Small Business holding data, GDPR???

[VEX]

As some know I run a small AV / Smarthome install company. This year I want to move it to more service work and contracts.

But that will mean more data holding, addresses, contact details, recurring payments and possible passwords.

It will be primarily only me with access to data, with a Dropbox back up / remote access

What hops and considerations do I need for GDPR compliance if any?

V.

[Australiam]

For small businesses as you describe, much of it is common sense, and there is not too much overhead, as long as you give consideration to GDPR in the things you do. However, most important is that somebody is aware of the regulation, and how it applies to you, so that you can make sure that what you do remains compliant.

For example, if your use of Dropbox means that data is being stored in the US, then you need a lawful basis for the transfer of the data outside the eu. If you had known that when you selected dropbox, you could have made sure you selected a service that hosted data in the EU and removed that issue without any extra overhead.

There are a few key things you need to understand well, and I'd suggest you have a process for (Such are if a customer issues you with a SAR), but hopefully you will rarely/never need to follow the process. You may need to check that you have the right paperwork in place with 3rd parties, but this will depend on how your business works.

There are other area such as the information you need to communicate to the individuals when collecting their data, which if you do not do, will make it obvious you have not taken GDPR into account.

In summary - I believe it it is worth spending some time getting up to speed, because once you have made a few small changes, the ongoing overhead is then minimal.

[48k]

It's worth having a look through the ICO's Small Business Hub https://ico.org.uk/for-organisations/business/

[williamp]

I think youll be fine. You have a legitimate interest in keeping existing customers data. Also new customers. Just be sure you didnt buy any sorg of database with their details on it: would they expect you to have their details, for example?

[GlenMH]

You will need to appliy to the ICO to get a Registration Certificate but that only takes a few mins.

[VEX]

Thanks guys, will have a poke around tomorrow and Friday.

V.

[VEX]

That is a great resourse for small business GDPR info, thanks.

Looks like I am all ok with a few little tweeks, here and there which will be easy to modify.

Thanks PH Collective

[Ean218]

GlenMH said:

You will need to appliy to the ICO to get a Registration Certificate but that only takes a few mins.

Why? From what he has outlined above he won't be holding any data that requires that.

[Australiam]

Ean218 said:

Why? From what he has outlined above he won't be holding any data that requires that.

"addresses, contact details" - presumably, due to the business working in a consumer environment (I'm guessing this based on it being smart homes) these will be the details of individuals rather than 'The finance manager' at 'Company address'. Therefore, he is unlikely to qualify for exemption under the ICO guidance, and would therefore need to register.

[Ean218]

Australiam said:

"addresses, contact details" - presumably, due to the business working in a consumer environment (I'm guessing this based on it being smart homes) these will be the details of individuals rather than 'The finance manager' at 'Company address'. Therefore, he is unlikely to qualify for exemption under the ICO guidance, and would therefore need to register.

No, you are quite incorrect, the requirement to register and pay a fee has the following specific exemptions in law:

The Data Protection Charges and Information Regulations 2018 said:

(d)for the purposes of matters of administration in relation to the members of staff and volunteers of, or persons working under any contract for services provided to, the data controller;

(e)for the purposes of advertising, marketing and public relations in respect of the data controller’s business, activity, goods or services;

(f)subject to sub-paragraph (4), for the purposes of—

(i)keeping accounts, or records of purchases, sales or other transactions,

(ii)deciding whether to accept any person as a customer or supplier, or

(iii)making financial or financial management forecasts,

in relation to any activity carried on by the data controller;

Those cover the examples you gave above. What you are mixing up is the requirement to comply with the GPDR which is a wholly different thing.

And if you go through the checklist on the ICO website https://ico.org.uk/for-organisations/data-protecti... it also shows that you do not have to pay a fee in those circumstances.

[Australiam]

Ean218 said:

Australiam said:

"addresses, contact details" - presumably, due to the business working in a consumer environment (I'm guessing this based on it being smart homes) these will be the details of individuals rather than 'The finance manager' at 'Company address'. Therefore, he is unlikely to qualify for exemption under the ICO guidance, and would therefore need to register.

No, you are quite incorrect, the requirement to register and pay a fee has the following specific exemptions in law:

The Data Protection Charges and Information Regulations 2018 said:

(d)for the purposes of matters of administration in relation to the members of staff and volunteers of, or persons working under any contract for services provided to, the data controller;

(e)for the purposes of advertising, marketing and public relations in respect of the data controller’s business, activity, goods or services;

(f)subject to sub-paragraph (4), for the purposes of—

(i)keeping accounts, or records of purchases, sales or other transactions,

(ii)deciding whether to accept any person as a customer or supplier, or

(iii)making financial or financial management forecasts,

in relation to any activity carried on by the data controller;

Those cover the examples you gave above. What you are mixing up is the requirement to comply with the GPDR which is a wholly different thing.

And if you go through the checklist on the ICO website https://ico.org.uk/for-organisations/data-protecti... it also shows that you do not have to pay a fee in those circumstances.

I agree that if the original poster we keeping the data on their own device, they would qualify for the 'keeping accounts' and/or 'marketing' based exemptions. However, as the OP is transferring the data to a 3rd party processor (Dropbox) with whom they have a processing agreement in the form of the EULA, which in all likelihood is outside the EU, do you still think that this qualifies? I am not sure they would still qualify to use the exemption?

At the very least I would be looking for further clarification from the ICO.

Edited by Australiam on Monday 13th January 13:13

[Ean218]

Australiam said:

I agree that if the original poster we keeping the data on their own device, they would qualify for the 'keeping accounts' and/or 'marketing' based exemptions. However, as the OP is transferring the data to a 3rd party processor (Dropbox) with whom they have a processing agreement in the form of the EULA, which in all likelihood is outside the EU, do you still think that this qualifies? I am not sure they would still qualify to use the exemption?

At the very least I would be looking for further clarification from the ICO.

The regulations regarding registration are quite straight forward and make no distinction over who processes the data on your behalf as the data controller and you would not need to register.

But again the GDPR aspect is a whole different can of worms and sub contracting the processing would need to comply, off-shoring data is in my opinion a bad idea anyway.