MBA1009 5 Things You Need To Know About GDPR

Hey O. Welcome to the Hundred Dollar MBA show, the business podcast that gets straight to the point and gives you the business lessons and insights that you need to build a better business every single day with our daily 10 minute business lessons for the real world. I'm your host, your coach, your teacher Omar Zenholm. I'm also the co founder of the $100 MBA, a complete business training and community online over at 100mba.net and in today's lesson you will learn the five essential things you really need to know about GDPR if you run a business and have an online presence. I'm sure you've heard about all the buzz of GDPR. It's like the modern day Y2K, but what is it and how can you prepare for it? There's a lot of misinformation out there, there's a lot of confusion and there's also a lot people don't want to get caught doing something wrong and getting fined big time. GDPR stands for General Data Protection Regulation and it's the legislation that has been passed in the eu. Even if your business is not based in Europe, if your customers or anybody who interacts with your website that provides information is from Europe, you need to be GDPR compliant. That basically means every business that has a website because you can't help if somebody from Europe will stumble upon your website and provide information. So let's make sure you're ready and you do the essential things to protect you and your business. Let's get into it. Let's get down to business. Today's episode of the $100 MBA show is supported by Earth ClassMail. If you run a business, you need a business address, but it doesn't mean you need to open up a business office. You can work from Home and Earth ClassMail can hook you up with a business address and scan all your mail and upload it to your account in the cloud so you can check all your physical mail anytime, anywhere. I love it. I love it, I love it. And we use EarthClassMail because we love it so much. And Earth ClassMail wants to hook you up with a free month to get started. Just go to earthclassmail.com mbamonth again, it's earthclassmail.com mbamarth use coupon code mbamonth. A couple things I want to mention I want to say before we start today's lesson. First of all, a big shout out to Angela Bacco. Angela tweeted at me on Twitter with the suggestion to do today's lesson. Thanks for the Suggestion. As soon as you tweeted at me, I thought to myself, hey, our business has been working hard on being GDPR compliant, putting all the pieces together. So why don't I share what I know? So part of that preparation is the second thing I want to mention. Please take on today's advice. But my overarching advice is make sure that your privacy policy and your terms and conditions and being GDR compliant is run by your business lawyer. If you don't have a business lawyer, you should get one. We absolutely love our business lawyer, David Liserbram. He was a guest teacher on our show before, actually, so you could check out his episode. Even though we've done all our homework and have done everything to be GDPR compliant, we run our policies by David, our lawyer, to make sure that we didn't miss anything, that we've dotted all the I's, crossed all the T's. You get it? Now, if getting a business lawyer is kind of an intimidating thought to you, I want to kind of tell you that it's actually not as expensive as you may think. Something like this may not cost you an arm and a leg. Even if your lawyer has high consultancy rates, this is not going to take them hours upon hours. And it's well worth it because the fines of not being GDPR compliant are seriously hefty. All right, let's get into today's lesson. The first thing I want to talk about is what is gdpr? So again, it stands for General Data Protection Regulation. And it's a regulation that was actually created and passed in 2016 in Europe. But they've given companies time to implement this, to get ready for it, and the deadline is actually May 25, 2018. Now, you might be thinking, oh, no, this is crazy. I don't have much time. It's okay, because you might find that what you do on your website is already GDPR compliant. Just have to make sure you update your privacy policies and this could be a few hours work. And again, cross it by your lawyer. Now, what is gdpr? What's the spirit of GDPR is very important. The whole reason why they pass this law in Europe is to protect European Union members, European Union citizens and their data. They want to make sure that their data is not easily found and also not easily leaked. With everything that has gone on in the news with data breaches, GDPR wants to make sure that if you have data on somebody and don't need it, that somebody, that someone should have the right to tell you, hey, delete my data. So basically the EU has passed this regulation to give the power back to the user when it comes to their data. And again, this applies to anybody who's part of the EU that lives in the EU and is interacting with your website. So basically this could be anybody because you don't have control over who goes to your website. Now you might be saying, hey, I'm a speaker, I'm an author, I sell my books on Amazon, I don't really need to worry about gdpr, I don't have a business online. If you collect any kind of data, whether it's IP addresses, whether it's email addresses, if we're growing an email list, which you should, this is normal, that's data. You're collecting somebody's email address. If you're tracking people's visits through Google Analytics, there's a good chance you're tracking their IP address. So pretty much any presence online, let alone if you're collecting any other kind of data, like their address, their name, any kind of conversations you've had with them through your, you know, maybe your online course, your membership, your software, whatever it is, if you're collecting any kind of data, you're in this boat, you need to make sure you're GDPR compliant. So the number one thing I wanted to mention is that kind of the spirit of what GDPR is protecting people and their data. Alright? The second thing you really need to do or examine or my biggest insight to kind of tell you this is what you need to focus on, on GDPR is you need to take a look at how you handle people's data. So here's basically the key. You need to only collect the data you actually need and then you only should keep that data for as long as you need it. So if, for example, you have somebody sign up for your online course, what do you really need? For them to sign up, you need their name and email address and obviously they have to pay. So they provide their, you know, physical address as well as their billing address, all that kind of stuff, right? Physical, if you're delivering something, if not, no problem, you still need a billing address. Now when it comes to billing, my personal advice is to get another company to handle all that, whether it's Stripe or PayPal or whatever that point. And then you can mention in your policy that, hey, when it comes to your payment processing and all the data that is stored on PayPal and PayPal is GDPR compliant, and if you need that information ever deleted at any time, you can email us and let us know, and at that point you go to PayPal and PayPal should have a procedure on how to delete their information. Same thing goes with your email marketing software, Mailchimp or ActiveCampaign. But on your website, you're saving some people's data, like their name, their email address, maybe their address, maybe their IP address. Your job is to collect as minimum data as possible and then have a procedure when they are not a actual member, to delete their information. You don't need it anymore, and this is a good way to protect yourself. The other thing about GDPR is if a customer comes to you and says, hey, I want all my information deleted, you need to have a procedure to delete that immediately. Now, this should be simple. If you have a simple website and you can just go to that user and delete that user from your database, you need to make sure that actually gets deleted from your server. So contact your host. And again, same thing goes if you collect data with other tools, whether it's with Mailchimp or ActiveCampaign or Sumo, or you're collecting data through your payment processor, or you have a customer service app like Zendesk or Intercom and you have conversations and data on that person. Intercom will walk you through and show you how to delete that information. So you're going to have to train up your customer service team to to delete information when a customer requests it. And you should have an internal system to delete information once they're not a member anymore. Now, legally, GDPR doesn't tell you that you have to delete information automatically when they're not a member. This is just sort of an advice that I'm trying to give you or a piece of advice I'm trying to give you. The law says if the customer requests deletion, you need to be able to delete that immediately. The other piece of the puzzle is if they request the information that you have. So a customer may say, I want the information that you actually store. I don't actually want you to delete it, but just, I want to know what you have on me. You should be able to provide that within 48 hours. And again, this is something as simple as, hey, we collect this information and it's all like your name, email address, you know, your personal address. When it comes to your payment information, PayPal stores that information and that's GDPR compliant. We don't even see your credit card information. So for us as well, like our businesses, we don't have access to their actual credit card numbers or anything like that. And we don't want to, we want somebody to have that responsibility that's super, super security like Stripe and we mentioned that to them. So if they request information, we could tell them the information that we actually have and own and the ones that are being processed or handled by other vendors, we tell them that as well. All right, tip number three, make sure your storage systems are secure. If you're using some really cheap servers or hosts out there, you really need to reconsider if you're using a host where your website has been hacked before, things like that, you need to really look at spending a little bit more money for more security. You know, if you use something like a Weebly or if you use servers for your app like Amazon, you're in good shape, they spend a lot of money on security. So make sure you invest in security in your actual website servers. Number four. And this is kind of a, you know, a high level something that you need to consider if you're starting to grow your team. But even if you're a small team, you need to make sure there's somebody who's responsible in the organization for the data you store. You need somebody responsible for data protection. For us we have Steve. Steve is our Server admin and DevOps and he's responsible for everything that's stored in our business. I've worked closely with him and our lead developer Shane on working on our GDPR policy and making sure everything's up to snuff and that we're doing anything right. But at the end of the day I should be able to call somebody really quick and say, hey Steve, we'll have a user here requesting their data or they're requesting for the data to be deleted. Can we make sure that happens? And then he needs to ultimately be responsible or she needs to be ultimately responsible in your organization. I have one more tip, one more essential thing you need to know about gdpr. But before that, let me give love to today's sponsor. Let's say you make Danish inspired urban clogs. And let's say you want to start selling those gorgeous shoes online. Well, creating a beautiful website is a good start. But you know what's even better? A powerful website with Weebly, you don't just get great looking online store templates. You get all the tools you need to build your brand, promote your products, process payment, manage inventory, send marketing campaigns and more. I'm talking a lot more. And it's all wrapped up in one neat little package designed to turn your idea into a thriving online business. Plus, they've got an epic support team. No scripts or robots, just friendly experts whose job is only to help you do whatever you're trying to do. So whether it's lavender biscotti or distressed denim sofas, Weebly turns your idea into a powerful online store. Because success isn't just getting your products online. It's getting them in the hands of your customers, who will love them. And as fans of the $100 MBA show, if you go to weebly.com mba, you'll get 15% off your Weebly online store. That's W E e b l y.com MBA weebly more than just a beautiful website. Alright, tip number five live. And this is a general tip. Just to kind of put this all in a nice neat bow. The attitude and your spirit when it comes to GDPR should basically be you want to respect your customer's data, you want to treat it with respect. And if you come with that angle, you'll just say, hey, I just need to show that I care about my customers and my visitors information. I want to make sure they feel safe and protected when they interact with me. And that's really the tone of the way you want to address your DDPR policy, which is rewriting your privacy policy. You want to make sure your customers that read your privacy policy know that, hey, we take your privacy extremely seriously. We think it's extremely important for us to make sure that you feel protected and are protected. So this is what we do with your data. This is what we collect, this is what we need it for, and this is how we delete it. And if at any time you want us to delete it, please contact us and we'll do it immediately. If you want to know any of the details of your information, please email us and we'll provide that. Make sure it's clear that this is a top priority and also make sure it's clear that, hey, you're only collecting the data that you need. That transparency will go a long way. And really, that's what GDPR is all about. They want to make sure the EU wants to make sure that, that their citizens are protected and cared for. All right, that wraps up today's lesson. Again, take a look at today's notes, take a look at today's lesson. Make sure you know what you're storing, how it's stored, and how you can delete it or share it with your customers. Rewrite your policies, pass it on to your lawyer and you're good to go. So if any of our wonderful European friends visit our websites, they know you got their back. All right, thank you so much for listening to the Hundred Dollar MBA show. Remember, we publish an episode every single day, five days a week, and tomorrow is Wednesday, where we answer a question from you, one of our listeners. Tomorrow's question is, how can I save money with my payment processor? I answered that question on the show. So make sure you hit subscribe so you don't miss it. Alright, before I go, I want to leave you with this. I was one of those people that really, really hated all this technical legal mumbo jumbo. It really just was like a downer on business. And I was like, oh, I just don't want to deal with this stuff. But I've learned to kind of just say, hey, this is just part of business and let me just do it right and get it done with. And there's nothing wrong with getting a little help with a lawyer. So actually having a good attitude about it and just realizing, hey, I gotta do this, let me do it right. Let me make sure that my customers know that I care about them. And this is sort of a way of marketing. So it's actually a marketing exercise in a way. If you want to frame it that way to make it easier for you, get it done and be done with. It's like taking out the garbage, right? All right, I'll check you in tomorrow's episode. I'll see you then. Take care, Sam.