No matter the size of our business, we handle a vast array of data from various sources, including contacts, prospects, clients, customers, suppliers, staff, volunteers, and contractors. This data, which can be classified into personal data, sensitive data, engagement data, analytics, and non-personal business information, is pivotal for operational success. Understanding and managing this data is a best practice and a legal requirement, especially under regulations like the GDPR, the Data Protection Act, and PECR.
Understanding Your Data
Businesses typically manage diverse types of data:
Personal Data: Identifiable and related information such as names, contact details, dates of birth, education, and employee information.
Sensitive Data: Includes race, ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, genetic data, biometric data, health data, sex life, or sexual orientation.
Engagement Data and Analytics: Information derived from interactions and analysis of user behaviour.
Non-Personal (Business) Information: Operational and transactional data not directly linked to individuals.
Knowing what data you have is crucial to avoid unnecessary collection, ensuring timely deletion, and efficiently collating information for Subject Access Requests (SARs). It also aids in managing consent and responding to regulatory requirements.
Data Mapping and Inventory
Data mapping is a fundamental yet often overlooked process. It involves creating a comprehensive inventory of the data you collect, detailing where it comes from, why it’s collected, where it’s stored, and how long it’s retained. This can be efficiently managed using a spreadsheet, aligning the data map with the customer journey. Key questions to consider include:
What information do you collect?
Who and where do you get it from?
Why are you using it?
Where are you storing it?
How long do you need it?
A thorough data map forms your Record of Processing Activities (ROPA) foundation, ensuring you have a legal basis for all data processing activities. It sounds worse than it is. You can combine them.
Legal and Compliance Aspects
Under regulations like GDPR, knowing what data you collect is a legal requirement. The first critical step in data privacy is creating an integrative view of your systems and the personal data collected, transferred, and retained. This comprehensive understanding helps manage consent and SARs and is essential for compliance.
Expanding the data map to include a ROPA ensures you can demonstrate the legal basis for your data processing activities, thereby supporting compliance and mitigating risks.
Risk Management
Without a clear understanding of your data, you expose your business to several risks, including data breaches and duplication across platforms. The consequences of poor data management can be severe, leading to time loss due to inaccurate or unknown data and becoming overwhelmed with requests. Effective data management mitigates these risks, ensuring operational efficiency and accuracy.
Benefits of Knowing Your Data
Understanding your data brings multiple benefits:
Operational Efficiency: Streamlined processes and reduced redundancy.
Cross-functional collaboration: Enhanced communication and coordination across teams.
Customer Trust: Demonstrates a commitment to data protection, fostering trust and loyalty.
Knowing that your data is not confined to apps and databases but also encompasses spreadsheets, emails, and other formats ensures comprehensive data management.
Practical Steps
To better understand your data, start with these steps:
Determine what data fields to include in your map.
Establish standard naming conventions.
Define schema logic or transformation rules.
Test for logic on a small sample.
Involve representatives from each team, including subcontractors, to ensure all data processing activities are accounted for.
Role of a Data Protection Consultant
As data protection consultants, we help businesses create data maps and ROPAs. Our outsourced service handles these tasks comprehensively, ensuring legal compliance and effective data management. When choosing a data protection consultant, look for expertise in data mapping and compliance and a proven track record of helping businesses navigate the complexities of data protection regulations.
Knowing your data can enhance operational efficiency, ensure compliance, and build stronger customer relationships. Book a clarity call and let us help you navigate this essential aspect of modern business.
Navigating the Future: PECR and Digital Marketing in the UK for Small Businesses
In today’s digital landscape, social media has become an indispensable tool for small businesses aiming to expand their reach and engage with their customer base more effectively. However, with the power of digital marketing comes the responsibility of adhering to regulatory frameworks designed to protect consumer privacy. In the UK, one of the key regulations governing electronic communications for marketing purposes is the Privacy and Electronic Communications Regulations (PECR). For small businesses navigating the complex interplay between digital marketing and data protection laws, understanding PECR is crucial.
Understanding PECR
PECR stands for the Privacy and Electronic Communications Regulations, complementing the General Data Protection Regulation (GDPR) and the Data Protection Act 2018 in the UK. While GDPR covers the broader aspects of data protection and privacy, PECR focuses specifically on electronic communications. It sets out rules regarding the sending of marketing emails, texts, and calls, the use of cookies, and the security of public electronic communications services.
PECR’s implications are significant for small businesses utilising social media and digital marketing. The regulations ensure that marketing communications are sent only to those with explicit consent, safeguarding individuals’ privacy and preventing unsolicited marketing. PECR covers many different aspects, and I will not explore all of it it here. The key areas in this blog will be
Legitimate interest: the ‘Soft opt-in’
Consent
In a separate article, we will examine cold emailing and the difference between individuals and corporate entities (registered businesses).
Deciding if legitimate interest or consent
PECR states that the legitimate interest test for direct electronic marketing is “A person may send or instigate the sending of electronic mail for the purposes of direct marketing where— (a) that person has obtained the contact details of the recipient of that electronic mail in the course of the sale or negotiations for the sale of a product or service to that recipient; (b) direct marketing is in respect of that person’s similar products and services only, and (c) the recipient has been given a simple means of refusing (free of charge except for the costs of transmitting the refusal) the use of his contact details for the purposes of such direct marketing at the time that the details were initially collected and, where he did not initially refuse the use of the details, at the time of each subsequent communication.”
You must hit all three to use this as a legitimate interest and record the assessment.
If you can not hit all 3, you will need to use consent as a legal reason to process their information and market.
PECR and Social Media for Small Businesses
So, not to get confused, the rest of this article looks at marketing and consent.
Social media platforms are powerful tools for small businesses to conduct marketing campaigns, engage with customers, and enhance brand visibility. However, PECR mandates that companies obtain explicit consent before sending direct marketing messages through electronic channels, including social media, where legitimate interest has not already been assessed.
Consent under PECR means that individuals must clearly understand what they are agreeing to and take positive action to give their consent. Pre-ticked boxes or assuming consent from inactivity are unacceptable practices under PECR.
Furthermore, when using cookies or similar technologies to track users’ behaviour on your website or social media platforms, PECR requires businesses to inform users about the cookies, explain what they do, and obtain their consent before placing them.
Best Practices for Compliance with Consent
Obtain Explicit Consent: Ensure that your marketing practices are transparent and that you obtain explicit consent from individuals before sending them marketing communications through social media or any other electronic means.
Be Clear About the Use of Cookies: If your website or social media campaigns use cookies, clearly inform your users about them and obtain their consent before tracking their activity.
Provide Easy Opt-Out Options: Compliance with PECR also means providing individuals with an easy way to withdraw their consent at any time. Ensure that opting out of marketing communications is as easy as opting in.
Keep Records of Consent: If required, maintain records of when and how consent was obtained to prove compliance with PECR.
Stay Informed: Regulatory landscapes are continually evolving. Stay informed about any updates or changes to PECR and GDPR to ensure ongoing compliance.
Navigating the Future
As digital marketing continues to evolve, so too will the regulatory landscape governing it. For small businesses in the UK, staying ahead of these changes is not just about compliance; it’s about building trust with your customers. By respecting their privacy and adhering to regulations like PECR, you demonstrate your commitment to ethical business practices.
In conclusion, while navigating PECR and digital marketing may seem daunting, it offers an opportunity for small businesses to differentiate themselves and build stronger relationships with their customers. By embracing these regulations, small businesses can leverage social media and digital marketing more effectively and responsibly, ensuring a future where growth and compliance go hand in hand.
Book your clarity call to discover how our expertise in PECR compliance can elevate your digital marketing strategy. Let’s grow your business together.
In the last couple of weeks, unwanted emails have increased. Either that, or I am hearing more complaints about the number of unwanted emails and messages people receive. Email marketing is essential for businesses to reach their target audience and promote their products or services. However, it is crucial to understand the importance of consent when engaging in email marketing campaigns. In this blog post, we will explore the concept of consent in email marketing, including when you need to ask for consent, using lead magnets, and the relevant UK legislation.
As we discussed in our blog ‘GDPR, Business and Social Media’, email marketing is regulated by two key pieces of legislation in the United Kingdom: the General Data Protection Regulation (GDPR) and the Privacy and Electronic Communications Regulations (PECR).
The PECR specifically addresses electronic communications, including email marketing. It sets out rules regarding consent, privacy, and electronic communications that differ between individuals and registered businesses. It is important to know that not all businesses should be treated equally.
You may have noticed that I use business and organisation in my blogs. That is because a business and a company have slightly different meanings.
A business does not have a distinct legal status. It operates under the legal framework governing business ownership, such as sole proprietorship or partnership. On the other hand, a company is a separate legal entity with its own rights, responsibilities, and obligations. A company is registered in Companies House, and that depends on the location in the UK you are.
Now, in relation to PECR, a business is a sole trader (and certain partnerships) and, therefore, must be classified as an individual, as it is not a separate entity, and therefore consent is required.
Under the GDPR, individuals (including sole traders and some partnerships) can control how their personal data, including email addresses, is used. As a business, you must comply with the GDPR by obtaining explicit consent to process data from individuals or having a legitimate interest before sending them marketing emails.
Obtaining Consent
Now, GDPR and PECR are interesting. Under PECR, obtaining consent from your individual subscribers is a fundamental requirement in email marketing. Consent ensures that you have the legal basis to market to individuals via email. You must ask for explicit consent before adding an individual to your email list. This means that individuals need to explicitly opt-in and provide their consent to receive marketing communications from you unless they are existing customers.
You may add existing customers to your list through a ‘soft-opt-in’. This means you can only send them marketing messages offering goods or services similar to those they have already purchased. The same rules for opt-out apply.
Lead Magnets and Consent
A common strategy used in email marketing is the use of lead magnets. Lead magnets are valuable incentives you offer your website visitors in exchange for their email addresses. These can be in the form of e-books, whitepapers, exclusive content, or discounts. While lead magnets can be an effective way to grow your email list, it is important to ensure that you obtain proper consent from the subscribers who sign up through these lead magnets. This means putting the checkbox to consent before signing up and DO NOT link it to the download button. Saying they have to consent before downloading does not allow them to consent freely.
What can I do if I receive unwanted emails?
If you believe you are being sent electronic messages and you have not consented or that they are still sending you them after you request to stop, report it to the ICO. How can the ICO know it is happening without reporting it and taking action? The more they are reported, the more evidence they have, and the more people complain, the more likely action will be taken. Click here to go to the ICO website and see how.
Conclusion
Email marketing is a powerful tool for businesses to engage with their audience and drive conversions. However, it is essential to prioritize consent in your email marketing efforts. Always obtain explicit consent from individuals before adding them to your email list, and be transparent about how their data will be used. Additionally, comply with relevant UK legislation, such as the GDPR and PECR, to ensure you adhere to legal requirements and protect your subscribers’ rights.
By following best practices and respecting the importance of consent, you can build a strong and engaged email list while maintaining trust with your subscribers.
We have created a quick guide to email marketing and the regulations. Download your copy here
Manage Cookie Consent
To provide the best experiences, we use technologies like cookies to store and/or access device information. Consenting to these technologies will allow us to process data such as browsing behaviour or unique IDs on this site. Not consenting or withdrawing consent, may adversely affect certain features and functions.
Functional
Always active
The technical storage or access is strictly necessary for the legitimate purpose of enabling the use of a specific service explicitly requested by the subscriber or user, or for the sole purpose of carrying out the transmission of a communication over an electronic communications network.
Preferences
The technical storage or access is necessary for the legitimate purpose of storing preferences that are not requested by the subscriber or user.
Statistics
The technical storage or access that is used exclusively for statistical purposes.The technical storage or access that is used exclusively for anonymous statistical purposes. Without a subpoena, voluntary compliance on the part of your Internet Service Provider, or additional records from a third party, information stored or retrieved for this purpose alone cannot usually be used to identify you.
Marketing
The technical storage or access is required to create user profiles to send advertising, or to track the user on a website or across several websites for similar marketing purposes.
