GDPR Compliance 2020 Summary - 10 Steps in 10 Minutes to Avoid Fines

[@eaphotoservices]

At last, I finally get it. No legal jargon. No meaningless fluffy overviews. Just the practical steps, in real terms, of what I need to do to be GDPR compliant. Brilliant! Thank you sooooooo much. Have shared on Facebook with all my friends and business owners.

[@benhill2561]

As a web developer I have watched 6 videos this morning trying to get an understanding of GDPR. This is by far the best one.

[@theericbeaty]

Amazing information. Thanks so much, Digitool! First-time viewer and just subscribed, so enjoy your happy dance, Daisy!

[@HaregotHailu]

Is amazing always following 😊

[@benhancock542]

This has been more informative that the hour long webinar I did today. Thank you!

[@GoDigitool]

No worries Ben, always happy to help :) Daisy

[@aretnv]

Thank you so much for this useful guide! I have been researching for weeks and it's lovely to see it all put together in tips like this. Clear and easy to understand. Very much appreciated from a small business owner! :)

[@om4769]

You got a true follower. Best content on GDPR so far. Thanks a lot sharing with us.

[@mhdalmurad8986]

terima kasih banyak atas panduan yg anda berikan semoga menjadi ilmu yg bermanfaat bagi saya

[@bento8]

best video on gdpr so far, with just the right amount of details

[@kanwalhafeez3782]

Want to learn more about GDPR Compliance : stafftimerapp.com/blogs/gdpr-compliance-and-employee-data-monitoring

[@rajneeshsingh508]

Very helpful to understand ...GDPR. Thank you!!

[@iangordon4852]

Absolutely superb. Easy to understand with no Jargon. As a very small business i am now confident that i can meet all GDPR principles. Thank you very much.

[@fiorenzamarani2899]

This was very useful! Thank you for sharing all this info:)

[@mazenkhiami9116]

GDPR was confusing for me but your explanation made it easy to understand and to act upon. Definitely, one of the best explanations I came across ever.

[@georgeskarpas9500]

Great work, really. Within my research for GDPR, this was the 1st video that was not just saying a few (general and confusing) things about GDPR, only to continue with promoting a product or service. Many thanks ..

[@GoDigitool]

Thanks for taking time out to leave such lovely feedback George :) Not here to promote anything, I just did the research for our own business and felt I could save people some time by explaining what I had learnt along the way. Daisy :)

[@SecretWealthProject]

Love it, people are literally being SCARED out of business because of this stuff, you make it all sound simple which is GREAT! Shared your video with my 18,000+ FB group members just now to help them (and you) out :) Thanks!

[@javirod8]

Excellent job, Daisy! After reading so many articles that only left me with more questions, this video made everything about GDPR "click".

[@GoDigitool]

Thanks Javier! And thank you for taking the time out to see the video.

[@dom38_fr82]

I was wondering what GDPR actually was. 13 minutes later, with simple and clear words ..I really feel I do. That was brilliant. Summing up all this in such a short time, making it understandable by anyone. Great work there !

[@biemachristinabanez7463]

very detailed and informative! thanks for this! SUBSCRIBED :)

[@LanceMcGrew]

GDPR is a goldmine for we folks doing website maintenance. Keep it coming :)

[@fer1892]

Or lawyers

[@lalitlakhanpal9690]

Very nicely explained. Useful video. Many thanks.

[@GoDigitool]

Thanks! Glad you enjoyed the video!

[@ecocleaningfairies8603]

Thanks this has saved me as I love watching videos instead doing all the reading to research what I need to do. You are very good at this. It is clear, well thought out, easy to understand, helpful and super informative. I feel really confident about what to do so thanks again.

[@AndyStone28]

Thank You Digitool for putting together this great video for all of us that are still currently baffled by what to do next to prepare for GDPR! The video really brought back memories of when I was a Health and Safety Officer in corporate retail! The terms are different, but the logic and processes are basically congruent with each other. The amount of clarity you shed light on is incredible, and I absolutely love the small Q&A for real business situations! I've shared the video on my FB and LinkedIn, I'll be sure to target any further questions back to your site. Thanks again for the awesome video!

[@ankush1275]

Very helpful, thanks for sharing

[@datasecteacher1895]

Thank you for this helpful video on GDPR!

[@GoDigitool]

Glad it was helpful!

[@chainstair4]

You are awesome for taking this awful big information of gdpr and compressing it into a 13 min video... Thank you very much U helped a looooooot

[@GoDigitool]

Thanks for the lovely comment, compressing the info into something that was easy to understand took a lot of late nights, coffee and pizza deliveries :)

[@MrHelloskinkeguf]

Thank you! this was a big help!

[@oaa-f6h]

Excellent presentation of GDPR overview. You made it look simple and enjoyable.

[@GoDigitool]

Glad it was helpful!

[@sandrodofimdomundo]

Great video and tips, tks! Not sure if you are aware of, GDPR rules in Brazil will be effective on February 16, 2020. Basically, it is a ctrl C/ctrl V version of the EU GDPR rules, so we are trying to understand it from the very beginning.

[@certificationcourses7477]

#GDPR is all about assessing the risk to data subjects. GDPR compliance is a continuous process. The worst thing organisations can do is not do anything at all! Good points raised in this video! However, it is the ICO (Information Commisioner's Office) that is the supervisory authority (SA) in the UK. They investigate GDPR compliance. ICO guidance and advice is the best to follow. (2:08)

[@mikgol81]

Thanks for the easy to understand explanation and list, best one i've seen all day :)

[@mirandarector4298]

Great structure of content throughout the video.

[@untitledobscure]

Best GDPR explanation in the shortest possible time! Great Job Daisy! 👍

[@mohammeddaud8448]

A super explanation. very succinct. thanks

[@tikax2085]

I found this video very helpful. thank you very much

[@rajaratnamduraisamy7398]

Excellent video. We are a small business and make print hard copies of the customer invoices, dispatch notes etc for accounting and audit purposes , under the new laws are we allowed to store these records and is there anything that we should be mindful of when maintaining these hard copy records . We also store the customer/ supplier details in our computers and servers should they be stored with password protection

[@BR-gt4zk]

This has been so informative on GDPR than any that i have yet to come across :-)

[@atlas9a]

Really helpful, thanks.

[@nikhilmain4831]

Do employers need to take and document consent for obtaining personal data from potential candidate for employment ? (refer Article 9 of GDPR). Can you lease guide.

[@mathuraidurai7337]

Thanks for the 10 useful tips given in the video.

[@randonneurUK]

So I have a phone book Yellow Pages which has details of suppliers that I might use. Do I need to inform plumbers and electricians that I have their phone No. in my records?

[@wanjirumwoka6187]

Great video! You explained the law very well.

[@LeeRichez]

this was useful - thanks :-)

[@GoDigitool]

Glad it was helpful!

[@CartooonTHAT]

Question. Lets say i went on holiday. and i happen to take loads of photos and videos in public areas. when people walk around. it happens i would have collected so many different people's data, their face information etc. and if i am to post videos of scenes where you can see someone's face. loads of random face walking around. is there anything i need to do on my side? and its not for any business purposes.

[@TheBarelegs]

just liked and subscribed. great tips.

[@GoDigitool]

Thank you!

[@nancypreston7966]

excellent. the best overview explanation I've seen!! super clear and enjoyable to watch. thank you!

[@GoDigitool]

Thank you for the lovely feedback Nancy, glad it was clear. Good luck with the GDPR changes and let me know if you have any questions :) Daisy

[@wjd1412]

Nancy Preston hh

[@nothertunemusic6979]

Yes, I agree, super healthy tips! Thanks!

[@kanwalhafeez3782]

Want to learn more about GDPR Compliance : stafftimerapp.com/blogs/gdpr-compliance-and-employee-data-monitoring

[@JohnWilson-ub9vw]

Interesting and informative. I work with a charitable foundation and keep information on our volunteers. These are not employees and they don't sell anything. We also have patients that we deal with . It would be interesting to know what to do about their records.

[@krzychaczu]

9:55 In case of buying data containing personal information, shouldn't data subject be informed about purchasing party's data policy and give them a constent of storing and processing that data? I doubt whether selling's party compliance with GDPR is sufficient to buy this data. The purchasing party is required to comply too, hence be able to provide the evidence that data subjects were informed about the purpose of storing and processing their personal information by the purchasing party and gave their consent for it as well.

[@adamjgh]

I work for a business that sells home improvements, the data we have is used for guarantees, our guarantee is 10 years so we keep data for that long we also keep limited data to prove when the guarantee has ended, can someone ask for that data to be deleted? If so how do we prove when products were installed????

[@FlashBackTheUnknown]

Well done. Learn so much about GDPR in a short time frame. Thanks!

[@GoDigitool]

Thank you! We're happy that you learned so much about it in a short time.

[@boathorn]

excellent explanation

[@georgeskarpas9500]

Daisy, thank you for inviting us to post questions. I do have one. I own a small company, that provides services to "Individual Professionals" (like a lawyer, or engineer) and "Companies" ONLY. I am talking about "Legal Entities" with Tax books, that must provide their VAT number, in order to accept an Invoice (not a simple Receipt). I have nothing to do with Retail market, I cannot sell anything to a "Person" (my Tax books, do not allow me to). The only data I keep about my Customers & Suppliers, is their "Tax data", the ones needed to issue or accept an invoice. The only "persons" I communicate with, are the employees of my Suppliers and the employees of my Business Customers (companies). The only data I have about them, is what is usually written in their Email signature (like Name, Job title, Email, Phone, Work address). The only way I use their data, is to communicate with them. I do no marketing at all, I do not collect any data from any source, I do not give any person's data to anybody. The ONLY "person" I deal with, is my 1 employee. His data, are provided only to my company's accountant. SO, the question is: Does GDPR "touches" my company ? Thank you.

[@GoDigitool]

Hey George, Great question! So, yes GDPR does affect your company but don't worry there isn't too much extra work to do! You will still have to take necessary precautions to make sure that data is safe and couldn't be misplaced or stolen. You will also need a system in place in case someone requests what data you have on them (this doesn't need to be anything too advanced, you just need a very clear idea of ALL the information you have on a customer so you can give that to them should they ask for it). I would consider putting all the GDPR marketing provisions in place (such as a privacy policy and opt in form) JUST IN CASE you want to market to your customers in the future. You don't have to send them any marketing but, I'd rather have the provisions in place than realise you want to market to them later down the line and realise you can't. Hope this helps! Daisy

[@georgeskarpas9500]

Thank you very much, George

[@GoDigitool]

No worries George, glad we could help :D

[@conradpreen2368]

Very useful, but I have one question. What is the situation regarding invoice and transaction data in e-commerce? The obligation to keep these records for the tax authorities to inspect seems to conflict with the "right to delete". If a customer comes to me and demands that I delete all her invoices which government department wins or do they both fine me?

[@GoDigitool]

Hey Conrad, great question. My understanding is that you can keep these records but would delete the information needed to market to her. Although this is just my interpretation and I'm not legally trained, I'd double check this with the ICO helpline, I've found them useful. ico.org.uk/global/contact-us/helpline/ I've found them really useful at answering specific questions :) Hope this helps and let me know what they say! Daisy

[@GianfrancoFattorini]

Very clear explanation!

[@rafahkabir]

is it mandatory to show the Privacy Policy on the navigation bar? i mean, what if your site does not have a navigation bar at all?

[@jackrobinson6866]

Excellent explanation! Thank you

[@akostadinov]

What would you say about Oracle web site where you need to click through several dialogs so select only the very limited cookies required by the web site? I don't think it can count as easy and clear.

[@soniarolfe186]

Clear video with good advice, thank you

[@GoDigitool]

Thanks for the kind words Sonia - so happy it was useful for you. Daisy

[@pammiller1561]

Very thorough. Thanks.

[@balkarransinghh]

Thank You Very Much

[@GoDigitool]

Glad it was helpful! :)

[@pavelvinitsky562]

Hi, your tips are perfect! We're going to follow your checklist on our websites! Can you please tell me, do we need to make the same if we have an app in AppStore? We don't collect names and emails but we definitely use some ads and analytics tools....

[@cynthiafernandes7668]

This is really helpful, summarizes the concept and tips are great as well.

[@GoDigitool]

Thank you Cynthia :) I appreciate the time you've taken to comment - that's so kind

[@kishorechavan3471]

Succinct and clear. Thanks.

[@michaelandrew4812]

Wow fantastic presentation we are undertaking a GDPR review with Deloitte but your explanation and examples are great.

[@markcunningham7350]

Tip 6 depends on who is collecting your data and for what reason, if you have entered into a contract with a financial services firm, they would normally need to hold onto the information for at least 6 years (for some pension transfers for your whole life), so that they can defend themselves against a claim for financial mis-selling. The law may also instruct the firm to hold onto personal data, such as HMRC etc. So the answer is no, there is no blanket requirement for a company to destroy your personal data. If depends.....

[@nitin124goel]

Is it okay to force user to accept terms & Condition /privacy policy? I mean not allowing to use the services unless they accept their privacy policy ?

[@spiratronics3887]

This is a brilliant video, thanks for taking the time to create it.

[@Is.The.Boss1]

What about cold contacts? We are a small agency and we don't own large databases to invite people to our events?

[@TheLonare]

thanks for summarizing it

[@petrnovak5374]

Thank you for this video. Any GDPR changes (updates) till now?

[@rosiebaker4250]

What is my settings all my phones the changes in th I ere on settings thank you

[@ronnizag]

Awesome tips!! is this GDPR is only for websites hat belong to european union right??

[@jenniferromeo2222]

Very well done!

[@GoDigitool]

Glad to hear it!

[@praveshkumar8161]

Hey, I am Quality Analyst and I want to know that what checklist or can say test cases a QA should have to ensure that website is GDPR compliant. If you have a checklist please share. Thanks

[@GoDigitool]

I'm afraid I don't have a checklist but you can easily make one from the steps mentioned in the video! Good luck Pravesh

[@eurotaxislimited9610]

Great video, we're going to show this to our employees.

[@Berniz123]

Great explanation! Well done! Will definitely follow your tips, thanks! ✌🏻

[@gwyneth7812]

Much clearer than anything else I have seen, thank you.

[@GoDigitool]

Not a problem Karen, so glad you found it useful :)

[@shubhamverma7747]

If you want to save your business from the fines regulated by EU GDPR then CLICK HERE : bit.ly/2MbIchU

[@kanwalhafeez3782]

Want to learn more about GDPR Compliance : stafftimerapp.com/blogs/gdpr-compliance-and-employee-data-monitoring

[@cross1439]

Hi Daisy, could you recommend a link for a free privacy policy template please

[@friewire]

Great video!

[@lisbethnielsson3231]

Thanks - very useful. Who gets the 20mill euro in fines? Do they go to the violated part?

[@TarrelScot]

Very useful and well structured video. Thank you. However it’s worth pointing out that the need for customers to opt in to electronic marketing communications has been in place for 15 years! (Privacy and Electronic Communications Act, 2003). It’s not new in GDPR.

[@bossoli60]

Very well done, thanks

[@GoDigitool]

Thank you Olivier!

[@davidfreedman7544]

Excellent!

[@Daria-kd4sz]

Hi Daisy! Thanks so much for that video. It was really handy to understand what GDPR is. I've check comment section but no one asks for it. What about cookies and all tracking stuff? I put a notification when entering website we use cookies and third-party engines and 'I am OK with cookies' botton and 'Learn more'. The website is built on Shopify platform and doesn't really allow to put more options. Do you think an additional text like 'If you don't agree to use cookies please change the settings in your browser or leave page' will sort out the problem?

[@neilcooper6798]

Really helpful and clear. Thank you.

[@GoDigitool]

Glad to help Neil - good luck with the GDPR changes.

[@untitled19DR]

you legit saved my life! thanks

[@robharris4097]

Thanks so much, this video is very helpful. I have a question: for health practitioners, who have hand written data taken at a consultation, is it necessary to contact every past patient and ask if their data can be held? Health practitioners are legally obliged to hold their data for 7 years, even if no longer in touch with them?

[@maoioagency]

nice video! But, I was wondering, what about "Goodbye E-mails"? They are automatically sent after someone unsubscribes, like a last ditch effort to try a persuade a subscriber to stay with us. Are those kind of emails "outlawed" now, after GDPR?

[@grahamsmith7463]

So if I get a speeding or parking fine through the post, I can phone them up and demand they delete all my data from their system?

[@gregorymagee4720]

Yeah, thats inaccurate. If there is a legal/regulatory basis for holding the data it can't just be 'deleted'

[@joemunkey30]

they would probably rely on a legal basis for processing like legitimate interest

[@krzychaczu]

The data deletion policy and procedures must also consider other applicable laws. In case of consent withdrawal, data processor shall stop processing this data for business purposes, but might be legally or regulatory required to keep this data for a period of time defined by a law or a regulation.

[@williamburndred6284]

Àaaààààaàaà

[@williamburndred6284]

A

[@TheKlima5]

Hello and thanks for the video! Do I need to add the 'Positive Opt In' checkbox if I'm not sending any marketing emails to my clients? I only send the booking confirmation email.

[@bhgp1976]

Great video! Are public bodies exempt from GDPR ie HMRC, local councils, water board, health authority etc? Can we opt out with these authorities from holding our data?

[@itsnotforourconvenience2990]

They shouldn't be exempt! If you do a company search (Dunn & Bradstreet, or Company Check), you will find that all of the "public bodies" are in actual fact registered as companies. The European Union, The House of Lords, local authorities, Police, Social Services, HMRC, Courts, et al, are all registered companies. The rabbit hole goes deep!

[@landonmettert7845]

Do you have to follow this for affiliate marketing?

[@mudassiraftab5119]

Thank you for the video. It was really informative. Now, I would like to know that what would happen from GDPR perspective for cases where business has sent emails to it's consumers/customers to opt or give concent to use their personal data for marketing campaigns, etc. but they have not responded to that email. Can I treat no response as their agreement? If yes then will I be liable to any fines?

[@barrymathers5264]

Very good video and clear advice

[@GoDigitool]

Glad to hear it Barry, thanks for the kind words. Daisy

[@rachelguard939]

What will happen about business cards? can people still hand those out?

[@GoDigitool]

Absolutely Rachel! If someone hands a business card to you, that is an example of someone giving an 'opt-in' action to you having their contact details, however, if you want to use this person's information in another way ie. add them to your mailing list you will have to get them to 'opt-in' to that too and ensure they have access to you fair notice policy.

[@GeekBoy03]

Sorry, all Verboten now!

[@SeekerLabs]

If you meet someone and they're European, just run.

[@Linandara]

Thank you for the video. Two questions, first, what about emails you are finding on business or organisation's website or a leaflet. Doy you still ask them if they want to stop receiving emails from you? Obviously they want to be contacted! Second, what about old friends or groups of friends. Do I have to ask all of them too? Thanks.

[@GeekBoy03]

MsMarchella sorry, but according to European regime laws, now everything is banned.

[@dawnpickford9132]

Thank you for this information, been a great help :)

[@GoDigitool]

I'm so glad it could be helpful Dawn, good luck with the GDPR changes and let me know if you have any questions! Daisy

[@HighAngel]

Good job :) Thank you :)

[@mohammeddaud8448]

One question. What do we need to do if we use WhatsApp etc for sending out advertising material to our personal contacts? do they need to opt in? (if they do need to opt in, is leaving an opt-out option sufficient to say they are happy to receive messages?) Bare in mind that in order to broadcast a message on WhatsApp to a group of people, the message only gets through if that party has your number stored on their phone. is that sufficinet for an 'opt-in'?

[@beepbuupbuupbeep]

Very good summary...

[@drbakker]

Really great video thanks! I have a question/observation on your last point about having an existing customers who are on an email newsletter opt in again. I am on probably 20+ lists, and I have not gotten a single request to opt in again (I live in the US), so are you sure about this requirement?

[@durangodave]

I have several questions. The first one is about ip address, i have not seen anywhere that states that an ip address is considered identifiable data so if someone simply visits the website and nothing more then is that considered collecting data? Second question is does this apply to hobby/nonprofit websites as well. If some underage kid ownes a website for them and their friends and they do not block EU ips or customers and EU customers sign up to the site, is the EU going to fine a kid 20 million bucks? Last question, If this is only for business sites then how does the EU qualify what is a business and what is not?