GDPR- Unlearn and re-learn: Busting the GDPR Myths

GDPR- Unlearn and re-learn: Busting the GDPR Myths

If a sapling was planted every time there was a misconception about GDPR, we'd have probably defeated global warming by now. Any new revolution, be it in technology, philosophy or any other dimension, always creates chaos and confusion during its inception, bringing along with it, a plethora of misconceptions as well. However, it is time we got it all cleared from our heads. 

You might have been a victim of this contagion as well, or have you not? Let us unlearn the (un)popular misconceptions and try to bring in the clarity of crystals to our GDPR understanding.

Consent is an alias of GDPR

The worst of dreams by the GDPR experts will probably involve them yelling 'Consent alone is not GDPR!!', into the psychic space of their co-workers. Because this is, by far, the biggest misunderstanding. GDPR does put high emphasis on consent, but it is not the whole picture. 

There are six lawful bases and they're all equally valid. Say you are a firm based out of Amsterdam and you are employing locals. You don't need to get their consent for storing their information on your register, because the law mandates it. It will fall under the 'legal obligation' umbrella. If a person gets interested about your product and asks for a quote, you don't have to bother him with consent. Because you can process his contact information based on 'Contract'.

Hence, we must keep an open eye and consider all the six lawful bases before applying them to our data processing activities.

Consent is just a check box

Most of us are thinking that the holy check in 'I agree to the Terms & Conditions and Privacy Policy' is the consent we need. Well, no! In fact, that is the first example of what is not a consent, in the ICO website.

There are specific rules to be kept in mind when consent is taken. We must first state all ways in which we shall process the data we are collecting. And furthermore, we must not make it a precondition of a service, which is exactly what we do with the 'I agree to the Terms & Conditions and Privacy Policy' check box. Consent must be given freely with no pre-checked boxes. And even if the boxes are not checked by the subject, the service must not be denied. Hence, before taking the consent route, the whole processing tree must be analysed, and the decision on whether or not to take this route should be made.

GDPR is the Villain


When GDPR first came into picture, there was a massive wave of negativity that accompanied it. Social media was flooded with posts talking about how GDPR will cause a huge expense hole in organisations’ budget and why it will create so many problems that didn’t exist in the first place. Many organisations, by default, assumed that they shall end up non-compliant and some of them even expressed their idea of conjuring up funds for a possible fine due to non-compliance. One could almost feel the need to hit the psychological reset button.


However, we must understand in our bones that GDPR is a set of laws that just demand  Good Business Practice; GDPR must be welcomed with positivity because not only does it provide a company with a better legal and policy framework, but it brings acompetitive advantage as well.


GDPR, in many ways, will change the way businesses are conducted, but one of the main shall be the cognitive advantage that a company shall possess in the minds of its clients, when it becomes GDPR compliant. A GDPR compliant company shall do better positioning in their customer’s head when they can flaunt their compliance tag.


My business is small, so I'm kind of exempt.


Only in specific cases like the one for appointing a DPO, does the GDPR talk about company sizes. GDPR has an attitude and it doesn't care about your firm's size. If you happen to, in anyway, cross any data path of any EU resident, you are under the GDPR radar.

Forget small business! Even if you're a solo-pruner who runs a fashion blog, with an emailing list under your sleeve, you must be GDPR compliant.


I don't collect data from users, so I'm cool.


No, you're not. GDPR originates from 'what data you hold', which means that not only a massive introspection into
your data inventory is needed, but also an analysis of 'all' data that you have on subjects is required. Even if you don't collect data through web forms or portals, you still need to worry about the data pertaining to EU subjects. 

You might scrap the publicly available information on individuals and try to convert them into leads. You might even have purchased your competitor's leads (Highly not recommended, though. Just saying) or it could be a person on social media who has liked your page. In all these cases, though you haven't obtained data from the user directly, you still have to respect the data you have on him/her and process it under the GDPR.


There is only one type of consent


Firstly, there's private data and sensitive data. The former refers to data like the IP address, pin code etc., while the latter covers aspects like religion, sexual orientation etc. Naturally, the consent mandated for these types vary.

There are two types of consent : Explicit & Implied Consent


Implied consent is when the subject, by providing you a particular data, is accepting it to be used in a certain way. In effect, you don't have to shout out loud by asking him to check a box, but you can just 'imply' consent by stating the way the data is going to be used. But it does have to be unambiguous, which means there should not be more than one interpretation possible for that particular way in which you plan to use the data. Explicit consent is where the subject literally says 'I agree' to your consent statement, which must clearly state what data you are collecting, how you are going to use it, what it means to your subject and how this data will be transferred and the related risks of the transfer.Yeah, that's a lot. But this consent is required only when sensitive data is collected. 


I need to be a data democracy: All rights to all


The data subject rights caught so much attention that GDPR pursuers became too obsessed with it. For example, right to be forgotten was seen as a white elephant in the room and it perhaps got too much attention. Not all rights need to be given all the time. GDPR gives us six lawful bases, which is nothing but the underlying reason behind processing of data. And as your reason varies with the kind of data and processing method, the data rights you need to offer shall vary as well. 


Lawful Basis(row)/Rights applicable (column)

Right to be informed

Right of access

Right to rectification

Right to erasure

Right to restrict processing

Right to data portability

Right to object

Rights related to automated decision making

Consent

 Y

 Y

Y 

 Y

 Y

Y

 

Contract

 Y

 Y

 Y



 Y


 Y

Legal Obligation

 Y

 Y

 Y

 Y




 Y

Vital Interests

 Y

 Y

Y 






Public Tasks

 Y

 Y

 Y




 Y


Legitimate interests

 Y

 Y

 Y

 Y

 Y


 Y

 Y


Consider the above depiction, which correlates between rights and the lawful basis. A data field processed on a basis of contract, cannot be asked to be erased as such. Similarly, a data processed for vital interests cannot be objected. So, being aware of why you process the data that you do, and categorizing them based on applicable rights and lawful basis is an extremely crucial function.


I can use 'Legitimate Interest' for marketing uses relating to personal data, without consent.


The best one is saved for the last, because this is something that can really get you into trouble. Legitimate interest is not the silver bullet you can use when you have run out of options. Usage of legitimate interest has to be weighed against the privacy of the user before it can be applied to a marketing related activity(Any activity, for that matter! ). Even though marketing is an example of legitimate interest given by the ICO itself, it does not rule out the fact that the user must agree to be communicated for marketing. 


A clear 'Opt-in' is always preferred, which is not treated as consent, and it is, in some form, necessary to proceed with marketing communications.

 



    • Recent Topics

    • Zoho Books and Zoho Projects Task Status Update

      How can we create an automation using custom functions for the following scenario. When our zoho books invoice status changes to paid. I want a task in Zoho projects to change to completed.

    • Zoho Books Estimate to Zoho CRM quote?

      I'm not sure why this isnt automatic, but maybe I'm missing something. When we create a quote in zoho books we have a custom function that pushes the contact into a deal within the CRM. I can not for the life of me figure out how to push an estimate from

    • Different content per social media account..

      Is there a way to add different content per social media account on one post?

    • Assigning Tasks and Requests to Groups... how do I?

      Guys, I've spent many hours exploring Zoho Support and we are generally satisfied with the system.  I'm trying to understand how a system that has so much to offer can be missing GROUP assignment and queue functionality.  I am hoping that there is a way

    • Execution failure when fetching a Name field from another app

      In creator I have one app [Employee Directory] with a form [Employees]. One of the fields is a name field called [Name]. Here is a sample that works, if executed from the Employees app: test_Employee = Employees[Name.first_name == "Alex"]; info test_Employee.Name;

    • Parsing of SQL query failed. Please check the SQL syntax.

      I am trying to have Zoho Analytics recognize that if the a Deal is in Stage "Need Docs" it should also be counted as a Deal in the Stage "New Lead" /*New Lead*/ SELECT "ID" 'New Lead' AS "Stage" From "Deals" Where "Stage" = 'Need Docs' Union All Error

    • Where is the setting to enable/disable 2FA?

      The following links show where enable/disable 2FA is supposed to appear, but neither appear for me: https://help.zoho.com/portal/en/kb/zohosites/faq/account/articles/how-do-i-enable-or-disable-two-factor-authentication-for-my-account shows Security >

    • How to Assign Record Ownership in a Custom Form via API?

      Hello everyone, I’ve created a custom form in Zoho People and I’m using the API to manage its records. I would like to know how I can assign ownership of these records to specific users via the API. Is there a specific parameter or field in the API request

    • Customer Statement Template not matching when sending

      Hi everyone! So when I send statements to our customers via Zoho Books, the message that appears by default does not match what I have written on the template Under settings -> email notifications -> sales -> customer statement We have a single default

    • Creation of Path and subpath

      In order to improve the structure of the website for better organization, I would like to consider that when publishing a page, it can be within a section and sub-section. For example, if I have an events option in the menu, I can put past events and

    • Zoho CRM Widget not displaying 2 related lists (JS)

      Okay so I basically have 2 relatedLists that I want to get and render: ZOHO.CRM.API.getRelatedRecords({ Entity: data.Entity, RecordID: data.EntityId, RelatedList: "Notes", page: 1, per_page: 200, }) ZOHO.CRM.API.getRelatedRecords({ Entity: data.Entity,

    • Emailing lookup field but placing this as an ID or number rather than text

      Hi there, First time poster and have been a user of Zoho Creator for approx 6weeks so forgive my ignorance as I learn to code. We have a need to send an email to a specific email address with some of the fields triggered by the submission of a form. In

    • Unlocking New Horizons: A Year in Review

      As we bid farewell to 2024, let's celebrate and revisit the key highlights of the year. From adding a new edition to cross-platform enhancements, here’s a roundup of all the feature updates designed to simplify accounting, optimize financial management,

    • Using AVG in SQL Query

      My current SQL Query is: SELECT "Client Info", avg("Revenue") FROM "Funded Deals" GROUP BY "Client Info" The current table that this is creating: Client Info avg(Revenue) Previous 4175 1st - New 3411 1st - Old 3013 Renew 3069 While this works as I had

    • Peppol Malaysia API

      Hi Zoho Books, my country Malaysia will going to implement "Peppol" (E-Invoicing), starting 1 Jul 2025 for all businesses. The government intends to provide API for accounting app. The workflow involves creating an invoice from accounting app, triggers

    • MORE BUGS: Client Script, Deluge and Widget JS SDK don't work as expected when trying to retrieve a record that has been "rejected" as part of an approval process.

      Client Script $Page.record is null when accessing a record that has been "rejected" as part of an approval process. Deluge zoho.crm.getRecordById(moduleName, recordId) returns {"status":"failure"} when recordId is a valid, but rejected record. OK... I

    • Re-emitir facturas con nueva dirección de facturación

      Hola, necesito saber si es posible que las facturas ya emitidas, pueden ser re-emitidas con el cambio de dirección de facturación, realizado el día de hoy 02-01-2025, para efectos contables. Espero su ayuda, Gracias

    • Zoho Learn vs. Trainer Central

      Hi, I'm currently using Zoho One with a WordPress-based website and WooCommerce to manage my online courses. I would like to know what is the difference between Zoho Learn and Trainer Central and if it's possible for these two platforms to replace WP

    • Map Plan to Different Income Account for Some Subscriptions via API

      We have a plan that has a default Plan Account of "Sales". Can we override the account for a specific subscription via API? In some instances the same exact plan should map to a different income account. When we create stand-alone invoices in Zoho Books,

    • Flow with CRM

      Hello, I have a simple flow that uses a web hook to enter data into a Sales Order. I have the web hook sending Flow data which has a PO field. If the PO has a special character like - or / or \ the task fails. How can I get the flow to be okay with the

    • Chrome browser issues. Anyone else?

      I am suddenly having multiple issues with Chrome browser interpreting the Zoho Mail interface.  Anyone else?  Any known problems? Thanks, Todd

    • Set another Layout as Standard

      We created a few layouts and we want to set another one to standard:

    • Zoho Payroll US?

      Good morning, just reaching out today to see if there's any timeline, or if there's progress being made to bring Zoho Payroll out to be available to all states within the USA. Currently we're going through testing with zoho, and are having issues when

    • Set up multiple IMAP email addresses

      Hi, I just started using CRM and its great, but I just found out I can only add one imap email address for incoming mail in the included salesinbox ...this is ridiculous. All companies have different email such as sales@domain, info@domain , personal@domain

    • Function 58: Custom calculation in item table of invoices (2 fields)

      Hello everyone, and welcome back to our series! In Zoho Books, the Item Amount in invoices is calculated by multiplying the Quantity and Rate fields. Previously, we shared a function to include a custom field in this calculation. Today, we are taking

    • Modules are continuously loading

      Hi! We are not able to open the task modules, it keeps continuously loading

    • Pushing Data from One CRM account to another.

      We have business partners that want to collaborate through the CRM. Other than pre-planned data migrations what are the options for Zoho Users to transfer data between the accounts. For instance, could I create a webhook that is sent from our CRM and then is picked up in the partner's Flow?

    • Search function not working anymore

      Hi! The search function is not working anymore. How can we solve this problem?

    • When converting a lead to an account, the custom mandatory fields in the account are not treated by zoho as mandatory

      In my Account module I have a number of custom fields that I have set as mandatory. When I enter a new customer as a new account they work, I can't save the record without populating them. However when I convert a lead, my CRM users are able to save the

    • Expand Zia's Language Support and AI Capabilities

      Dear Zoho Desk Support, I would like to submit a feature request to improve Zia, the AI-driven support assistant in Zoho Desk. Currently, Zia only supports the English language, while other AI agents such as Gemini, ChatGPT, and Claude can work with a

    • get gettting the days number between two dates with deluge

      I am trying to calculate the days number between 2 specific dates but its not working. PLease help me.

    • geographic search filter in map view

      Hi, I have a recruiting and timesheet system built in Creator. The client wants to enhance the search for candidates based on their location and filter by job skills - currently they look on the Map View which uses the geo location or post code of the

    • Limit excceding issue in zoho creator

      I am transferring data from Zoho Books to Zoho Creator using a Deluge script. However, I am frequently encountering a "limit exceeding error," which seems to be related to the Deluge statements limit. I reached out to Zoho Support, and they informed me

    • How do I add more schedules to Zoho Creator?

      At the moment, the number of schedule calls we have in Zoho Creator are 1800 per month and I was wondering if it was possible to upgrade that amount to something higher. I'd like to know my options as well as the pricing.

    • Conexion CREATOR x CRM

      Buenas tardes, Tengo un problema con un código que crea un registro en CRM. Revisé el CRM para eliminar los campos obligatorios, pero cuando ejecuto el programa, aparece el siguiente mensaje de error: {"code":"MANDATORY_NOT_FOUND","details":{"api_name":"data"},"message":"required

    • Invoices with billable time and expenses

      I cannot seem to get a straight answer. We are looking to create an invoice to send to our clients, but it needs to have the following on it: 1. Billable hours for each employee. All hours for the pay period on one line, by employee. 2. Expenses for each

    • Search Bar Improvement for Zoho Commerce

      Hey everyone, I've been using Zoho Commerce for a bit now, and I think the search bar could really use an upgrade. Right now, it doesn't show products in a dropdown as you type, which would make finding items a lot faster. On Shopify, for example, you

    • Send Whatsapp with API including custom placeholders

      Is is possible to initiate a session on whatsapp IM channel with a template that includes params (placeholders) that are passed on the API call? This is very usefull to send a Utility message for a transactional notification including an order number

    • Can't get form response to populate custom PDF template

      I've created a template and set it to default but can't figure out how to get the response to populate that template. It keeps giving me the default summary.

    • Zoho Sheets not compatible with Excel/Google Sheets

      In order to share a copy of a Zoho sheet with someone that does not use Zoho, it must be downloaded as MS Excel format and then added to an email.  This is a labor intensive, and frankly confusing process.  I have forgotten to do this before, only to

    • Next Page