Overview of the GDPR Policy for a online retail business

In 25^th of May,2018 the European Union introduced the newsest data privacy law, i.e the General Data Protection Regulation-came into the picture. GDPR sets a new bar for privacy at the most exstensive law in the world. The companies which gathers and handles European cutomers’ personal data will be heavily impacted.Retail industry and companies planning to sell to European customers in the EU or EEA, have to ensure their policies are GDPR compliant.

3 types of groups affected by the new law:

Data subject - Client,user,employee- anybody located in the EU providing the mentioned personal data.

Data controller- Retail & e-commerce companies collecting,managing,using  or storing any personal data.

Data processor-  Third party services providing ecommerce,marketing & shipping to those retail companies that process the only the data. Companies like DHL,Shopify & ERP systems etc.

GDPR’s impact on Retail industry

     The list of things which you need to do to ensure your company comply with GDPR law:
·       Make your consent instructions clear & actionable.
·       Complete a Privacy Impact Assessment(PIA), as mandated by the GDPR.
·       Decide what data from EU you need to store & ensure that you have the proper premissions.
·       Revise your website’s privacy policy to comply with GDPR & notify your existing customers to accept your new policy.
·       Decide the process & functionality needs to be established to comply with customer’s new rights to access,correct,delete & export their data.
If the retailer asks the customer to create an account, later customer can ask the company to delete their account,purchase history and actions for which the retailer is entirely responsible. The “right to be forgotten” process must be easily navigable,docsumented & clearly advertised for any customers who wish to delete their personal data.

Key points of GDPR for Retailers

GDPR law gives more rights to the people over their personal data. It gives your client or user the right to access,corretc,delete & restrict the data collection & storage.Personal information like IP addresses,location & behavioural data needs to be masked & shouldn’t be shared with third party without customer’s consent.

GDPR does not outperform other laws. For example, if you have to keep personal data to prove the VAT charges, this needs to be kept for tax compliance. The rule in England & Ireland is 7 years. This may vary depends upon the countries.

1.      Recruit a staff member to look after the Data protection policy. Make sure your  employee has completed data protection training  & certified for that.

2.      Specify the contact details of DPO(Data Protection Officer) in your organistaion & inform the cutomer how to lodge a data subject access request.

3.      Using phrases like “we may use your information”  is not acceptable  as it’s not precise. Permisiion must be straight-forward & recorded.

4.      Data breaches must be recorded & necessary action needs to be taken with a preventive measure within 72 hours.

This applies for small businesses too, the data protection commisioner officer may not audit your company now. But they can do that at any tike Iin the future and failure to abide all the above points are unlawful.

Author: Mahindan Uthayakumar

Keywords

#GDPR Policy

#Data protection

#Online business

#Retail industry

#Customer data

Reference

Flow. 2021. How to Make Your European Ecommerce Business GDPR Compliant | Flow [online]  Available at: <https://www.flow.io/blog/how-to-make-your-european-ecommerce-business-gdpr-compliant/> [Accessed 20 March 2021].

Willows consulting. 2021. GDPR for eCommerce | Willow consulting [online]  Available at: <https://www.willows-consulting.com/gdpr-for-ecommerce/> [Accessed 20 March 2021].

Image reference: The Conversation, The Guardian.