GDPR checklist for Asian businesses selling to Europe

A GDPR checklist is worth starting now if your company in Asia sells to people in Europe. The General Data Protection Regulation, Regulation (EU) 2016/679, was adopted on 27 April 2016. It applies from 25 May 2018. That leaves less than three months. The law does not stop at the EU border. It can reach a firm in Singapore, Hong Kong, Tokyo or Ho Chi Minh City. This post explains who is covered and lists the first steps to take.

Does the law reach your company?

Article 3 sets the scope. It covers a business with an establishment in the Union. It also covers a business outside the Union in two cases. The first is when it offers goods or services to people in the Union. The second is when it monitors the behaviour of people in the Union, as far as that behaviour takes place there.

Here are some plain examples. An online shop in Seoul that ships to Germany and shows prices in euros offers goods to people in the Union. A travel site in Bangkok that tracks visitors from France with cookies and builds profiles of them may be monitoring behaviour. A supplier that only sells to other firms and never handles data about people in Europe may sit outside the law. Check your own case. If you are unsure, assume you are covered and plan from there.

Source: Regulation (EU) 2016/679, EUR-Lex, https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:32016R0679, Article 3

Step 1: Map the personal data you hold

Personal data means any information about an identifiable person. Names, emails, phone numbers, delivery addresses, IP addresses and order histories all count. For each kind of data, note the reason you gather it, the place it is stored, the staff who can open it and the outside parties you pass it to. Include payment firms, cloud hosts, email tools and delivery partners.

Article 30 asks controllers to keep a written record of their processing activities. A shared spreadsheet is a fair start. Update it when something changes. This map is the base for every other step.

Source: Regulation (EU) 2016/679, EUR-Lex, https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:32016R0679, Article 30

Step 2: Check your legal reason for each use

The regulation expects a lawful reason for each way you use data. Consent is one reason. A contract with the customer is another. Each use should match a reason you can name. If you rely on consent, it must be freely given, specific, informed and unambiguous. A pre-ticked box does not meet that bar.

Tell people what you do with their data in plain words. Say who you are, why you collect the data, how long you keep it and how they can contact you. Rewrite your privacy notice so a customer can read it in one minute. Then make sure people can ask to see their data, correct it or have it erased, and that your team knows who answers those requests.

Source: Regulation (EU) 2016/679, EUR-Lex, https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:32016R0679

Step 3: Name a representative in the Union

Article 27 applies when Article 3(2) applies to you. A company outside the Union must then designate in writing a representative in the Union. The article lists limits. It does not cover occasional processing where risk to people is unlikely, and it does not cover public authorities. Most regular online sellers should expect to need one. The representative can be a person or a firm based in a Member State that is home to some of your customers. Agree the role in writing and give the representative your records when asked.

Source: Regulation (EU) 2016/679, EUR-Lex, https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:32016R0679, Article 27

Step 4: Plan for a data breach

A data breach is a leak, loss or theft of personal data. Article 33 says the controller must notify the supervisory authority without undue delay and, where feasible, not later than 72 hours after becoming aware of it. Notice is not needed when the breach is not likely to create risk for people. Write a short response plan now. Name who decides, who calls the authority and who writes to affected customers. Keep a log of every incident, even small ones.

Also look at your suppliers. If a cloud host or mailing firm handles data for you, a written contract with that firm should set out what it may do with the data. Ask each one how it will tell you about a breach.

Source: Regulation (EU) 2016/679, EUR-Lex, https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:32016R0679, Article 33 and the regulation as a whole

Step 5: Decide on risk checks and a data protection officer

Article 35 requires an impact assessment before processing that is likely to result in a high risk to people. Large-scale use of sensitive data is one named case. Article 37 requires a data protection officer in certain cases, such as large-scale monitoring of people or large-scale use of sensitive data. Read both articles against your own work. If neither applies, write down why. That note shows you thought about it.

Then look at the cost of getting it wrong. Article 83 allows fines reaching 20 million euros, or 4 percent of a company's total worldwide annual turnover, for the most serious breaches, such as breaking the core principles or the rules on people's rights. Some other duties, including several of those above, carry a lower cap of 10 million euros or 2 percent. Regulators can order fixes as well.

Use the weeks left well. Map the data first, fix the privacy notice second, name the representative third, and test the breach plan last. This is a general guide, not legal advice. For your own case, speak with a lawyer who knows EU data protection law.

Source: Regulation (EU) 2016/679, EUR-Lex, https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:32016R0679, Articles 35, 37, 83 and 99

Sources

Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016, EUR-Lex: https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:32016R0679