Although we tend to talk about the GDPR as a closed issue, we were surprised to learn that one year after its implementation, two-thirds of companies were still not in compliance with the new law[1]<\/a><\/strong>. It’s huge! So I guess the subject is far from being closed…<\/p>\n If you are in this situation, the rest of this article tells you the different steps you need to take to make sure you comply with this law.<\/p>\n \u00a0<\/p>\n The first step on the road to GDPR compliance is to understand how personal data is stored, processed, shared, and used within your enterprise. Identify the existing personal data processing practices, those responsible for them, the current security levels, and the changes required.<\/p>\n Know that GDPR obligations do not apply only to your enterprise but also extend to your suppliers who process personal data on your behalf.<\/p>\n \u00a0<\/p>\n Your enterprise must be able to prove compliance with the GDPR at any point in time. To that end, you must keep a register of data processing activities, which replaces the mandatory declaration to the CNIL<\/a><\/strong>. This register should include all operations performed on personal data related to the following processes: collection, storage, use, sharing, or destruction. You must ensure, at all times, that the processes in place are compliant, secure, and that they guarantee data confidentiality. \u00a0<\/p>\n As soon as a processing activity that may infringe privacy is detected, you must conduct a privacy impact assessment. These assessments must also be documented.\u00a0<\/p>\n \u00a0<\/p>\n The implementation of the GDPR is a good time for you to rework your database and keep it healthy over time. It is important for you and your customers that you keep only relevant information. That’s why you should regularly clean your database and make sure you don’t keep inactive contacts or irrelevant information in it.<\/p>\n Besides, if you have sensitive customer data, a regular review of access within your organization may be a good practice to ensure that only those employees who need it have access.<\/p>\n It is also a good idea to take all your information-gathering tools and adapt them to the legislation. Ask yourself if the information requested in your different forms is necessary for your organization in your different marketing targeting actions.<\/p>\n \u00a0<\/p>\n Such an appointment is mandatory only for public sector organizations and companies processing sensitive data and\/or data on a large scale. However, having recourse to one is highly recommended for other enterprises also. \u00a0<\/p>\n This person must be involved in matters relating to the protection of personal data. The data protection officer\u2019s main duties are to ensure compliance, to advise the controller on its application, and to act as a contact person with supervisory authorities. He or she may also be responsible for notifying the CNIL and the people concerned in case of violation of privacy, within a maximum of 72 hours.\u00a0<\/p>\n \u00a0<\/p>\n The principle of privacy by design<\/em> aims at building privacy protection upfront when developing a new product, service, or application.<\/p>\n The principle of privacy by default<\/em> means that once a product, service, or application has been released, the highest possible level of data protection should be guaranteed by the enterprise by default. Also, the amount of personal data collected should be strictly limited to that which is necessary for the optimal use of the product, service, or application. \u00a0<\/p>\n \u00a0<\/p>\n The GDPR guarantees your customers new rights to access their data. You must be able to respond to 4 overriding rights of your users:<\/p>\n \u00a0<\/p>\n Any employees who are likely to handle data must be aware of best practices to ensure its protection and confidentiality. Make sure to train all concerned within your enterprise. \u00a0<\/p>\n You can also use specialized marketing solutions to exploit your data. For example, as part of a distributed marketing strategy, solutions such as Dialog Insight allow you to configure a wide range of personalized data access. This allocation of strictly necessary accesses to each user or collaborator allows you to minimize the risks of data leakage but also misuse of information.<\/p>\n This is done by configuring security attributes for your information, creating a granular permissions tree, or through a customized interface to suit the needs of each user.<\/p>\n \u00a0<\/p>\n Find out more about the GDPR<\/strong><\/span><\/p>\n For those wondering about the liability of marketing mailing solutions such as Dialog Insight in the event of non-compliance with the GDPR, well, a sub-contractor cannot be held responsible for its customers’ non-compliance.<\/p>\n For our part, we offer all the necessary tools for our customers to comply. We also always advise our new clients to set up a consent center, but it remains their responsibility to apply the law properly. Nevertheless, we feel it is important to ensure that we make every effort to respect the responsibilities of subcontractors as set out in the law, that is to say:<\/p>\n If you are looking for a technology solution that will make it easy for you to comply with the law, Dialog Insight can certainly help you get there. Having anticipated that this type of consent compliance would become a key issue in the future of digital marketing, Dialog Insight has made it one of its main focus. This has allowed us, primarily, to consolidate our leadership position in Canada as foreign solutions have taken longer to comply with Bill C-28 and, more recently, the GDPR.<\/p>\n For further information, please refer to the full text on the General Data Protection Regulation (GDPR)<\/a><\/strong>.<\/p>\n You can also download our compliance checklist<\/a><\/strong> to have these tips always at hand!<\/p>\n [1]<\/strong><\/a> https:\/\/www.capgemini.com\/fr-fr\/news\/rapport-sur-la-rgpd\/<\/a><\/strong><\/p>\n \u00a0<\/p>\n\n\n1. Review existing practices<\/strong><\/span><\/h2>\n
2. Keep a register of processing activities<\/strong><\/span><\/h2>\n
3. Keeping a healthy database<\/strong><\/span><\/h2>\n
4. Appoint a data protection officer (DPO)<\/strong><\/span><\/h2>\n
5. Apply the principles of privacy by design<\/em> and privacy by default<\/em><\/strong><\/span><\/h2>\n
6. Provide flexible access to user data<\/strong><\/span><\/h2>\n
\n
7. Raise awareness and train employees<\/strong><\/span><\/h2>\n
\n
![\"\"](\"https:\/\/www.dialoginsight.com\/wp-content\/uploads\/2023\/05\/icone_v3_aide-memoire.png\")
<\/figure>\n<\/div>\n\n\n\nAre you having trouble distinguishing between Bill C-28 and the GDPR?<\/h2>\n\n\n\n
This checklist details the main differences between the two Acts and could be very useful in ensuring compliance.<\/h3>\n\n\n\n