How to ensure regulator and GDPR compliance

Why is compliance so important?

Compliance is a really big deal. When your procedures aren’t watertight, you risk:

⚠️ 7-figure fines

⚠️ Penalties

⚠️ Reputational damage 

One small slip-up could cost you big time 😓

Before we take a look at how to ensure your business remains regulator and GDPR compliant, let’s take a closer look at what it all really means. 

Different industries have specific regulations that they must adhere to. For example, UK financial services firms are regulated by the Financial Conduct Authority, which supervises and sets specific standards for financial firms.  However, GDPR compliance is something that affects all businesses.

What does GDPR mean?

GDPR, the General Data Protection Regulation, is an EU privacy law that protects the personal data of all EU citizens. The regulation outlines the rules in regard to the processing and movement of personal data, which apply to all establishments in the European Union that control or process personal data, as well as all external processing of personal data belonging to individuals in the European Union.

The seven data protection principles of the GDPR:

1. Process data in a lawful, fair, and transparent way.
2. Only process data for legitimate purposes, which should be explicitly specified upon data collection.
3. Minimize data collection and processing to what is necessary for a specified purpose.
4. Store accurate and up-to-date personal data.
5. Limit personal data storage to the time necessary to store it for the specified purpose.
6. Ensure appropriate security, integrity, and confidentiality for all data processing.
7. Be accountable and demonstrate GDPR compliance with all of the above principles.

When did GDPR come into effect?

GDPR came into effect in the UK on 25th May 2018. Since Brexit, when the UK left the EU on 31st January 2020, the GDPR has been retained in domestic law as ‘UK GDPR’ and the principles remain largely the same.  

UK GDPR applies to controllers and processors based outside of the UK if their data processing activities relate to the offering of goods and services to individuals in the UK, or monitoring the behaviour of individuals taking place in the UK. 

EU GDPR applies to UK controllers who have an establishment in the European Economic Area, have customers in the EEA, or monitor individuals in the EEA.

Does my website need to be GDPR compliant?

GDPR affects all websites that collect personal data, since they are likely to get visitors from the EU region. Therefore, every business website must take appropriate steps to ensure GDPR compliance: 

• Disclose that your website collects personal data.
• Gain explicit consent to collect and process personal information.
• Inform users about how, why, and where their personal data will be processed and stored.
• Ensure you can provide a portable copy of the personal data collected from users if they ask for it.
• Delete users’ personal data upon request, or if you no longer have a legitimate reason to store it.

If in doubt, seek legal advice from somebody who is well-versed in GDPR to help you keep your website compliant.

How to comply with GDPR and regulator compliance

When it comes to complying with all of the regulations that govern your business, you may need to seek specialist advice in order to ensure you protect your business and remain fully compliant. At the very least, be sure to consider the following steps to stay GDPR compliant and keep your data safe:

1️⃣ Implement data governance:

• Make sure you’re fully aware of what personal data is stored, where it is stored, who uses it, how it is used, and why.
• Keep detailed documentation of all consent and the data you collect.
• Ensure that consent to data collection is explicit, freely given, specific, informed, and unambiguous.
• Clearly distinguish requests for consent from any other matters and present them in clear, plain language.
• Only obtain and use personal data for fair and lawful reasons.
• Data subjects can withdraw their consent whenever they wish to, in which case you must delete it.
• Have Data Processing Agreement contracts in place with any third parties that process data on behalf of your business.

2️⃣ Ensure staff accountability:

• Make your privacy policy accessible, perhaps by adding it to your employee handbook, and keep it up-to-date.
• Train your team on your compliance obligations.
• Assign data protection responsibilities to your team.
• Ensure automated and manual administrative tasks are carried out correctly and compliantly.
• If appropriate for your organisation, appoint a Data Protection Officer.

3️⃣ Implement technical and organisational security measures:

• Keep your IT systems secure and up-to-date, backing up data regularly.
• Lock filing cabinets and use secure devices with strong password protection.
• Install antivirus and malware protection, and keep it up-to-date.
• Don’t store personal data any longer than you need to.
• Dispose of old IT equipment and records securely.

4️⃣ Have clear policies in place to prevent security breaches:

• Keep policies up-to-date and easily accessible.
• Don’t leave paperwork and laptops unattended.
• Lock your screen when away from your desk.
• Take care when working remotely, and only use secure wifi connections.
• Beware of any suspicious emails.

A CRM with built-in compliance templates

😱 Are you concerned about meeting your compliance obligations? A CRM with built-in compliance templates could be just what you need…

Here’s how our compliant CRM software can help your business meet regulator and GDPR obligations:

✅ GDPR:

• records ‘opt-ins’ and easy ‘opt-out’ 
• respond to requests for customer data by exporting it from the lead record
• easily delete customer data.

Read more about FLG’s GDPR compliant customer contact features.

✅ User compliance and platform permission:

• User privileges control what they see and do 
• Easily build step-by-step call scripts to ensure no important steps are missed
• Create templates for accurate and consistent communication.

✅ Audit logs and reports: 

• A complete timeline of all lead activity
• Account-wide, time-stamped audit trail
• Audit history shows details such as edits and status changes
• Optional logs and reporting on granular account information.

✅ Automatic call notes and recordings with dialler and telephony integrations:

✅ Secure, ISO 27001 certified data storage:

• Secure data, hosted in ISO 27001 certified data centres.
• No data transferred outside of the UK and the Republic of Ireland.

Download a PDF version of our compliance tips.

Written by Lauren Shaw, Marketing Manager at FLG.

Learn more

Want to learn more about how FLG can help you stay compliant? Contact us and someone will be in touch to answer your questions.