What Constitutes Personal Data & Why It’s Important | With Data Protection Expert Thomas McNamara

So from my understanding, I understand personal data is protected under the GDPR, but for those people that don't understand, what constitutes personal data specifically, and can you give an example, and why is this important for people to know? To pay attention to?

Yes, so personal data is very much data that's able to identify an individual or it's relating to an individual. So it doesn't cover like company data, it doesn't cover data that's not related to a person. So all these regulations, the GDPR, are very much based on the individual's rights and protecting their data. So for example, you've got the very basic stuff. You've got like bank account details, names, address, date of birth. They're your standard personal data. And then you've got what's called special categories of personal data, and that includes health-related data, data related to political opinions, your sexual orientation. And you can obviously see why that type of data would be given a special status. Obviously, that's the type of data that if it was disclosed could have potentially harm to the individual. So as we see, personal data is really about you, about you as a person. So the reason it needs to be protected is because, like, everybody has this right to privacy. You should have the right to disclose your data as you wish, and that data should only be used as you've given your permission for it to be used.

Makes sense. And then, you know, is that the same for B2B SaaS as well, or is that a little different?

Well, so B2B SaaS are usually processing data on behalf of their clients. So while the data wouldn't originate within the business, they're known as data processors when you're working in that B2B capacity. And there is— you've got the same responsibilities in terms of protecting the data and only using it for specific reasons. But I guess ultimately your client in that B2B situation would have the higher level of responsibility, but that's why they contract with you. And you've got those big data processing agreements and contracts that assign liability and the likes when you are dealing with a client in a B2B relationship.

Yeah. So, you know, a lot of our audience and people who listen to our show, SaaS District, are SaaS founders or probably marketers or involved in the SaaS space. At what point should When should a SaaS founder really look at, look, I need to build, start thinking about creating a GDPR compliance program? Is this right at the beginning and as soon as I launch, or is this kind of later stage? And why do you think, why is it important to have that data protection in a SaaS business?

Yeah, so I think it's super important from the outset that at the very minimum, the founders know kind of what they have to do. What are the general principles in the area? Now, they don't have to be like experts, but there's a ton of resources out there from regulators that kind of point you in the right direction. So in the UK, you've got the Information Commissioner's Office or the ICO. In Ireland, you've got the DPC and there's one in each country across Europe. And they've got really good information out there. So I think it's really important that founders at least educate themselves on what's required from the outset. Then launching a SaaS business. So specifically launching a B2B SaaS business. You won't get in the door with clients unless you've got a strong program, and more so as you move up the chain. So when you're looking at enterprise clients, they'll really want to pick apart your data protection, your data privacy program, to ensure that they've got the minimum amount of risk when they're sharing their data with you. So I think it's super important. And as we mentioned before, SaaS is SaaS is all about growth. And without that solid framework, it's going to be hard to attract clients, especially in the B2B SaaS space. So you've got some basic things like your data processing agreement is a contract that is required by data protection laws across Europe that between what we call the controller, which would be the SaaS company's client, and the SaaS company, which is known as the processor, and it's called a data processing agreement. And if you don't have that, legal document, then there's no way for them to send data to you. And obviously you can't deliver your service. So it's kind of, it's very core to a SaaS business to make sure that they've even got the foundations of a program before they start going looking for clients. Okay. Maybe before they have an actual product and they have something to sell, you can put it off till then. But once you're actively in the market looking for clients, you need to have your documentation. You need have your program in place to be able to put those clients at ease that you share data with us. There isn't going to be a breach on our end, which is going to drag your, your company's brand through the, through the mud.

And who's typically like with an enterprise client like that where you're working with and you're, you're, they're sharing a lot of confidential data. If you don't have your ducks in a row, so to speak, who is actually liable for that? If some, some breach happens, is it the enterprise client or is it the SaaS company?

Yes. So both can be responsible. If you've done everything that was required of you through the contract, then you'll be able to claim that you've got limited liability. If they— if the breach was just a human error, then it's unlikely that you'd be held responsible. But if the breach was due to a lack of security controls on your behalf, then you would be seen as, as liable for that breach. So it kind of really depends if you've been doing everything that's required of you in the business, then the, then the client would have no avenue to say, okay, we're suing you, or we're invoking this agreement, which, which puts the liability on you. But ultimately, the responsibility lies with, with the client because they're seen as As I mentioned, the controller of the data. So they, they've taken the data from the individual and the individual might know about the SaaS company operating in the background.

Yeah.

But while the controller is the first, like has the first line of liability, it'll be written into your contracts with the, between you and your client that if the problem happened on, on your end, then you will be responsible for it.

Makes sense. So it could fall back to you. And for the SaaS companies who— so assuming that people have it in place, they have an established program, they've thought it through, they're working with enterprise clients, you guys come in and you probably find some kind of flaws. You guys do audits to help them improve it and become more reliable and build more trust with their clients. What does an audit typically entail and typically look like? What are you guys finding there?

Yeah, so we really do audits and look at companies that maybe had a really strong program in 2018 when the GDPR all came about, and there was a big focus on it. So people might have put a lot of effort into it at the time. But unless you're constantly keeping this up to date, and you've got your records of processing, you've got your data flow maps, and you've got all your documentation up to date, like unless there's somebody responsible for keeping that up to date, it tends to go stale quite quickly, especially in the startup phase. Obviously things happen a mile a minute. And like you've got teams that change their direction. There's pivots happening. And perhaps what was a reflection of the business back 18 months, 2 years ago, isn't really a reflection of the business now. So when we're doing audits, like, so the audits are either, they can be like company-led where a founder says, okay, we need to look at this again. It could be from a catalyst, like, okay, an enterprise client wants to see our documentation. We're not too sure if this is in a good space. We want to win this business. Or else it could come the investor point of view. So investors doing their due diligence, if they're working with a company who says they're the revelation when it comes to data, etc., etc., the investors may want to do some due diligence. Okay, we'll audit their data privacy practices, see if they're living up to what they've told us. But in general, when we go in to have a look, it's really that we're looking at what documentation's in place, what policies and procedures in place, and see if that's actually reflective of the business as it stands. And then we tend to— again, so coming from a compliance background, it's all about compliance and risk. So I'll be able to rate your risks on a scorecard and like identify what needs to be approached straight away versus something that can maybe we can work on in the medium to long term.

Makes sense.