11 myths about GDPR

At the end of the day, there has been a two year grace period for businesses to get their act together, and the ICO will be enforcing the legislation from the 25th May 2018. 

So whilst a small infraction may be something you can work with the ICO to resolve, don't expect them to go lightly on you should something bigger arise.

3. GDPR only affects businesses in Europe

Fortunately for European consumers, the majority of firms that wish to provide goods or services to Europeans will need to comply with GDPR. 

This is the case regardless of where a company is based and where the personal data of their European customers is stored.

4. Brexit means UK firms don't need to worry about GDPR

For the moment the UK is bound by GDPR legislation as it will come into force before the UK leaves the EU. But, that doesn't mean GDPR will disappear when the UK eventually leaves.

The UK government have aired their commitment to maintaining strong links with Europe when it comes to data. 

Services is one of the UK's largest sectors, and depends for much of its work on the collection and analysis of data. 

If the UK wants to continue providing services as well as goods to Europe, it will need to maintain legislation very similar to GDPR.

5. GDPR only applies to data customers give me

GDPR applies to any personally identifiable information, whether given to you by a customer or individual, or collected without their explicit consent. 

For example, if you're collecting data through advertising or website analytics and you're not anonymising it – perhaps you're recording the customer's IP internet address – then you are capturing data covered by GDPR. 

It's worth remembering that GDPR applies to any personal information you collect about individuals, whether customers, employees or anyone else.

6. You must have consent to process personal data

This myth has grown from the media's fixation on how recording consent is changing with GDPR. 

For example, businesses can no longer use an opt-out policy when it comes to consent – such as a pre-ticked box on a website form.

But this is simply about improving the basis businesses have for consent.

This does not mean that securing explicit consent from customers is the ultimate goal for businesses.

Consent only matters if your basis for using customer data is built on consent.

There are a number of other ways you can lawfully justify the use of customer data that do not require explicit consent from a customer. 

The legislation lists six principles of lawfulness, which we've looked at here, all of which can provide a basis for legitimately processing customer information.

7. You don't need consent to process personal data

A complete contrast to the myth above, but some people seem to think that the concept of 'legitimate interest' in the GDPR framework means that they do not need to get customer consent in order to process their data.

But as with the 'you must have consent' myth, it's actually partially right.

Legitimate interest allows businesses to lawfully process personal data where there is a need by the business to do so for either legal, contractual or public interest reasons. 

If your use of personal data does not fit the requirements for Legitimate Interest, you should be using one of the other six principles as the basis for your data use.

8. You must get 'double opt-in' from customers for email newsletter signups

If you don't already know, a double opt-in is when you sign up for something and you're then asked to confirm this subscription. 

For example, if you sign up to receive news alerts via email from a website, a double opt-in will mean you receive an email asking you to confirm your subscription.

Under GDPR, this is not a requirement. 

A number of websites and commentators have said that double opt-in is required to satisfy GDPR's need for proven explicit consent. 

But this is not the case. 

So long as you can show that a user had to opt-in when they first submit (or you record) their data, and that the wording of the opt-in is clear and accurate, you should be fine.

On a side note, there are lots of good reasons to use a double opt-in anyway: it can stop spam; users who complete the double opt-in are often more likely to convert into a sale.

9. Everyone needs a Data Protection Officer

The good news for small businesses is that not every business requires a Data Protection Officer. 

You will only be required to appoint a Data Protection Officer if you are a public authority; you engage in large scale systematic monitoring of customers and individuals; or your organisation processes a large volume of sensitive personal data about individuals or customers.

10. The biggest threat to businesses is huge fines from GDPR

Despite some of the scaremongering headlines, the point of GDPR is not to fine companies: it is to protect citizens of the EU.

Yes, fines handed out by the ICO, currently limited to £500k, under GDPR could reach a limit of €20million or 4% of a firm's turnover. 

But the history of the ICO, and their various statements, suggest they are not out to fine companies, let alone for small infringements as some news stories have claimed.

Now, you might think that this is exactly the sort of thing the ICO would say. 

But if we look at the ICO's track record, we can get some context. In the 2016/17 financial year the ICO concluded over 17,000 cases. 

Only 16 resulted in fines.