Key insights and methods to empower data security in the wake of GDPR regulations.

2. b
2
Are you GDPRed yet?
© 2017 Datamatics Business Solutions Ltd. All rights reserved.
Prelude
Datamatics’ key services is to provide customized intelligent database solutions. We develop,
design and deliver accurate and validated database solutions for global enterprises. We
increase the buying probability of contact data up to 90% by adding layers of intelligent tags.
Our team of experts deliver over 300% increase in data efficiency through our services of:
Database creation, validation, cleansing, enrichment, enhancement and consolidation with
intelligence.
As Data Processors, we adhere to GDPR guidelines at every step of data management. This
document is our observation on the regulation. We do not provide any GDPR compliance
certification or consultation services.

3. b
3
Are you GDPRed yet?
© 2017 Datamatics Business Solutions Ltd. All rights reserved.
Table of Contents
1. Overview........................................................................................................................................... 4
2. Getting the most from these changes.............................................................................................. 5
3. Effects of GDPR on PECR (Privacy and Electronic Communications Regulations) ........................... 6
4. Penalties ........................................................................................................................................... 7
5. GDPR and B2B marketing................................................................................................................. 7
6. GDPR: Delving deeper ...................................................................................................................... 8
7. Conclusion ...................................................................................................................................... 10

4. b
4
Are you GDPRed yet?
© 2017 Datamatics Business Solutions Ltd. All rights reserved.
Overview
The General Data Protection Regulation (GDPR) promises a radical revolution to European
privacy laws that have been prevailing for over two decades. It imposes a radical, much
tougher data protection regulatory framework on Europe, UK and the wider world for
processing personal data. The GDPR regulation will replace Directive 95/46/EC - directly
applicable in every Member State from 25th
May 2018.
The GDPR regulation aims to harmonize all data protection law across the EU & UK to increase
individual rights. However, there may be differences in the way the regulation is interpreted
and enforced in different Member States.
There are six privacy principles under the GDPR regulation that form the fundamental
conditions which organisations must follow. These principles should be adhered to when
collecting, processing and managing the personal information data for all citizens in EU &
UK. The six principles are listed below:
 Personal data must be processed lawfully, fairly and in a transparent manner
 Personal data must be collected for specified, explicit and legitimate purposes and not
further processed in a manner that is incompatible with those purposes (with exceptions
for public interest, scientific, historical or statistical purposes)
 Personal data must be adequate, relevant and limited to what is necessary in relation to
purposes for which they are processed.
 Personal data must be accurate and kept up to date. Inaccurate personal data should be
corrected or deleted.
 Personal data should be retained an identifiable format for no longer than is necessary
(with exceptions for public interest, scientific, historical or statistical purposes)
 Personal data should be kept secure & confidential.
GDPR gives individuals a lot more power to access the information that's held about them.
Individuals are entitled to question the usage of data and to be given copies of that data.
Companies of all sizes will have to give users more control over their data.
Individuals also have the power to get their data erased if - it is no longer necessary for the
purpose it was collected, if consent is withdrawn, there's no legitimate interest, and if it was
unlawfully processed.
If they have strong grounds to ask for processing to stop, it must be stopped.

5. b
5
Are you GDPRed yet?
© 2017 Datamatics Business Solutions Ltd. All rights reserved.
Data covered under GDPR
In the virtual business world every technology device and database processes personal data
in some way.
GDPR regulation covers every processing operation on personal data, either by automated or
non-automated means (active or passive in nature). Processing personal data includes
creating personal data; storing; using; copying; aggregating; adapting; amending; sharing;
transmitting; archiving; selling; losing; and erasing the data.
GDPR applies to:
GDPR primarily applies to
businesses established in the
Union. It will also apply to
businesses based outside the
Union that offer goods and
services to, or monitor individuals
in, the Union. Further, all
processing must comply with six
general principles and must satisfy
a processing condition.
Getting the most from these changes
A. Metadata management is essential to comply with GDPR.
There will be an increased emphasis on knowing what personal data is created and how it’s
processed. Stronger accountability is an important principle of the GDPR. Hence, Tooling to
manage (personal) data will prove vital in the future.
GDPR requires implicit and explicit insight in the processing of personal data - possible with
accurate Metadata management. It’s key to know the data being processed and the
processing properties to gain in-depth insights.
Businesses need to know everything about the personal data they hold to exercise data
subject rights.

6. b
6
Are you GDPRed yet?
© 2017 Datamatics Business Solutions Ltd. All rights reserved.
B. GDPR compliance will build trust with clients and Safeguard personal data.
If businesses want to tailor their product experience, customers should be able to trust them.
GDPR makes it possible for businesses to request data from its customers. The increase in
accountability will help build trust with clients.
In addition to creating value, GDPR compliance helps in preventing incidents and damage.
Being transparent and providing insight and control to customers ensures personal data
usage ethically.
In addition to higher fines, reputational damage of supervisory action is still an important risk.
Complying with GDPR provisions helps mitigate this risk.
C. Make GDPR compliance a top priority for the coming months.
Be GDPR-ready by analysing the risk of processing personal data. Prioritize the action items
and minimize the risks in a short span.
The underlying principles of GDPR and current privacy legislation are highly similar.
Organizations that comply with the GDPR will cover a large portion of the current legislation.
25th May 2018 may seem too far, but the days will pass by before we know it.
Effects of GDPR on PECR (Privacy and Electronic Communications
Regulations)
The PECR are derived from the European law, also known as ‘the e-privacy Directive’. Under
the current rules B2B marketers are subject to fewer regulatory requirements than B2C
marketers. This is because PECR focuses on protections for consumers. Marketing to
corporate employees via electronic channels does not require consent under PECR.
However, GDPR sets a much higher standard for consent. It’s designed to put data protection
at the top in the minds of business owners and encourages them to take a more holistic
approach. The combination of GDPR and PECR means marketing processes need to be
reinforced and a positive opt-in strategy needs to be fostered.

7. b
7
Are you GDPRed yet?
© 2017 Datamatics Business Solutions Ltd. All rights reserved.
Penalties
The regulation introduces fines of up to 4% of annual worldwide turnover or €20m,
whichever is greater. The supervisory authorities can audit and issue a temporary or
permanent ban on processing. Individuals can sue businesses for compensation to recover
both material damage and non-material damage (e.g. distress).
These fines apply to breaches, including failure to comply with the six general principles or
carrying out processing without satisfying a processing condition. Failing to notify a personal
data breach or put in place an adequate contract with a processor fall into this penalty.
Penalty Pendulum
GDPR and B2B marketing
Most of the obligations under the DPA (Data Protection Act) apply to firms carrying out B2B
marketing related activities. However, the PECR specifies that B2B email marketing does not
have to obtain the express opt-in consent of any individual whose personal data is involved
in said activities to satisfy the individual consent ground.
Therefore, in the context of B2B marketing activities involving personal data, if individuals are
given the option to opt-out this is sufficient to establish consent. As in the case with Brexit,
however, only until the legislation has been implemented will the full limitations be made
clear to B2B marketers.

8. b
8
Are you GDPRed yet?
© 2017 Datamatics Business Solutions Ltd. All rights reserved.
What can B2B businesses do ahead of May 2018?
To prepare for GDPR before May 2018, make sure that:
1. If an individual within your database enquires whether you hold any information about
them, confirmation must be given without undue delay.
2. If confirmation is received that their personal data is being held, you will be obliged to
inform the individual of precisely which of their personal data is being held, for what
purposes and that he/she has the right to object to their data being held in the manner
specified.
3. If an individual needs access to their personal data or wishes to receive a copy of the data,
then you must honour this request without unnecessary delay.
4. If any personal data contained within the database is inaccurate, you must allow any
affected individuals to rectify or otherwise correct any erroneous records.
5. If an individual objects to their personal data being stored in the database or asks for their
personal data to be deleted, then these requests must be upheld.
Meanwhile, businesses should be refining what they already know and adapt best practices
when building strategies to communicate with prospects. GDPR regulation will ensure that
businesses plan a robust data management system. The ones who begin now will put
themselves in the best position to comply with the regulation, encourage ‘opt-ins’ and
engagement with marketing campaigns and content.
Until the GDPR comes into force, standard email marketing with a soft opt-out approach can
be adapted. Targeted data lists can be purchased to capture as many possible leads in the
GDPR compliance pool. Now is the time to use every marketing tactic in the arsenal. Make
sure that there is as much data double opted-in to your communications as possible.
GDPR: Delving deeper
ICO (Information Commissioner's Office) enforcement actions

9. b
9
Are you GDPRed yet?
© 2017 Datamatics Business Solutions Ltd. All rights reserved.
Individual’s rights
New DPO (Data Protection Officer) role
Businesses that have "regular and systematic monitoring" of individuals or process sensitive
personal data at a large scale have to employ a Data Protection Officer (DPO). This may mean
hiring a new staff member. The DPO is responsible for overseeing data protection strategy
and implementation to ensure compliance with GDPR requirements. The role includes
monitoring GDPR compliance with appropriate training and reporting mechanisms to senior
management.
The DPO’s responsibilities include:
 Educating the company and employees on important compliance requirements.
 Training data processing staff.
 Proactively conducting audits to ensure compliance and address potential threats.
 Serving as the point of contact between the company and GDPR Supervisory Authorities.
 Monitoring performance and providing advice on the impact of data protection efforts.
 Maintaining comprehensive records of company’s data processing activities, including
the purpose of processing, which must be made public on request.
 Interfacing with individuals to inform them about how their data is being used, their
rights to erase personal data and measures the company has put in place to protect
their personal information.

10. b
10
Are you GDPRed yet?
© 2017 Datamatics Business Solutions Ltd. All rights reserved.
Marketer’s obligations
The GDPR raises
countless
compliance issues.
It would be very
easy to “get lost”.
Work needs to be
prioritised, so that
critical risks issues
and key business
objectives are
addressed before
matters of lesser
importance.
Conclusion
Being GDPRed before the deadline: As an intelligent data partner, we are uniquely placed
to help our clients adjust to the new environment. For the past three decades, we have
increased database efficiency by 300% for Fortune 5000 companies and SME’s across the
globe. Our team is truly global, with on-the-ground expertise in all the major EU economies.
Roadmap to compliance
We are currently helping businesses in EU & UK to manage their legacy data and build new
data that’s GDPR compliant. Datamatics can assist businesses in being GDPR-ready before
the deadline approaches.
Checklist
 Determine the exposure.
 Understand the penalties.
 Establish controls
required.
 Get the opt-in statement
specifics right.
 Check privacy and cookie
consent.
 Get explicit double opt-in
consent from contacts.
 Buy targeted lists now
opt-in to communications.

11. b
11
Are you GDPRed yet?
© 2017 Datamatics Business Solutions Ltd. All rights reserved.
About Datamatics Business Solutions Ltd.
We are a Global Provider of the Business Process Management (BPM) solutions. We partner
with Fortune 5000 to help drive revenue growth, operational efficiency & customer
engagement. We deliver highly customized solutions that leverage our strong industry
experience of over 35 years.
Envisioning the future, Datamatics has been awarded as the ‘Best Outsourcing Services
Provider by the 2020 Group and won multiple awards by World HRD as the “Best Employer
Brand in 2017”.
Disclaimer: This whitepaper is purely an observation of information available on the internet. The paper is not a legal or a political expression towards any
organization or policy. Datamatics is not responsible for any derivation from this whitepaper.