The General Data Protection Regulation (GDPR) is going to affect all companies: large wholesalers and home restaurants alike. A lot has been written on this topic, but many articles are overwhelming or leave your questions unanswered.
 In this post, we will explain what kind of requests you may expect from your customers, and how to protect customers' information in Erply.
Here is our previous overview of GDPR.

The goals of GDPR

The regulation has been put in place with the following goals in mind:

The scope of the regulation

The GDPR applies to businesses of all sizes as long as they have customers or staff in the European Union.
 If your company operates in the European Union, note that GDPR grants equal rights to all your customers, including non-EU customers.

What counts as customer data processing?

Anything, really.
 Data processing begins with entering a customer’s data into Erply and ends with deleting that customer’s records.
 Everything in-between counts as data processing too, including:

How do I collect customer consent? How do I inform customers about data processing?

There are two important requirements which will likely require you to update your membership application forms (paper or electronic), and your service terms and conditions:
 
1. The customer must be informed of how their data will be processed.
 
Before collecting any personal information, you must explain to the customer what purposes their data will be used for. This is a great opportunity to explain how your customers can benefit from data processing.


You must also keep a list of all sub-processors, or companies whom customer data is shared with. Customers may request a list of companies processing their data. Erply, naturally, is among those. If you use a webshop or use custom integration, there may be more parties involved.


Explain who is responsible for the customer’s data and how it is kept secure.


Full requirements for disclosure are listed in GDPR Article 13.



 






2. The customer must give their consent for each data processing purpose.
 List your data processing purposes. These are likely specific to your company. It is important that these purposes are described in plain language and in a straightforward manner. Customers should not need a legal advisor to understand your data processing purposes.


For each data processing purpose, the customer must give their consent by ticking a box. On an electronic form, the boxes must not be ticked by default.


Your company must store the paper forms or the electronically submitted information, to be able to refer to these consents later if needed.


Erply does not provide data fields for storing these consents, other than an
"Email opt-out"
 checkbox on customer form. Data processing purposes are specific to each company and we do not know what your exact purposes are or how many different purposes there might be.
  

What other rights do customers have?

GDPR grants individuals a number of rights. Privacy-minded customers will certainly find these new opportunities welcome, so be prepared to answer the following questions.
 
Note: Always require the customer to show a proof of identity. Disclosing or modifying the information of the wrong person is a serious offense.
 
1. What information is being stored about me?
 
Full information about a customer can be found on the customer card in the back office. Review it as needed:


Being Gdpr Compliant With Erply blog post image

 






2. I want to have a copy of my data.
 Under GDPR, individuals may request a copy of their customer card and their transaction history. An electronic file containing this information can be downloaded from customer card:

Being Gdpr Compliant With Erply blog post image

3. I don't want my information to be used for …
 Consent is not permanent. Allow customers to easily take back their consent.

 
4. I want to update or remove my information.
 Upon request, update information that is out of date.


Customers can also ask their personal information to be removed from your system. In that case, make sure that they do not have any unpaid invoices.
   Set up internal processes to handle these requests. Instead of deleting a customer card entirely, you may want to only clear the respective fields requested to be cleared. Be proactive about data changes and have cashiers ask customers to confirm their phone numbers and email addresses at least once a year.

What personal information is stored in Erply?

Personal data, which you might have stored in Erply, may include:
Three important rules apply when becoming GDPR compliant:
Sensitive personal information includes:

Review and minimize the amount of data your business stores

As a first step, make an inventory of all personal data you hold and ask the following questions:

Amount of stored personal information should be minimal.
Keep only what you actually need (and have lawfully acquired) and delete the rest.
 
Tip:
if you are working with corporate customers, you can refer to the companies' contact persons by their job position, not by their name. This way, the phone numbers and emails stored in Erply cannot be used to identify an individual, and will thus not be personal information.
   Being Gdpr Compliant With Erply blog post image  

Anonymize customer information

An "anonymized" customer record is one that contains no personally identifiable information:
   Being Gdpr Compliant With Erply blog post image   Since you can identify the customer by their loyalty card number, there is no particular need to store their name or email address.
 This way, the customer can remain anonymous, if requested, and will still retain reward points balance, personalized coupons, loyal customer pricing, and other benefits. And you still have their detailed purchase history.

Does Erply log data processing activities?

Yes and no.
 Yes — for everything that you do in Erply, we keep a log. Just like the regulation requires.
 We cannot, however, track customer processing that takes place outside of Erply.
 
For activities outside of Erply, you need to:
        a) Keep a separate log elsewhere
        b) 
Write these data processing activities into Erply’s log using an API call
 This includes all cases where:
If you use any of the following services, you may want to check if they provide the necessary logging. If not, you may need to implement a logging solution yourself.

Note:
Customers themselves do not have the right to request a copy of their log. Logs are kept only for the — hopefully unlikely — case where a customer files a complaint. This can result in your local supervisory authority launching an investigation and asking for your business to provide the relevant logs. In that case, we will help you.

Important safety measures you should implement

Here are our recommendations for keeping your customers' data safe:
 
1. Do not keep customer information on your computer.
 
If you must export customer information to Excel, be sure to delete the data immediately once it is no longer needed.

 






2. Do not use personal computers or devices for doing work.
 Instruct employees to never use their personal devices to log into Erply or any other service in which you keep customer data. Ensure that office computers are configured securely, and are free of viruses and malware.
 
3. Use strong passwords.
 Your customers' data is protected by the password that you use for logging into Erply. If a breach occurs, your business is liable. A password should be sufficiently long and consist of random characters, digits, and special symbols.

4. If a customer files a request, ask for their ID.
 Make sure to identify the customer before you disclose any personal data to them. Only disclose data once you have confirmed the recipient is who they claim to be.

5. Map your internal processes.

It is easier to plan your data protection measures if you make a list.

6. Train your employees.
 
Share this article with all your employees or colleagues. For employee onboarding, we have a solution — see below.

 






7. Report data leaks.
 In case of data leaks, unauthorized access, or any security breaches involving possible access to personal data, your business is responsible for informing local authorities no later than
72 hours after detecting the breach. You are obligated to inform all parties to the data about the incident, including the customers whose data was compromised.


8. Verify your third-party processors.
 Make sure that the third-party processors that you use comply with GDPR. You, as the Controller, are solely responsible for assessing the adequacy of your authorized processors.
  

Employee onboarding

We strongly recommend to set up an onboarding process and make sure that employees get a proper training and an overview of data protection principles before they are granted access to customer information.
 
The solution (which is available in the Erply app store
) is as follows:
  1. Ask Erply customer support to enable a data protection module on your account.



    Erply’s data protection module will display an informative pop-up to each user and will ask for their confirmation before they can proceed:

    Being Gdpr Compliant With Erply blog post image Alternatively, you can enter the confirmations manually on employee form.

     
  2. Confirm employee's access to customer data:


    Being Gdpr Compliant With Erply blog post image 
  3. When all employees have been onboarded, enable restrictions from the
    Settings → Configuration
     page:


    Being Gdpr Compliant With Erply blog post image

Final words

These suggestions will help you lay a solid groundwork for GDPR compliance. We hope you have found them helpful, and that you now have an idea of next steps that need to be taken to become GDPR compliant.
 We are planning to offer a few more GDPR-related features in Erply. Stay tuned!