united-kingdom gdpr personal-information
Practical GDPR guidance for online businesses
<p>When you start an online business, or even just create a website, there is a lot of confusion on what needs to be done to comply with GDPR. As many online resources (<a href="https://law.stackexchange.com/questions/77282/under-the-gdpr-in-germany-is-a-privacy-policy-required-when-not-tracking-any-pe">including StackExchange</a>) suggest, it is next to impossible to have a website and not fall under GDPR rules. Furthermore, there seems to be some confusion and back-and-forth on what is deemed compliant, and what's not.</p>
<p>If you want to clarify how GDPR rules apply in your case, the usual advice is to &quot;get a lawyer&quot;. However, this is not practical for many small starting online businesses that have no resources to pay for a full time legal advisor. So I am hoping to gather some practical tips about doing this without employing a lawyer.</p>
<p>First, let me lay out some assumptions on the nature of the business:</p>
<ul>
<li>It is new and small in every sense of the word: a few dozen customers, $1k-2k monthly turnover</li>
<li>It is based in UK</li>
<li>It is not dealing with extra-sensitive data like bank account numbers or identity documents</li>
</ul>
<p>And now some specific questions:</p>
<ol>
<li>What would be the best strategy in terms of &quot;cost vs reliability&quot; to ensure GDPR compliance? Would it be practical to follow one of the many GDPR tutorials online to choose a proper hosting, security measures, etc?</li>
<li>If I unintentionally use a non-compliant hosting configuration or a 3rd-party service like Google Analytics that transfers customers' data to a &quot;unsafe&quot; jurisdiction, what consequences is it likely to bring about? Are there any examples of this happening?</li>
<li>How severe should data processing faults be for the business to be facing serious fines and lawsuits (vs. just fixing the fault and issuing an official apology)?</li>
<li>What would be a sensible time to actually employ a GDPR advisor? Is this based on the kind of data that the company handles? On the number of customers? On the turnover?</li>
</ol>

<p>It is entirely possible to reach a reasonable level of compliance in a DIY approach, provided that you familiarize yourself with the relevant legal framework. The UK ICO has produced in-depth guidance to help here, which is significantly more digestible than the laws themselves:</p>
<p><a href="https://ico.org.uk/for-organisations/guide-to-data-protection/guide-to-the-general-data-protection-regulation-gdpr/" rel="noreferrer">ICO Guide to the UK General Data Protection Regulation (UK GDPR)</a></p>
<p>For a first reading, it is probably appropriate to focus on the summaries and checklists at the top of each section.</p>
<p>You will however notice that GDPR is a lot about <em>principles</em>, and requirements like selecting <em>appropriate</em> compliance measures yourself. On one hand, this means that you have some flexibility in your compliance approach, but it also means also that you can never be sure whether you're actually compliant. But this is also precisely why professional help can be valuable, since compliance professionals probably have a better overview of best practices, state of the art measures, and also potential pitfalls.</p>
<p>In some <a href="https://law.stackexchange.com/a/83897">other</a> <a href="https://law.stackexchange.com/a/83565">answers</a>, I have written basic overviews/checklists to get started with a GDPR compliance effort.</p>
<p>On to your concrete questions:</p>
<ol>
<li><p>What is the best strategy to get started with GDPR compliance?</p>
<p>This is ultimately a business decision that you have to make. You have to consider how much compliance is worth to you, both in terms of time and money. Maybe you can DIY it, maybe you'll want to get professional help, maybe you'll just hope that no one ever sues you or lodges a complaint. There is no objective optimum, and only you know your particular situation.</p>
</li>
<li><p>What are the consequences for unintentional infringement?</p>
<p>Not being aware of the rules is not a valid defense (<em>ignorantia juris non excusat</em>).</p>
</li>
<li><p>How are fines calculated?</p>
<p>The GDPR has two separate enforcement mechanisms: data subjects can sue you for compliance and damages, and the ICO can fine you.</p>
<p>Damages are typically small compared to the cost of a lawsuit.</p>
<p>When issuing fines, the ICO must consider a variety of factor per <a href="https://www.legislation.gov.uk/eur/2016/679/article/83" rel="noreferrer">Article 83</a>, for example whether the infringement was willful or negligent. The ICO is not required to impose damages, and anecdotally many small problems can be resolved informally before it comes to a full investigation.</p>
<p>In particular, the <a href="https://ico.org.uk/media/about-the-ico/documents/2259467/regulatory-action-policy.pdf" rel="noreferrer">ICO's Regulatory Action Policy 2018</a> explains that “we will reserve our powers [to issue fines] for the most serious cases, representing the most severe breaches of information rights obligations. These will typically involve wilful, deliberate or negligent acts, or repeated breaches of information rights obligations, causing harm or damage to individuals.” The policy also provides a 5-step process for arriving at fines: removing financial gain, accounting for scale and severity of the breach, considering aggravating factors, ensuring a deterrent for others, and considering mitigating factors.</p>
<p>This suggests that a good-faith effort to ensure compliance already goes a long way.</p>
</li>
<li><p>When to get professional help?</p>
<p>Under some circumstances, the GDPR <em>requires</em> that you appoint a data protection officer, who doesn't have to be an employee. You mention that you do not process sensitive data, so that it is currently unlikely you'd be required to appoint a DPO (compare Art 37, but note that the list of sensitive categories of data in Art 9(1) does not match your examples). The requirement to appoint a DPO depends entirely on the kind and scale of your data processing activities, not on number of employees or revenue thresholds. However, some GDPR compliance obligations like Art 30 Records of Processing Activities can also trigger when you reach 250 employees.</p>
<p>Aside from that, it is a business decision whether and when to invest in compliance.</p>
<p>Note that if your business offers goods or services to people in the EU/EEA, you may be required to appoint an EU representative. Some law firms offer package deals for DPOs + EU/UK representatives.</p>
</li>
</ol>
