Data protection for SMEs

Not only do customers care about their data, but they care about how it’s managed – in other words, how it’s used, stored and protected. If customers have a solid understanding of how you handle their data, they’re more likely to trust you. And that in turn means they’re more likely to buy into your products and services. 

Today, we’re covering all things data protection for SMEs – including useful help and support from government organisations and our own Leicester IT consultants.

Data protection explained

More commonly referred to by its acronym of GDPR, the general Data Protection Regulation was rolled out in 2018 and continues to protect the data, privacy and security of data subjects in the EU.

Key points to know about data protection for SMEs are:

• If you process the data of EU residents, then GDPR applies to you (even if you’re not based in the EU).
• The EU has the power to levy huge penalties against businesses in serious breach of its regulations – either a multi-million euro fine or a percentage of your revenue (whichever is larger). 
• Data covers a lot of areas, from gender and ethnicity to location, political beliefs and website cookies. 
• Data processing must be lawful, accurate and transparent – relating to only what’s strictly necessary, for as long as strictly necessary. It must only be collected for legitimate purposes and should be treated securely. 

Key documentation your SME needs

To manage data, and data protection for your SME, you need legal documents in place – such as a Privacy Notice. These documents carry legal weight and should explain:

• The what, why, and where around data collection.
• Who’s in charge of the data (i.e. the data controller).
• Any security measures in place for keeping data protected.
• Information about how the data will be used and shared.
• What rights data subjects have, and how to opt-in or opt-out.

The ICO has a useful tool that can give you a head start. All you need to do is add your details in and let it do the work for you. It’s a great way to ensure your business is running within the law and gives customers that peace of mind, too.

Managing compromised data

If you think your organisation’s data has been breached, the first step is to check whether you need to file a report with the ICO. If you do, you must do so within 72 hours of discovering the breach. You’ll be asked questions about:

• What happened
• When and how you discovered the breach
• Remedial actions you’re taking 
• Data subjects who may have been affected

Of course, it’s not just about taking action. It’s also about prevention. Below, we’ve compiled some tips and advice for data protection for SMEs, helping to minimise risk:

• Encourage good ‘cyber hygiene’ in your workplace, such as performing regular data back-ups, setting strong passwords and encrypting communications. Remember, passwords should never be shared.
• Prioritise any requests from data subjects to access or remove their data.
• Dispose of data securely, whether physical or digital.
• Consider appointing a data protection officer (DPO) in your organisation.

Prioritise data protection for SMEs with Aurora

When it comes to data protection for your SME, there are lots of ways our Leicester consultants can help:

• Security measures and monitoring, such as running audits to find gaps in your defences and identify vulnerabilities. 
• System updates, which keep you up-to-date with the latest information and technology, from antivirus protection to password management solutions.
• Attacks and breaches, with advice, reassurance and actionable solutions that get you back up and running and stronger for the future. 

Plus, we can even advise on ways to keep your people – and data – safe when working remotely. 
Get in touch with our team in Leicester by calling 03450 099 099, or visit our LinkedIn profile, website blogs or service page for more information about our IT support in Leicestershire.