the more than you know about the new regulations, the more than info you lot'll be able to give your clients.

Hither is a handy GDPR checklist for Data Controllers. I would run your own concern through information technology first and then show it to your clients to help ensure they are as well in compliance.

You volition salve them a headache (and possibly a fine) in the long run and create more than work for yourself (such equally helping them update their website and clean their data lists) in the process.

* This mail was concluding updated in August 2021.

Got your legal documents sorted?

Whether it's a Freelancer Agreement a DPA, a data alienation notification template or website policies, you need the legal stuff and then you lot don't become sued or screwed.

GDPR compliant and written by an international contracts lawyer specifically for VAs, docs are too updated and resent to buyers free of accuse any time the law changes.

Discover OUT More

Source: https://www.thevahandbook.com/va-data-protection/

Posted by: harrisonmandell53.blogspot.com