GDPR for small businesses

GDPR For Small Business

In May 2018, the General Data Protection Regulation (GDPR) went into effect, strengthening the rights of EU residents regarding data privacy and protection. Essentially, these rights comprise two things:

  • Besides transparency, organizations must provide individuals with the ability to review, amend, or challenge the processing of their personal information.
  • To protect individual data, organizations should implement security measures and manage the liability for any breach or misuse of this information.

This article will discuss how GDPR may applyies to small businesses and some of the essential tasks these businesses need to determine whether the data privacy of their clients is being protected and whether they are GDPR compliant.

GDPR and Small Businesses

Small Businesses with 250-500 Employees

A small company is generally considered as one with fewer than 500 employees in the United States. It is a requirement under GDPR for companies to keep a record of all data processing operations, if they meet certain thresholds. If subject to GDPR, the GDPR’s record-keeping requirements apply to every business with 250-500 employees.

Whether a Data Protection Officer (DPO) is needed is not determined by the business’ size but by the scale and sensitivity of its core processing operations. DPOs are knowledgeable about data protection legislation and processes. A person in this position is also responsible for notifying the authorities of any data breaches.

Small Businesses with Fewer Than 250 Employees

Generally speaking, Article 30 of the GDPR exempts small businesses with less than 250 workers from the need to maintain records of their processing operations, whether as a controller or processor. The size exemption does not apply, however, if the businesses are processing data in any of the following activities:

  • The data processing operations may jeopardize an individual’s rights and freedoms.
  • The information to be processed may involve an individual’s racial origin; political, religious, or philosophical opinions; union membership; genetic or biometric data; or the individual’s health or sexuality.
  • The personal data involved are related to criminal offender, conviction, or arrest-related.
  • The personal data is processed regularly.

As long as these minor requirements are met, small businesses should consider themselves equivalent to larger firms under GDPR for Article 30 compliance requirements.

Small businesses are generally understood to have fewer resources than large corporations. Thus, the Information Commissioner Office (ICO) will consider any smaller company’s challenges in complying with the new legislation. 

GDPR Compliance of Small Businesses

In most instances, your personal data, client information, and company connections will all have this kind of information in some manner. Therefore, let us examine the GDPR’s fundamental principles and how you will be required to comply with them.

Consent

GDPR

Prepare to add more check-the-boxes to your systems since enhanced consent demands getting permission for each use of a customer’s data. Suppose your business requests an email address and permission to deliver purchase information. In that case, it might need permission once more before utilizing that email for marketing reasons. Businesses should phrase all permission requests in a manner that is understandable to the company’s targeted customers.

Access and Control

Data owners should be given control over their information, including the right to delete, receive and reuse their data. It also includes the ability to move, copy, or transfer their data securely. As a business owner, you may need to provide a system for customers to control the use of their personal data, from data entry to data deletion.

Data Breach Reporting

Businesses may have to notify data owners if a security breach occurs. While this may conjure up visions of large-scale attacks, it also encompasses minor errors such as granting access to your data to a contractor or an employee losing a laptop. No matter how minor the breach is, the business might have to inform the data owner about it if it poses risks to the data owner.

Privacy

After the data is provided, you’ll need security measures in place to preserve it. Merely said, you should see that data is appropriately protected. Thus, it would be best if you consider encrypting any database that holds your clients’ data rather than simply password protecting it.

Overseeing

You may need to provide proper surveillance to third-party applications and organizations that are involved in the data processing. When using online newsletter services, the use of mailing lists should be in GDPR compliance. 

Additional GDPR Compliance

The following factors may help illustrate the most critical actions that US small businesses will need to do to be GDPR compliant:

Audit the Data

Proper auditing of data for GDPR compliance is not a simple undertaking. Thus, businesses must make wise decisions. They may be required to do Data Protection Impact Assessments (DPIAs) before initiating any data processing. It proactively protects data and assesses potential risks to data subjects associated with any new data processing. Most European data protection authorities provide guidelines on their websites on DPIAs and when they should be conducted.

Audit the Service Providers

Auditing your service provider’s compliance is a chore that many US businesses struggle with and may be the source of your business’s most significant risk. Businesses need to evaluate and execute data processing agreements with third-party service providers that handle personal data on your behalf. GDPR requires the data controller to enter contracts, and the data processor may only act on the controller’s orders. A service provider that does not comply with GDPR may be subject to non-compliance and put the controller at risk.

What Happens To Non-Compliant Small Businesses?

Investing the effort to design a GDPR-compliant privacy policy may significantly assist small businesses in showing compliance. Those who have not done so may be deemed non-compliant. They may face reprimands, temporary or permanent data processing limits, data restriction or deletion orders, and suspension of data transfer to third countries from supervisory authorities.

Article 83 of the GDPR alerts enterprises to infractions and imposes discretionary fines. It incentivizes enterprises to handle personal data legally and responsibly. 

GDPR Compliance is Important for Small Businesses

GDPR compliance is crucial for both small and large businesses. Many businesses have hired a Data Protection Officer (DPO) to monitor GDPR compliance. 

Inadequate comprehension is a poor excuse for GDPR non-compliance. Whether it is a sole proprietor or a global corporation, businesses should review how they handle personal data and verify that suitable processes and policies are in place. Systems for granting data access requests and systems for detecting and reporting data breaches may need to be in place. Businesses should also implement appropriate technical and organizational protections to oversee the safety and security of data.

To comply with the GDPR requirements, your business must work with experts in data privacy and protection. Contact Metaverse Law today and learn more.

Image of the United States Capitol Building at night.

Strengthening the U.S. Government Supply Chain: Cybersecurity under Executive Order 14028

Image Credit: Michael Jowen from Unsplash.

U.S. government agencies have a reputation for occasionally clinging on to outdated technology. Some illustrative examples include the U.S. Department of Defense (DoD) paying Microsoft $9 million to continue supporting the defunct Windows XP in 2015 and a U.S. Government Accountability Office (GAO) report from 2019 documenting multiple agencies using legacy systems with 8 to 50-year-old components. In its findings, the GAO unsurprisingly concluded that such legacy systems using outdated or unsupported software languages and hardware poses a cybersecurity risk.

In the wake of the SolarWinds, Microsoft Exchange, and Colonial Pipeline security incidents that impacted U.S. government agencies and/or U.S. critical infrastructure, President Biden issued Executive Order 14028 to update minimum cybersecurity standards for all software sold to the federal government and throughout the supply chain.

Existing Requirements under FedRAMP, DFARS, and CMMC

The new obligations arising out of Executive Order 14028 add to existing security regulations for certain government contractors and subcontractors.

The Federal Risk and Authorization Management Program (FedRAMP) oversees the safe provisioning of cloud products and services from a Cloud Service Provider (CSP) to any government agency. As part of the FedRAMP authorization process, an accredited Third-Party Assessment Organization (3PAO) assesses the CSP’s controls under NIST SP 800-53, a security framework for federal government information systems. The 3PAO also assesses additional controls above the NIST baseline that are unique to cloud computing.

Contractors who supply products or services specifically to the DoD are subject to the Defense Federal Acquisition Regulation Supplement (DFARS). The DFARS standards establish compliance with fourteen groups of cybersecurity requirements under NIST SP 800-171, meant to protect Controlled Unclassified Information (CUI).  

In November 2020, the DoD released the Cybersecurity Maturity Model Certification (CMMC) framework, which builds upon DFARS. Contractors undergo an audit by a CMMC Third Party Assessment Organization (C3PAO), which issues a certification for the contractors’ assessed cybersecurity maturity level. The certification ranges from CMMC Level 1, indicating a low, ad-hoc maturity, to CMMC Level 5, indicating a high, optimized maturity. As contractors progress further up the DoD supply chain all the way to prime contractors—those working directly with the DoD—the DoD scale requirements for those contractors to meet higher certification levels. Meeting all DFARS controls and 110 controls in NIST SP 800-171 roughly correlates to CMMC level 3.

Cybersecurity Requirements of Executive Order 14028

Continue Reading Strengthening the U.S. Government Supply Chain: Cybersecurity under Executive Order 14028