Any website that collects data from its visitors will have to be in full compliance with the new rules on General Data Protection Regulation (GDPR), or 'Algemene Verordening Gegevensbescherming' (AVG) in Dutch, from the end of May 2018. This is quite a mouthful, but what exactly does the term mean and what does the new regulation mean? We will provide a word of explanation, because you will have to be the rule anyway in order to avoid potential sample fines (up to 20 million euros or 4% of the annual worldwide turnover!).

The new GDPR legislation has far-reaching implications for any kind of data collection, as you already know. But how do these rules express themselves in concrete terms? We would like to list a few practical examples:

• Applicants: e-mailing CVs to colleagues for inspection is no longer allowed, unless you anonymise the CV in such a way that the identity of the person can no longer be inferred from it. Assuming that the candidate has not been withheld, you may not keep his or her details unless he or she explicitly consents to this (on paper or otherwise). Any form of CV (in a mailbox, stored locally on a laptop, printed out, ...) must be destroyed, according to the 'right to be forgotten' principle.
• Promotional actions: in the case of a promotional action, you collect your name, address, e-mail ... Unless explicitly approved by the participant, this data may no longer be used outside the framework of the action and must be irrevocably deleted.
• Existing databases: files of former employees, former members and the like may no longer be kept, unless all these persons give their explicit permission or if there is a well-founded and demonstrable reason to keep these data without explicit permission.
• Minors: in the case of data from minors (in this case younger than 16 years of age), parental consent is always required! As a data collector, you are obliged to make 'reasonable efforts' (for the time being, this is a grey area, without explicit delimitation) to find out the age, depending on the context.
• E-commerce: in the case of anonymous purchases, the personal data must be deleted after the reflection period has expired. Only items relating to invoicing may be kept. If a database leak with information from payment cards shows that the company and/or webshop is not GDPR-compliant, the company - and possibly also the technical partner - will pay for the entire damage.
• Tracking: when profiling (name + segmentation) visitors on a site/application, the visitor must be clearly informed of what is being traced and why. Opt-out must be possible at all times, and therefore there must also be a sound privacy policy that clearly explains this.
• Obtaining/purchasing databases: when purchasing or otherwise obtaining data, you must notify everyone within 30 days stating your source ('data obtained from X'), unless those involved already know this or the effort is too great (this is another grey area).

For more information read our other articles: GDPR for marketers in 6 steps and your cookie policy in line with GDPR thanks to Google Tag Manager (GTM) + roadmap.