Are you running a business? Do you own a website or handle personal data? It is crucial to understand the implications of the General Data Protection Regulation (GDPR) for your activities. It has been in force across the European Union since May 25, 2018.
What is the GDPR?
The GDPR governs the processing of personal data within the European Union (EU). It builds on the French Data Protection Act of January 6, 1978. Its purpose is to give citizens better control over how their personal data is used and processed.
The GDPR was introduced to:
- harmonize data protection rules across Europe;
- provide a consistent legal framework for organizations, enabling them to grow digital activities while building trust with users.
What are the objectives of the GDPR?
The GDPR has three main objectives:
- Expand individuals’ rights. The GDPR establishes a right to data portability and includes specific provisions for minors.
- Increase accountability. Both data controllers and processors are responsible for compliance.
- Strengthen regulation. It enhances cooperation between data protection authorities, allowing them to make joint decisions and impose stricter sanctions for cross-border processing.
Who must apply the GDPR?
Any organization, regardless of size, country, or activity, may be subject to the GDPR if:
- it is established in an EU member state;
- its activity directly targets EU residents.
For example, a company based in Italy exporting products to Tunisia must comply because it is established in the EU. Similarly, a company in Japan with a French-language e-commerce site that delivers products to France must comply.
The GDPR also applies to data processors such as hosting providers, software integrators, and marketing agencies, because they process personal data on behalf of another entity (business, local authority, association, etc.).
Who must appoint a DPO?
Organizations must appoint a data protection officer (DPO) if:
- their activities are related to the public sector;
- their core operations involve regular, systematic, large-scale monitoring of individuals;
- their main activities involve processing sensitive data or data related to criminal convictions or offenses.
The DPO advises the organization on privacy impact assessments (PIAs), which are carried out when data processing poses a risk to people’s rights and freedoms. The goal is to assess the origin, nature, specificity, and severity of the risk.
Who ensures GDPR compliance?
In France, the Commission nationale de l’informatique et des libertés (CNIL) oversees the protection of personal data. Created in 1978, this independent authority acts on behalf of the state but is not under the authority of the government or a ministry.
The CNIL comprises:
- 18 voting or appointed members;
- a team of around 25 state contract agents;
- five operational directorates: legal support, rights protection and sanctions, technologies and innovation, public relations, and administrative/financial affairs.
Among its 18 members are:
- four parliamentarians (two deputies and two senators);
- two members from the Economic, Social and Environmental Council;
- six representatives from high courts;
- five qualified experts appointed by various authorities;
- the president of the administrative documents access commission.
What are the four missions of the CNIL?
- Inform and protect rights. The CNIL answers questions from individuals and organizations and ensures citizens can access data concerning them. If someone has trouble exercising their rights, they can file a complaint.
- Support compliance and advise. The CNIL provides compliance tools and guidance to help organizations follow the GDPR.
- Anticipate and innovate. The CNIL contributes to ethical digital debates and technological development that protects privacy through its innovation lab.
- Inspect and sanction. It monitors GDPR implementation and can issue warnings or sanctions when needed.
The five core principles of personal data protection
- Purpose limitation. Personal data may only be collected and used for a specific, legal, and legitimate purpose.
- Proportionality and relevance. Data collected must be relevant and strictly necessary for the purpose.
- Storage limitation. Personal data should not be kept indefinitely. A retention period must be defined based on the type of data and its purpose.
- Security and confidentiality. The responsible party must ensure that information is secure and accessible only to authorized persons.
- Rights of individuals. Individuals must be informed of their rights and how to exercise them. Requests must be answered within one month.
What rights do individuals have over their personal data?
Individuals have:
- the right to access their data;
- the right to rectification and objection;
- the right to portability;
- the right to erasure (“right to be forgotten”);
- the right to notification;
- the right to compensation for material or moral damage;
- the right to collective action.
Personal data protection: six best practices
Collect only data that is necessary
Collect personal data only for a defined and legitimate purpose. You cannot later use it for another purpose. For example, a recruitment database cannot be used for promotional offers.
To comply with the GDPR, follow the data minimization principle, limiting collection to what is strictly needed.
Be transparent
Individuals must be informed in advance about how their data will be used. Information should be:
- consistent with the situation and collection method;
- clear and easy to understand.
Collecting data without someone’s knowledge is prohibited.
Make it easy for people to exercise their rights
You must put in place processes that allow prospects and clients to exercise their rights. They should be able to request this by sending a simple email to a dedicated address, and you must respond in a timely manner.
Set clear data retention periods
It is forbidden to keep personal data indefinitely. Data should only be kept as long as needed to achieve the purpose. Afterward, it should be deleted, anonymized, or archived according to legal requirements.
Ensure data security
Implement both physical and digital safeguards, secure facilities and equipment, and manage authorizations and access rights. Measures must be adapted to the sensitivity of the data and potential risks.
Adopt a continuous compliance approach
Regularly check whether:
- data processing has evolved;
- security procedures are followed;
- adaptations are needed.
Email marketing: how to obtain consent
For email campaigns, you must obtain recipient consent using opt-in. If someone has not explicitly said “yes,” it must be considered a “no.”
A valid consent example:
“I agree that my email address may be used to receive offers from company X by email.”
For email sending, consider double opt-in. Unlike single opt-in, this method has two steps:
- the recipient agrees to receive promotional messages;
- the recipient confirms their consent by clicking a link in a confirmation email.
GDPR-friendly lead collection options with Dataventure
Using various acquisition mechanisms, you can collect opt-in profiles:
- Clic-lead. This campaign type supports visibility, traffic, and lead acquisition with dedicated collection at controlled cost per lead (CPL), without sharing addresses, and scalable volume.
- Co-registration premium. Collect high-value leads through a branded campaign page with customizable qualification questions.
- Co-registration. Ideal for affinity profiles with controlled costs.
- Co-sponsoring. A large-scale, cost-effective solution offering the lowest cost per profile and hundreds of thousands of profiles collected each month.
Dataventure monetizes Cardata group collection platforms, collecting over 3 million email addresses monthly for major advertisers, making it one of the French leaders in opt-in profile collection.
What are the advantages of double opt-in?
Choosing double opt-in brings several benefits:
- confirmation that an email address is valid;
- improved mailing list quality;
- compliance with data protection regulations;
- fewer complaints;
- better brand image.
Sanctions for GDPR non-compliance
Non-compliance with the GDPR can result in serious administrative sanctions: data erasure orders, warnings, orders to comply, suspension of data flows, and heavy fines.
Depending on the violation, fines can reach up to €10 million or €20 million. For companies, they can range from 2% to 4% of global annual turnover.
Need help setting up secure, compliant customer acquisition campaigns? Dataventure’s experts offer GDPR-friendly solutions tailored to your traffic and acquisition needs.
