October 8, 2021
GDPR: Four Common Misconceptions About Collecting Personal Data
Whether your business is B2B or B2C, you’ll inevitably run into the question of data collection and GDPR compliance. We’ll break down some misconceptions surrounding data collection so you will have a better idea on how to navigate through GDPR compliance.
Misconception #1: I cannot collect certain personal data.
Generally, GDPR does not restrict the type of data you collect, but it does restrict the circumstances in which you can collect. You can collect all sorts of user data as long as you obtain explicit consent from the user and have proper safeguards against data breach. Keep in mind that there are specific requirements for obtaining a user’s explicit consent which you must follow before you start collecting user’s personal data.
Misconception #2: Business data is also personal data.
Business data is treated differently from personal data. Sometimes the line between what is considered business data and personal data can be blurred, but generally, business data is not personal data that is governed by GDPR. For example, my office email and phone number is considered business data and not my personal data, even though you can identify me using such information.
Misconception #3: I can collect my employee’s information without complying with GDPR.
Many of our clients with subsidiaries or affiliates in the EU mistakenly think that they can receive and make use of employee’s data from their EU offices. That is not the case. Your EU offices have the right to refuse to provide their employee’s information to other offices (or even the headquarter) if the other offices are not in compliance with GDPR. Certain employee data can be considered as personal data and not business data; therefore, governed under GDPR.
Misconception #4: GDPR is the same as your local privacy laws.
Complying with GDPR does not necessarily mean you are in compliance with your local privacy laws. Although much of the laws and regulations may overlap, there are likely differences (even subtle differences) that may put your company at risk of violation. This is why you should consult with your attorney that is familiar with both GDPR and local privacy laws.
Please note that these are general information on GDPR provided for your reference and should not substitute the advice of an attorney. Please contact our office find out more on GDPR compliance for your business.