Best Practice handling of customer data in preparation for GDPR

Companies should be planning right now for GDPR, and start to implement GDPR-lead best practices into daily operation in preparation for GDPR coming into force.

 

All companies should be fully up to speed no later than in February 2018 or they will be caught up in the permissioning rush, because after that it will likely be too late. This is crucial for all first and zero party data, and should be a major consideration for 3rd party data as well.

 

Here are the key best practices we recommend everyone undertakes, or at least starts to prepare for right now:

 

Interest-lead Sign-ups

 

Have users sign up around interests rather than brands or specific events. Users who sign up around interests are more likely to stay connected than those tied to specific events and brands. Permissioning around single events does not give companies the right to market alternative, or even future events to customers under GDPR. However customers who sign up for news and event alerts around given topics and interests can provide you with longer term, and broader-based permissioning, and is a win for both sites.

 

Profile Interests

 

Maximise the permission-based profiling by of your audience by capturing the interactions and interests wherever users have given you permission to do so, and ensure the data sits directly with the core audience CRM. This means that you can maintain user records for longer, as you capture a broader range of interactions, and it means your insight allows you to target them in a much more engaging manner around their current interests.

 

Micro Targeting

 

Every customer who opts out of marketing is out for good under GDPR, or at least until they re-engage and re-permission you to send them further marketing communication. This is why you need to make sure that you are targeting users on their specific current interests. Under GDPR you can not simply create new mailing lists to target users who have un-subscribed from your marketing. They will be gone.

 

Daily Message Caps

 

Limit the number of messages sent to each individual on a daily, weekly and monthly basis to only those which are most relevant to them. If you find yourself sending more than three marketing emails in a day you have breached best practice, even more than one could be seen as risking the relationship. You should therefore set up daily message caps that hard block you from sending too many marketing related messages.

 

No last minute blasts

 

You will massively degrade your CRM by doing last minute blasts for events to your entire audience CRM to see if you can get any final sign-ups. Every one of the members on your mailing list who un-subscribes may never come back. Instead of trying to think of everyone you can include on a mailer, focus on everyone you should exclude instead so that you only target the most interested and relevant audience for each event. You can then invite the engaged audience to share with their contacts whom they know might be interested.

 

Better Safe than Sorry

 

Seek GDPR compliant permissioning in February or March 2018 at the latest for GDPR compliant marketing. There will be an absolute flood of permissioning emails, calls and communication to your audience in general as we get close to the May 2018 deadline for having your marketing campaigns fully permission based. You will want to beat the rush or face the reality that most of your audience will become out of easy reach.

 

Permission Restricted Data Sharing and Buying

 

Not only will you not be able to blanket sell contact details any more once GDPR goes into place, you will no longer simply be able to buy them in. GDPR enforces that whenever seeking marketing permission all the companies with whom the data and permission is being shared with must be named in the original sign up statement.

 

This means you simply can’t have a white paper download library with common permission for sharing data for all downloads; and it means that you may well not be allowed to use the data you’re buying unless it has the explicit permissioning in place requried by GDPR.

 

Terms and Conditions

 

You will need to re-seek permission each time you change the way you profile or use your customer data, and you are not allowed to hold or use it in a way which is not in their interests under GDPR, or through alternative permissioning.

 

It means you should establish GDPR compliant practices as soon as possible and ensure that your audience has signed up for those explicitly. Without doing so and without that explicit permission you may not be able to hold their data any more.

 

Note that if you change how you are profiling your audience, or add new personal data fields to their records, then you may well need to re-seek their permssion / acceptance of the updated terms and conditions.

 

No Unnecessary Data

 

You should no longer retain any non-essential personal data on customer records. This will include a lot of the fuzzy data that can help you maintain postive relationships with your customers, such as their birthday, their partner, their children’s names, where they live etc. It will be hard to justify holding this type of data on your customers for most businesses under GDPR.

 

These are simply the top line best practices you you should look to embrace, which will then become much clearer to you when you work through your PIA, and your LIA’s. And if you’re not sure about those you should definitely read up on them (see our handy list of GDPR defintions).