Is Your Small Business GDPR Compliant?

Business Tips

Mar 15

Disclaimer: I am NOT a legal expert and this post does not constitute legal advice.

Hmm... GDPR? What?

The General Data Protection Regulation (GDPR) is a law that regulates how businesses are collecting, using and processing data from EU citizens. Even if your business is located outside of the EU you are affected if you have EU customers who give you personal data, such as a name and email address.

Many small businesses owners are quite confused as to what they need to do. Much of the GDPR language is aimed at large corporations but don't be fooled - even if you are a single person business you need to comply.

In the following I provide an overview of the most important aspect of the GDPR in relation to small online businesses as well as Squarespace, and some useful links where you can learn more about this subject.

Some of the GDPR highlights:

Explicit Consent
You will need to get explicit consent from your customer to collect and use their data. This could be updated language at data collection point and/or double opt-in.
Use and Transfer of Data
You need to make it very clear to your EU customers how you are going to use their data. For instance, if you are transferring their data to a 3rd party (e.g. Mailchimp) you need to get their permission for this.
Data Processing Agreement (DPA)
It is highly recommended to sign a Data Processing Agreement (DPA) with any 3rd party data processors you are working with. In my case this would be Squarespace, Stripe, PayPal, Mailchimp and 17hats. I already did this for Mailchimp and have requested DPA's from the others by writing to their customer support.
Privacy Policy
Update your Privacy Policy to include specific info on how you are collecting, using and processing your clients' data and how you comply with the GDPR. I use this service (affiliate link) for my Privacy Policy and Terms & Conditions. Love Termageddon, they update my privacy policy automatically and also offer excellent service!
Data Access
You must make information about their data easily available to your customers if they ask for it. And delete it if they request that.
Non-Compliance
Non-compliance can result in very high fees, like up to EUR 20 million! This is clearly aimed at large businesses but even as a small business you can get fined. Now how this would be enforced for non-EU businesses I don't know. And I don't worry about this too much, either. The main point of the GDPR is to protect private citizen data and there are already a lot of measures in place for this (like the EU-U.S. and Swiss-U.S. Privacy Shield Frameworks), the GDPR just takes it up a notch.
Anyone can Report you for perceived Non-Compliance
Regardless of whether someone is the victim of your alleged non-compliance or just a by-stander (for instance a competitor!), apparently anyone can report you if they think that you are not compliant.

→ Here is a great article that explains it in more detail in plain English

What about Squarespace?

Consent at Check-Out
If you sell products through Squarespace there is an option at check-out where your customer can subscribe to your newsletter. You can currently turn this option on so that it's already checked by default, and the customer can just uncheck it again when they check out a product. This will no longer be considered compliant under GDPR so it’s important to uncheck this option.
Consent at Data Collection Point
I use Squarespace Campaigns for my email marketing. There is no consent check box on Squarespace forms but you can use either double opt-in or Google reCaptcha to ensure your subscribers explicitly agree with being added to a list.
Data Processing Agreement
When you agree to the Squarespace Terms of Service, you also agree to their DPA. You don't need to request or sign a separate physical document. Review the Squarespace Privacy Policy and DPA.