toggle menu

Whether you are still ironing out the finer details or just need peace of mind that you’ve done everything necessary to conform, this article seeks to offer a checklist of nine things that will help ensure your organisation is on the right track towards full GDPR compliance.

9 Things to Remember About Your GDPR Compliance

The shadow of General Data Protection Regulation (GDPR) looms large and is set to change the way personal data is collected, stored and processed by institutions across Europe. GDPR, which comes into force on 25th May 2018, seeks to enforce the safe sharing and use of data across Europe; it is mandatory for all organisations that handle personal data in the EU to comply.

The importance of GDPR cannot be understated, so we are confident that most organisations will already be fully compliant. However, if you are still ironing out the finer details or just need peace of mind that you’ve done everything necessary to conform, then this article seeks to offer a checklist of nine things that will help ensure your organisation is on the right track towards full GDPR compliance.


  1. Appoint someone to be responsible for data

The GDPR legislation seeks to make organisations more accountable for the data that they handle. Personal data rights will become much more prevalent, and organisations will have a stringent moral and legal obligation to protect clients, members and subscribers; this calls for a much more considered and responsive control of an individual’s data.

It is essential that organisations are always on top of their data. We recommend that you appoint someone within your organisation to take on the responsibility of dealing with all things related to data requests and GPDR guidelines.


  1. Audit your existing systems

Understanding your current systems and data management processes is essential for moving forward towards GPDR compliance. We recommend that organisations take stock of their existing procedures of data controlling and enact a full audit for GPDR fulfilment.

This can be a long process, so we recommend that you start as soon as possible and put a plan in motion that seeks to amend anything that could violate GPDR.


  1. Implement an effective CRM system

Many organisations fall into the trap of treating all data the same, however the reality is that not all data is created equal! Data represents a person and you should manage it like you would a human.
We recommend that you implement an effective Customer Relationship Management (CRM) system to ensure that you are able to better understand the data that you hold. By utilising a CRM system, you will be much better equipped to see who wants to receive the content that you deliver.


  1. Allow people to control their personal data

GDPR is empowering individuals to take control of their personal data, and organisations must seek to make it as easy as possible for people to control what is done with their information.

To give users the control that is needed both by them and by law, investing in a practical preference centre that allows users to choose the type of communication they wish to receive from your organisation is essential.

Every customer is on their own unique journey, and you must listen to their needs and desires to create unique content and campaigns that suits them.


  1. Make your privacy policies clear and appropriate

GDPR includes rules on giving privacy information to data subjects in articles 12, 13 and 14. The emphasis is placed firmly on making privacy policies clear, well defined and user-friendly. ‘Appropriate measures’ must be taken by data controllers to make this happen.

To comply, all organisations should amend their privacy policies to fall in line with the guidelines in the legislation, however, the legalities and wording can be quite complex if you don’t have a law degree. Fear not, there are plenty of solutions out there to help you make sure your privacy policies are GDPR compliant. Once such solution is Iubenda, they are a service that generates solicitor-level privacy policies for your organisation’s website in just a few steps. Find out more about them here.


  1. Stop collecting cookies without consent

The use of cookies is mentioned only once in the GDPR legislation, but the article that refers to them is very clear in what it expects. Organisations are no longer allowed to use cookies to identify individual’s via their device because it is considered personal data.

There should be a conscious effort by organisations to stop collecting rogue cookies or find a legal means to collect and process that data, however GDPR’s bolstered regulations mean it will be much more difficult to gain legal consent as users need to opt-in themselves.


  1. Design an engaging opt-in process

Now that organisations must legally ask subscribers to opt-in to mailing lists, individuals can afford to be much more discerning about what data they choose to hand over.  Therefore, the need for an engaging strategy that encourages people to opt-in to campaigns has never been more apparent.

You should:

  • Know your audience
  • Adapt your message to engage your target audience
  • Make it relevant to their needs
  • Make your content visually striking


  1. Get SSL certification

Given that GDPR has the objective of protecting the personal data rights of individuals, organisations should be seen to be actively promoting the protection of personal data.

One small but highly effective method of giving individuals the confidence to trust organisations is by ensuring they obtain an SSL certificate.

Installing a SSL certificate activates the padlock and the “https” protocol on a web server. Organisations should install an SSL Certificate onto its web server to start a secure session with browsers.


  1. Content is king

And finally…CONTENT!

As we have already established, the landscape of engagement will change with the imposition of GDPR, and the need for a more refined content strategy that will appeal to the needs of the individual is essential.

If you want an insightful, engaging and GDPR compliant way of producing content, then drop us a message at