Join our Waitlist for Expert Advice!

Why Cooperating With Non-GDPR Compliant Companies Can Actually Put Your Own Company at Risk Have you checked to see that your partners are as well prepared as you are?

By Maciej Zawadziński Edited by Dan Bova

Opinions expressed by Entrepreneur contributors are their own.

You're reading Entrepreneur Europe, an international franchise of Entrepreneur Media.

Shutterstock.com

You've put all the right processes in place, from data collection to processing, storage and deletion on request. You're ready for GDPR. Bring it on, Data Protection Authority!

Related: With GDPR Disrupting Email Marketing, LinkedIn Is the Best Alternative

But, if you're like most organizations, you work within a larger data ecosystem; it's simply a necessity to get and use the data you need to effectively operate in 2018. Have you checked to see that your partners are as well prepared as you are? Because the list of cases of third-party data carelessness is only growing.

As someone who has spent the last decade running two advertising and marketing companies, I'll focus on the risks concerning personal data in those industries. Other types of data are of course relevant and affected by GDPR. However, marketing data is a great example as we're all dependent on it to plan brand strategies, create engaging campaigns, capture buyer personas and understand the customer journey.

What would happen if you suddenly lost all this data?

Decision makers would be blind, the brand compromised. The enterprise would be exposed to a string of costly and time-consuming operations that everyone would rather avoid. Recent data breaches involving British Airways, Feedify and Ticketmaster shook public opinion, but how could the business sector be prepared if none of us ask each other about the security of our software?

A week before the GDPR went into force, we asked companies from the adtech and martech sector about their planned policies, and 66 percent of respondents declared that they will only cooperate with GDPR-compliant partners.

In contrast, only 31 percent received a similar declaration from partners.

This tells us that most businesses aren't checking whether their partners are GDPR-compliant, which is a critical mistake because regardless of whether a company is a data processor, controller or a joint controller, it's exposed to a high level of risk and consequences.

Related: How Small Businesses Can Survive in the Age of GDPR

What are the most likely GDPR-related crisis scenarios?

1. You receive data from a partner that didn't carry out the proper consent collection process.

"Proper consent" according to article 7 of GDPR means "freely given, specific, informed and unambiguous," which doesn't seem like a popular consent collection strategy. In the case of a Data Protection Authority investigation, you might be obliged to erase all the data obtained from a partner that won't be able to present properly collected consents. If your company is a joint data controller, it will face some serious fines as well (up to €20 million or 4 percent of the annual worldwide turnover).

2. You obtain or share data with a partner that doesn't provide mechanisms to edit or erase user data.

Apart from the scenario in which you are sending a mass email marketing campaign to an illegally collected database, which seems obviously wrong, you can still make a lot less spectacular mistakes like simply working on stale data, erroneous segments or mistargeted campaigns. In the case of an investigation, depending on whether you are the co-processor or co-controller, you would have to erase all the data and the company could face financial and legal consequences.

3. One of your data processors gets hacked.

If you collect website data through trackers from companies without proper privacy and security measures in place, your company could face the consequences of their poor decisions.

In the event of a hack or leak, your customers' personal data that was stored by the processor could be exposed. The first and most painful step would be informing victims of the breach. You'd experience the same negative consequences as if it were a data leak from your own systems. This not only means a PR crisis, but also a significant amount of time and money to fix the problem, not to mention the eventual Data Protection Authority investigation.

Related: With GDPR Restrictions on Using Consumer Data, Marketers Will Need to Start Mining Moments

How can you verify partners and avoid problems?

1. One of the most crucial parts of your company's security procedure is a Data Processing Agreement (DPA). There are different elements you can include in your DPA but the important part is to have one. In the case of a breach or investigation, a DPA has a decisive influence on your liability when it comes to possible transgressions.

2. Read your partner's privacy policies and try to test them. Ask for data access or erasure. Check if the consent collection process is GDPR-compliant and verify if tags are fired according to the level of consent given. You can do this by using simple plugins like Ghostery, Privacy Badger or Disconnect.

3. Ask partners about their data-processing vendors and subprocessors. Confirm whether they have DPAs with them. Remember that if you entrust or sell data to a third party, it becomes part of a huge data chain which may be exposed to attacks.

Maciej Zawadziński

CEO of Clearcode and Piwik PRO

Maciej Zawadziński is an adtech and martech expert, experienced entrepreneur and startup creator. He is also a privacy evangelist and engaged GDPR supporter. Earlier in his career, Zawadziński created the first blog advertising network in Poland.
Health & Wellness

I'm a CEO, Founder and Father of 2 — Here Are 3 Practices That Help Me Maintain My Sanity.

This is a combination of active practices that I've put together over a decade of my intense entrepreneurial journey.

Business News

Remote Work Enthusiast Kevin O'Leary Does TV Appearance Wearing Suit Jacket, Tie and Pajama Bottoms

"Shark Tank" star Kevin O'Leary looks all business—until you see the wide view.

Business News

Are Apple Smart Glasses in the Works? Apple Is Eyeing Meta's Ran-Ban Success Story, According to a New Report.

Meta has sold more than 700,000 pairs of smart glasses, with demand even ahead of supply at one point.

Money & Finance

The 'Richest' U.S. City Probably Isn't Where You Think It Is

It's not located in New York or California.

Business News

Google Leak Spills the Secret Sauce for Search Rankings — Here's What to Know

It's the biggest peek into Google's search secrets yet.

Growing a Business

Why 'Founder Mode' is Not a One-Size-Fits-All Solution to Leadership

The founder-driven approach can boost a business's growth, but transitioning from "founder mode" to a balanced leadership style is essential for sustained success and scaling.