Article
Lead generation and the GDPR: Are you compliant?
dpocentre.com
Quoted on this wiki
Every place a page here uses this source, in the order the words come in it.
After determining a lawful basis, you must document it and ensure the information is clearly stated in your privacy policy and privacy noticeA clear, open and honest explanation of how an organisation processes personal data.. “For certain types of marketing activities, consent is the only appropriate lawful basis to use.” ePrivacy Directive and PECR
“personal dataInformation which relates to an identified or identifiable natural person.” Since the General Data Protection RegulationRegulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (General Data Protection Regulation). (GDPR) came into effect in 2018, marketing strategies have undergone a significant transformation, with a definite shift toward inbound methodologies. Attracting engagement from customers, rather than pursuing prospects directly has become the modern standard. Outdated tactics such as buying prospect lists, cold calling, and sending unsolicited emails have been replaced by a focus on creating valuable, engaging content, and tailored experiences.
Understanding the GDPR and lawful bases “The General Data Protection Regulation (GDPR) provides the legal framework for the collection, processing, and storage of personal data of individuals in the EU (with the UK GDPR applying to individuals in the UK).” An important aspect of the GDPR is the necessityThe purpose of the personal data processing activity must not be able to be achieved by a less intrusive method. for businesses and organisations to establish an appropriate lawful basisIn the event of processing personal data, an appropriate rationale in order to process personal data. for processing personal data. This means that before collecting any personal data, you must first identify and document the lawful basis for doing so.
“lawfullyIn data protection terms, 'lawfully' must satisfy one of the appropriate lawful basis for processing and must not contravene any other statutory or common law obligations.” Since the General Data Protection RegulationRegulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (General Data Protection Regulation). (GDPR) came into effect in 2018, marketing strategies have undergone a significant transformation, with a definite shift toward inbound methodologies. Attracting engagement from customers, rather than pursuing prospects directly has become the modern standard. Outdated tactics such as buying prospect lists, cold calling, and sending unsolicited emails have been replaced by a focus on creating valuable, engaging content, and tailored experiences.
The General Data Protection Regulation (GDPR) provides the legal framework for the collection, processing, and storage of personal data of individuals in the EU (with the UK GDPR applying to individuals in the UK). “before collecting any personal data, you must first identify and document the lawful basis for doing so.” There are six lawful bases under the GDPR:
There are six lawful bases under the GDPR: “ConsentAn unambiguous, informed and freely given indication by an individual agreeing to their personal data being processed. – where an individual has given consent for their personal data to be processed” Legitimate InterestsLegitimate interests is one of the six lawful bases for processing personal data. You must have a lawful basis in order to process personal data in line with the ‘lawfulness, fairness and transparency’ principle. – where the processing of an individual’s personal data is necessary for the legitimate interests of a business or organisation, unless there is a good reason to protect the individual’s personal data, which then overrides those legitimate interests
After determining a lawful basis, you must document it and ensure the information is clearly stated in your privacy policy and privacy noticeA clear, open and honest explanation of how an organisation processes personal data.. “The lawful bases commonly used for processing personal data for marketing and lead generation purposes are consent and legitimate interests.” ePrivacy Directive and PECR
ConsentAn unambiguous, informed and freely given indication by an individual agreeing to their personal data being processed. – where an individual has given consent for their personal data to be processed “Legitimate InterestsLegitimate interests is one of the six lawful bases for processing personal data. You must have a lawful basis in order to process personal data in line with the ‘lawfulness, fairness and transparency’ principle. – where the processing of an individual’s personal data is necessary for the legitimate interests of a business or organisation, unless there is a good reason to protect the individual’s personal data, which then overrides those legitimate interests” Contract – where the processing is necessary for the performance of a contract a business or organisation has with an individual
Public Task – where the processing is necessary for the performance of a task in the public interest or for official functions, and the task or function has a clear basis in the law “After determining a lawful basis, you must document it and ensure the information is clearly stated in your privacy policy and privacy noticeA clear, open and honest explanation of how an organisation processes personal data..” It is important to choose the most appropriate lawful basis, as it is difficult to change later without good reason. The lawful bases commonly used for processing personal data for marketing and lead generation purposes are consent and legitimate interests. For certain types of marketing activities, consent is the only appropriate lawful basis to use. A data protection officer (DPO) can provide guidance on the most suitable lawful basis for your personal data processing.
After determining a lawful basis, you must document it and ensure the information is clearly stated in your privacy policy and privacy noticeA clear, open and honest explanation of how an organisation processes personal data.. “For certain types of marketing activities, consent is the only appropriate lawful basis to use.” ePrivacy Directive and PECR
After determining a lawful basis, you must document it and ensure the information is clearly stated in your privacy policy and privacy noticeA clear, open and honest explanation of how an organisation processes personal data.. “It is important to choose the most appropriate lawful basis, as it is difficult to change later without good reason.” ePrivacy Directive and PECR
What about legitimate interests? “However, as marketing is generally in the interests of the business, the validity of using legitimate interests as a lawful basis for processing data must be carefully considered, balancing any possible consequences for the individual.” A Legitimate Interests AssessmentAn assessment that used to demonstrate whether not processing is necessary in the legitimate interests and does not prejudice the data subject’s interests, rights and freedoms. (LIA) is a useful tool that can be used to identify and consider this lawful basis as a possible justification for processing personal data under the GDPR.
“personal dataInformation which relates to an identified or identifiable natural person.” Since the General Data Protection RegulationRegulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (General Data Protection Regulation). (GDPR) came into effect in 2018, marketing strategies have undergone a significant transformation, with a definite shift toward inbound methodologies. Attracting engagement from customers, rather than pursuing prospects directly has become the modern standard. Outdated tactics such as buying prospect lists, cold calling, and sending unsolicited emails have been replaced by a focus on creating valuable, engaging content, and tailored experiences.
“it is crucial to understand your responsibilities under data protection laws to ensure that all EU and UK personal dataInformation which relates to an identified or identifiable natural person. is collected, processed, and stored lawfullyIn data protection terms, 'lawfully' must satisfy one of the appropriate lawful basis for processing and must not contravene any other statutory or common law obligations., transparently, and securely.” Since the General Data Protection RegulationRegulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (General Data Protection Regulation). (GDPR) came into effect in 2018, marketing strategies have undergone a significant transformation, with a definite shift toward inbound methodologies. Attracting engagement from customers, rather than pursuing prospects directly has become the modern standard. Outdated tactics such as buying prospect lists, cold calling, and sending unsolicited emails have been replaced by a focus on creating valuable, engaging content, and tailored experiences.
“lawfullyIn data protection terms, 'lawfully' must satisfy one of the appropriate lawful basis for processing and must not contravene any other statutory or common law obligations.” Since the General Data Protection RegulationRegulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (General Data Protection Regulation). (GDPR) came into effect in 2018, marketing strategies have undergone a significant transformation, with a definite shift toward inbound methodologies. Attracting engagement from customers, rather than pursuing prospects directly has become the modern standard. Outdated tactics such as buying prospect lists, cold calling, and sending unsolicited emails have been replaced by a focus on creating valuable, engaging content, and tailored experiences.