Do I have to be concerned with GDPR?

As someone who’s main service is managing my clients’ email lists, I’ve been getting asked quite often lately about GDPR since it’s coming into full effect at the end of May.

Likewise, as a coach and community leader of freelancers, I’ve been asked if they should worry about or what they should do (if anything) about the GDPR, especially if they are outside of the EU.

I want to first state that I’m not a lawyer and by no means take any of this information as legal advice.

Take it as best practice for you, your business, and your email list moving forward.

As a part of the GDPR, all customers or users will have the right to request the data held on them, the right to have that data deleted if its original purpose has ceased, and the right to have that data transferred to a different provider.

Which means to provide an individual with the right to request, delete, or move their personal data, the individual must be aware that you as a company have the data to begin with. Without their awareness of you using their data, they have no actionable right. So the use of user or customer data through third party providers is likely to become quite complicated.

This would fall under the right-to-be-forgotten laws.

As you can see from the previous 5 sentences alone, there are lots of room for interpretation and questions to be answered. So best to consult your lawyer.

I can’t tell you how to make your business comply with GDPR because there are still so many gray areas (in my opinion) for the EU, that outside of the EU it’s even a darker gray.

What I can tell you is that if you are “doing right” by your email subscribers you are well on your way to being compliant.

What’s “doing right” mean?

It means that:
you are doing double opt-in
you are allowing folks to unsubscribe from every email
if you are sharing email addresses via JV webinars, online summits, partnerships, etc with other businesses, you are sending transitional emails to those subscribers letting them know what you are doing with their email address and giving them an option to opt-out
you share who else has their data and make sure that you understand (even sign, in some cases) what they are doing with the data. This includes 3rd parties such as Google, Facebook, etc.
you aren’t selling your email list
In short, you are doing good business with good intentions.

You may also want to update your privacy policy on your website after the conversation with your lawyer.

Further resources:
12 Steps to take now
GDPR Requirements in Plain English

Action Items
Update your Privacy Policy
Add a checkbox to any lead magnet form and have the subscriber acknowledge what you intend on doing with their information after the lead magnet delivery
Find out what else you can do from your own email marketing service
In Drip and ConvertKit, you can segment your list to find those that are within the EU, add in GDPR specific settings into forms, and take actions to comply with the GDPR in other ways.

Here are some other platforms and how they are handling GDPR:
MailChimp
ActiveCampaign
HubSpot
AWeber
Constant Contact