3 ms·

How does GDPR affect your business? You're not really responsible for anybody's data, presumably you inherit the policies of your customers.

BjoernKW 8y ago
First, I'm responsible for handling my clients' data, such as their email addresses or phone numbers. It doesn't matter that they're business customers rather than consumers. GDPR still applies. Secondly, though not always the case, I might have to process their respective customers' data in some way in order to do my job (by having access to a production database, for example). So, yes, GDPR absolutely does apply to my business.
- cfitz 8y ago
  Can you please share how GDPR affects the second workflow? I'm curious, as I've performed similar work.
  - BjoernKW 8y ago
    It means that in that case I have to provide my client with a data processing agreement and handle data accordingly. Basically, it means that what's been best practice all along is made explicit. So, in most case this doesn't affect the actual workflow all that much. However, in the past occasionally clients could be quite liberal in handing out access to their production data. GDPR definitely has raised awareness that this isn't something to be taken lightly.
- BigMan555 8y ago
  So you're saying that you are asking consent to store the phone number and email address of a client? And you'll provide clients with the right to be forgotten, meaning that you're prepared to delete their contact information? This seems like overkill.
  - BjoernKW 8y ago
    > So you're saying that you are asking consent to store the phone number and email address of a client? No, I didn't say that. GDPR doesn't mean that you have to ask for consent in each and every case. If as a business you have a legitimate interest to store client data for a specific purpose you don't have to ask for explicit consent. Being able to contact clients in the future who contacted you first constitutes such a legitimate interest. As for the right to be forgotten: Sure, why wouldn't I? If they don't want to be contacted anymore and want me to delete their contact info I'm happy to oblige.
    - anothergoogler 8y ago
      Past invoices will have names and addresses, will you shred them? Don't you need them to file taxes?
      - BjoernKW 8y ago
        Existing laws and accounting standards still take precedence over GDPR. Past invoices and accounting entries remain as they are.

BjoernKW 8y ago

First, I'm responsible for handling my clients' data, such as their email addresses or phone numbers. It doesn't matter that they're business customers rather than consumers. GDPR still applies. Secondly, though not always the case, I might have to process their respective customers' data in some way in order to do my job (by having access to a production database, for example). So, yes, GDPR absolutely does apply to my business.

cfitz 8y ago
Can you please share how GDPR affects the second workflow? I'm curious, as I've performed similar work.
- BjoernKW 8y ago
  It means that in that case I have to provide my client with a data processing agreement and handle data accordingly. Basically, it means that what's been best practice all along is made explicit. So, in most case this doesn't affect the actual workflow all that much. However, in the past occasionally clients could be quite liberal in handing out access to their production data. GDPR definitely has raised awareness that this isn't something to be taken lightly.
BigMan555 8y ago
So you're saying that you are asking consent to store the phone number and email address of a client? And you'll provide clients with the right to be forgotten, meaning that you're prepared to delete their contact information? This seems like overkill.
- BjoernKW 8y ago
  > So you're saying that you are asking consent to store the phone number and email address of a client? No, I didn't say that. GDPR doesn't mean that you have to ask for consent in each and every case. If as a business you have a legitimate interest to store client data for a specific purpose you don't have to ask for explicit consent. Being able to contact clients in the future who contacted you first constitutes such a legitimate interest. As for the right to be forgotten: Sure, why wouldn't I? If they don't want to be contacted anymore and want me to delete their contact info I'm happy to oblige.
  - anothergoogler 8y ago
    Past invoices will have names and addresses, will you shred them? Don't you need them to file taxes?
    - BjoernKW 8y ago
      Existing laws and accounting standards still take precedence over GDPR. Past invoices and accounting entries remain as they are.