How Have You Managed GDPR?

[WebMarkets]

It seems like GDPR was a whole lot of hype, but fizzled away quite quickly. I know of the penalties and much depends on audience traffic. Which even for the most local of local sites, can easily obtain Euro traffic. Just curious to know the experience of others.

[effectdigital]

We actually found that, whilst it require strict management in terms of file transfers, GDPR wasn't as scary as everyone said it would be

One thing we did was to sign up for Wizuda, a GDPR compliant file-transfer system (previously we just sent stuff to clients through Dropbox links, Sync.com links or WeTransfer links). It's important to note that a compliant file transfer system, doesn't 'make' all your file transfers GDPR compliant. It provides a platform which records certain info and erases files past a certain date, thus 'enabling' you to be GDPR compliant (but not necessitating that your actions will make it so)

We also asked clients whom wanted to transfer data to us, to sign up to it and to send a covering note (through Wizuda mail) on every single file which they fired through to us. If they don't include the note we delete the file and reject the transfer

The note they must send to us goes something like this:

• https://d.pr/i/tIhQBK.png (screenshot from Wizuda Mail - redacted)

We also initially got a lot of pressure whereby, our Account Managers were going directly to analysts (whom were, at the time - managing GDPR transfers) and trying to 'push through stuff that the client just wanted' without the client having properly proven - that they owned the data and had the 'right' to transfer it to us for marketing activities. Needless to say we immediately clamped down on that with full force, by creating an interactive (digital or printable) 'fillable' PDF form which AMs 'have' to get filled in (by the client) before we accept ANY inbound data which contains any PID

• https://d.pr/i/1nkG5F.png (PDF screenshot - redacted)

Since only Account Managers have a relationship with a client and can tell them 'no you do not have permission to legally do this, and we will not support you with illegal data transfers' - it made sense to unburden those 'physically' transferring the data and leave it up to higher level AMs / ADs and clients to sort out between themselves

We have now adopted more advanced approaches but all this stuff was an integral stop-gap

This all prevented two things:

1) Us transferring data which was not GDPR compliant to clients

2) Clients being able to get us to 'work on' illegally transferred data, which would make us an accessory to their malpractice

Some think we went crazy and went way too far, but I'm pleased that we're taking more steps every day to ensure full GDPR compliance. That being said even our initial steps were really strong

The truth is, no one knows whose practices are / are not safe. Most of this GDPR stuff hasn't worked its way through the courts yet - and until that happens, whose to say which approach is most compliant? I think we're doing well, though

At the beginning we were quite scared that our email marketing would die off. But actually that's not the case! It just has much less churn than before. To be honest, the people whom were targeted before GDPR came into play, who may have not given explicit permissions for our client(s) to share their data, were the group who never really converted anyway. The people who signed up to be contacted, whom demonstrated their interest, supplied far more of our client(s) conversions. So in a way it was kind of irrelevant, just meant we spent less of firing out emails in the first place. Most ethical, strong-performing email marketing is re-targeting and usually users have to interact and give consent for that to happen anyway (subscribe to our newsletter, etc.)