GDPR impact on small business

[Serpeni]

I produce handmade items for companies to use as marketing tools. With a small loyal customer base of around 40, I often email to individuals within the companies, advising of developments which might help them. On occasion this is extended to other prospective clients, just letting them know we are here and offering our products. This rarely goes further than being sent to 20 clients in a year. Do I need to gain permission to continue to write to the existing clients, and to ask for permission from the potential ones?

 

[Nochexman]

Yes, you have to do. Both the GDPR legislation and the UK's Information Commissioner's Office, responsible for enforcing data protection laws, have stated unequivocally that the rules apply to everyone.

Nonsense - otherwise please provide a link to said statement.

 

[Brandspeak]

Yes you will. You will have probably noticed recently a lot of emails from companies requesting consent from you, e.g. Google. This is essentially the same process you will have to go through, sending out an email to re-confirm acceptance of your data collection and processing policy.

 

[AndyLF]

Read up about 'legitimate interests' within the context of GDPR. If you have an ongoing commercial relationship with a contact you may feel that you can still email them under the banner of 'legitimate interests'. Certainly I know businesses who have taken a commercial view that they won't ask for opt-in from existing/current customers. These aren't small businesses either.

Let's face it, if you scrutinized what you'd been sending out up to now, how you were sending it, and to whom, you were probably breaching the previous data protection act in some way and lost no sleep over it.

In your case, you'd only need to worry about GDPR if one of your contacts reported you to the ICO. If you are sending your contacts info that they will find useful and is in THEIR interest, they are highly unlikely to report you to the ICO. Even if they did, the ICO isn't going to be interested in slapping you with a fine. They will FAR FAR too busy dealing with the headline cases that will suck up all their resources, and used as high profile warnings to the rest of us.

That said, the prospective customers you mention would certainly need opting-in. However, now that GDPR has come into effect, you can't legitimately email them to ask them to opt-in, so you'd need to call/write.