GDPR- Unlearn and re-learn: Busting the GDPR Myths

GDPR- Unlearn and re-learn: Busting the GDPR Myths

If a sapling was planted every time there was a misconception about GDPR, we'd have probably defeated global warming by now. Any new revolution, be it in technology, philosophy or any other dimension, always creates chaos and confusion during its inception, bringing along with it, a plethora of misconceptions as well. However, it is time we got it all cleared from our heads. 

You might have been a victim of this contagion as well, or have you not? Let us unlearn the (un)popular misconceptions and try to bring in the clarity of crystals to our GDPR understanding.

Consent is an alias of GDPR

The worst of dreams by the GDPR experts will probably involve them yelling 'Consent alone is not GDPR!!', into the psychic space of their co-workers. Because this is, by far, the biggest misunderstanding. GDPR does put high emphasis on consent, but it is not the whole picture. 

There are six lawful bases and they're all equally valid. Say you are a firm based out of Amsterdam and you are employing locals. You don't need to get their consent for storing their information on your register, because the law mandates it. It will fall under the 'legal obligation' umbrella. If a person gets interested about your product and asks for a quote, you don't have to bother him with consent. Because you can process his contact information based on 'Contract'.

Hence, we must keep an open eye and consider all the six lawful bases before applying them to our data processing activities.

Consent is just a check box

Most of us are thinking that the holy check in 'I agree to the Terms & Conditions and Privacy Policy' is the consent we need. Well, no! In fact, that is the first example of what is not a consent, in the ICO website.

There are specific rules to be kept in mind when consent is taken. We must first state all ways in which we shall process the data we are collecting. And furthermore, we must not make it a precondition of a service, which is exactly what we do with the 'I agree to the Terms & Conditions and Privacy Policy' check box. Consent must be given freely with no pre-checked boxes. And even if the boxes are not checked by the subject, the service must not be denied. Hence, before taking the consent route, the whole processing tree must be analysed, and the decision on whether or not to take this route should be made.

GDPR is the Villain


When GDPR first came into picture, there was a massive wave of negativity that accompanied it. Social media was flooded with posts talking about how GDPR will cause a huge expense hole in organisations’ budget and why it will create so many problems that didn’t exist in the first place. Many organisations, by default, assumed that they shall end up non-compliant and some of them even expressed their idea of conjuring up funds for a possible fine due to non-compliance. One could almost feel the need to hit the psychological reset button.


However, we must understand in our bones that GDPR is a set of laws that just demand  Good Business Practice; GDPR must be welcomed with positivity because not only does it provide a company with a better legal and policy framework, but it brings acompetitive advantage as well.


GDPR, in many ways, will change the way businesses are conducted, but one of the main shall be the cognitive advantage that a company shall possess in the minds of its clients, when it becomes GDPR compliant. A GDPR compliant company shall do better positioning in their customer’s head when they can flaunt their compliance tag.


My business is small, so I'm kind of exempt.


Only in specific cases like the one for appointing a DPO, does the GDPR talk about company sizes. GDPR has an attitude and it doesn't care about your firm's size. If you happen to, in anyway, cross any data path of any EU resident, you are under the GDPR radar.

Forget small business! Even if you're a solo-pruner who runs a fashion blog, with an emailing list under your sleeve, you must be GDPR compliant.


I don't collect data from users, so I'm cool.


No, you're not. GDPR originates from 'what data you hold', which means that not only a massive introspection into
your data inventory is needed, but also an analysis of 'all' data that you have on subjects is required. Even if you don't collect data through web forms or portals, you still need to worry about the data pertaining to EU subjects. 

You might scrap the publicly available information on individuals and try to convert them into leads. You might even have purchased your competitor's leads (Highly not recommended, though. Just saying) or it could be a person on social media who has liked your page. In all these cases, though you haven't obtained data from the user directly, you still have to respect the data you have on him/her and process it under the GDPR.


There is only one type of consent


Firstly, there's private data and sensitive data. The former refers to data like the IP address, pin code etc., while the latter covers aspects like religion, sexual orientation etc. Naturally, the consent mandated for these types vary.

There are two types of consent : Explicit & Implied Consent


Implied consent is when the subject, by providing you a particular data, is accepting it to be used in a certain way. In effect, you don't have to shout out loud by asking him to check a box, but you can just 'imply' consent by stating the way the data is going to be used. But it does have to be unambiguous, which means there should not be more than one interpretation possible for that particular way in which you plan to use the data. Explicit consent is where the subject literally says 'I agree' to your consent statement, which must clearly state what data you are collecting, how you are going to use it, what it means to your subject and how this data will be transferred and the related risks of the transfer.Yeah, that's a lot. But this consent is required only when sensitive data is collected. 


I need to be a data democracy: All rights to all


The data subject rights caught so much attention that GDPR pursuers became too obsessed with it. For example, right to be forgotten was seen as a white elephant in the room and it perhaps got too much attention. Not all rights need to be given all the time. GDPR gives us six lawful bases, which is nothing but the underlying reason behind processing of data. And as your reason varies with the kind of data and processing method, the data rights you need to offer shall vary as well. 


Lawful Basis(row)/Rights applicable (column)

Right to be informed

Right of access

Right to rectification

Right to erasure

Right to restrict processing

Right to data portability

Right to object

Rights related to automated decision making

Consent

 Y

 Y

Y 

 Y

 Y

Y

 

Contract

 Y

 Y

 Y



 Y


 Y

Legal Obligation

 Y

 Y

 Y

 Y




 Y

Vital Interests

 Y

 Y

Y 






Public Tasks

 Y

 Y

 Y




 Y


Legitimate interests

 Y

 Y

 Y

 Y

 Y


 Y

 Y


Consider the above depiction, which correlates between rights and the lawful basis. A data field processed on a basis of contract, cannot be asked to be erased as such. Similarly, a data processed for vital interests cannot be objected. So, being aware of why you process the data that you do, and categorizing them based on applicable rights and lawful basis is an extremely crucial function.


I can use 'Legitimate Interest' for marketing uses relating to personal data, without consent.


The best one is saved for the last, because this is something that can really get you into trouble. Legitimate interest is not the silver bullet you can use when you have run out of options. Usage of legitimate interest has to be weighed against the privacy of the user before it can be applied to a marketing related activity(Any activity, for that matter! ). Even though marketing is an example of legitimate interest given by the ICO itself, it does not rule out the fact that the user must agree to be communicated for marketing. 


A clear 'Opt-in' is always preferred, which is not treated as consent, and it is, in some form, necessary to proceed with marketing communications.

 



    • Recent Topics

    • I cannot receive emails.

      I need help, I've tried everything but I still can't receive emails from other people. I can send it but I can't receive emails, When I created the email it was all in order and suddenly I can't get emails from anyone anymore.

    • Incoming Gmail Email Not Coming Into Zoho

      My outbound email from Zoho is working, but when people respond to the email, it's not coming back into Zoho. I can see it when I'm in Gmail, but it's not in Zoho.

    • Não foi possível enviar a mensagem;Razão:554 5.1.8 Email Outgoing Blocked.

      Preciso de ajuda não consigo enviar emails,conta recen criada

    • Average Costing / Weighted Average Costing

      Hello fellow maadirs. I understand Zoho Books uses FIFO method of dealing with inventory costing, but do you guys have any plans to introduce average costing? We indians need average costing. It's part of our culture. Please. I beg thee. Thanks.

    • Credit note

      By mistake I issued credit note in Jan 2025 for the invoice related to Dec 2024. Now I want to delete this credit note but anable to do so. Need help in this

    • CRM formula field help

      Hello! i was hoping to get some help with a formula i'm creating within a module. I'm looking to make a formula that changes based on a date field but based upon the present date. This is the formula i have so far: If(Now() < ${Instructors.Start Date},

    • Change to copy/paste functionality in Deluge code editor

      Recently there was a change to the Deluge code etidor where it now inserts backslashes into strings automatically when copying/pasting strings with double quotes, it's a nightmare to have to go delete all these. Is it possible to toggle this on or off?

    • BANK FEED - MAYBANK , provider from YODLEE IS NOT WORKING

      As per topic, the provider YODLEE is not working for the BANK FEED. It have been reported since 2023 Q3, and second report on 2023 Q4. now almost end of 2024 Q1, and coming to 2024 Q2. Malaysia Bank Maybank is NOT working. can anyone check on this issue?

    • Canadian payroll

      Hello ZOHO, is any updates on when payroll for Canada will be available?

    • Default reminders on Emails

      I have seen that it is possible to set, for each email, a reminder when the email remains unresponded for some time. This is very useful, so useful that I would like to set it for all my emails, by default. Because an unanswered email usually requires

    • in zoho assist I would like to temporarliy go into view only mode

      During a zoho assist remote support / remote control session, I would like an option to turn off control, and go into view only mode. Then later, turn back on control, all within the same session. (Many other remote login apps have this feature.) For

    • Zoho notes list issue

      Hi team, Suddenly my extension is not working and I could not find the extension in my marketplace list anymore. Extension version deprecated This version of the extension is no longer in use. Please update the extension and try again.

    • Assignment Rule: Immediate Ticket Assignment to Agents Upon Shift Start

      Dear Zoho Desk Team, I hope this message finds you well. Currently, when the option to assign tickets to offline agents is turned off, agents who come online during their shift have to wait for about 30 minutes before any tickets from the queue are assigned

    • Change email template depending on answer from form

      Is it possible to set up the following in Zoho Desk: When a user submits a ticket via the Zoho Help Center's form, they can select an answer from a dropdown field. In this example, the dropdown options are 'Option A' and 'Option B.' If a user selects

    • Kaizen #171: FAQs on COQL API

      Hello all!! Welcome back to another post in the Kaizen series! In this post, we will address some of the most frequently asked questions about Zoho CRM's COQL API from the Zoho CRM Developer Community Forum. COQL API Query API lets you query for records

    • Issue with Date Placeholder Formatting in Ticket ID Customization

      Hello Support Team, I'm experiencing an issue with the date placeholder formatting in Zoho Desk's Ticket ID customization. Specifically, when using the `{{DD}}` placeholder for the day in the prefix or suffix, the output displays the day as a single digit

    • Time Field

      Good Day, I have a question, when I save a draft and reload it. Why does the time field format keeps goes from hh:mm to hh:mm:ss? Is there a way I can force it to load to hh:mm only? I have tried example = totime(input.TimeField, "hh:mm") in the -created

    • Feature Req - See imap emails in Timeline tab of a deal

      In many other CRMs such as pipedrive and hubspot, when you are looking at the timeline of a deal you can also see snippets of emails that have been sent or received and then click to view the full message. This gives users a fast way to catch up on EVERYTHING

    • HOW TO: Searching a thread (email body/text) with a custom function, allowing filtering and specific actions

      We are still trialing out Zoho at this time, but have found a major expected feature to be missing - the ability to search within the text of an email for automation/workflows. NOTE: You need to create a connection for zohodesk under settings -> Developer

    • Partnership Proposal for Supporting Number Porting Services in Singapore

      Dear Zoho Representative’s, I hope this message finds you well. My name is Honelito Gilos, and I represent Borderless Hub Pte Ltd (Singapore). We are a Telco here in Singapore specialising in providing seamless number porting services, and I’m reaching

    • Tip #2: Prefill forms automatically with existing Zoho CRM data

      How to automatically prefill a form with existing Zoho CRM data? Prefilled forms can be useful when you want your prospects to view and confirm their data, and in a wide range of other situations. In Zoho Forms, we prefill the fields with the values from Zoho CRM using the Zoho CRM field. What is a Zoho CRM field? A Zoho CRM field acts as a two-way communication channel, by sending data to Zoho CRM from forms and fetching information from CRM into Forms. The field will look up data from your CRM

    • Transform Your Customer Support with AI-Powered Chatbots in Zoho SalesIQ

      Ever wondered how some companies seem to have superhuman customer support? Let's uncover their secret! In the digital age, customer expectations are skyrocketing. Did you know that according to McKinsey, 75% of consumers expect a response within five

    • Quickbooks conversion and Internet sales

      Hello, we are considering converting from Quickbooks enterprise to Zoho Books and using MonotorZ for our mrp needs. Today we import Internet sales under a single customer with multiple ship to addresses. We want to maintain the detail in CRM for marketing

    • How to add two columns in Zoho forms

      I would like to have two columns in Zoho forms. How can i enable two columns?

    • When creating Sales Order / Estimate via API, the line item Tax Code does not get pulled in.

      I'm creating Sales Orders via API from CRM but it does not pull in the "Tax Code" I've read within the forums that this should be done automatically but it's not happening. Not sure if it's a bug or by design? Anybody else know? Should we be adding the

    • Chart showing schedule

      I want to be able to create a chart for everyday to check and which of which driver is available on the timeframe. Here's my table Name City Day Start Time End Time Driver1 Medicine Hat Monday 11:45 AM 4:45 PM Driver 2 Medicine Hat Tuesday 11:00 AM 7:00

    • Quais são os maiores desafios que você enfrenta ao implementar o Zoho CRM?

      Olá, pessoal da comunidade Zoho Brasil! Sou parceiro autorizado da Zoho e, ao longo do tempo, tenho notado que cada implementação de CRM traz desafios únicos, dependendo do segmento de negócio, das metas da empresa e até da familiaridade da equipe com

    • 2025 Just Got More Exciting for Developers!

      Hello, Greetings to the Zoho Books Community! As we step into the New Year, we're thrilled to roll out something truly special for our Zoho Finance enthusiasts – the "Zoho Finance Developer" Community! This is your exclusive space to connect with fellow

    • Error in executing On user input script

      I'm having problems with this  this script : ; Tipo_list=List(); Tipo_rec = Tabla_factores[Periodo == input.Periodo_anos.toLong()]; Tipo_list.addAll(Tipo_rec.Clase_credito.getall()); for each Clase_credito in Tipo_list { Tipo_credito:ui.add(Clase_credito) } Error in executing On User Input script of Periodo en años. Error. Error in executing Fetch Record task. Unable to fetch Tabla_factores and update variable Tipo_rec. Error in evaluating the criteria : Error. Error evaluating NUMERIC expression

    • sync data from outside of zoho plateform

      hii team , i am creating a platform using zoho platform, i want to sync the data from out side of the platform like people-soft, but i am not able to sync the data , if it is possible , then suggest me how can i do it , i want to sync data from other

    • How to add a Data Updated As Of: dynamically in text?

      I need to add a "Data Updated As Of" in the dashboard to show when was the last date the data was updated. I tried to create a widget but it does not look really good, see below. Is there a way I can do this through the text widget and update it automatically

    • Automate search in customer list and easilly initiate email

      Hello and happy new year ! I have a customer list with name, telephone, emails and some criterias like location, type of customer, etc. I want to search that form to extract part of it, for example all customers that have a location of "Québec city" and

    • "Select All" item in the context menu

      In the Client on Android, there is a “Select all” item in the note’s context menu. There is no such item in the PC client. Can it be added in future versions of the client?

    • Syncing Leave Calendar With Shared Google Calendar Does Not Remove Canceled Leaves

      Our organization has each employee sync their Leaves calendar with a shared Google calendar, but am I right that if an employee cancels a Leave in Zoho that it will not be removed automatically from the shared Google calendar through the same sync m

    • Is it possible to display formulas in cells instead of calculated results?

      I want to export my Zoho sheet as tab separated text without losing the formulas. In excel, I would use the settings Options - Advanced - show formulas in cells instead of their calculated results then save as tab separated values. How do I do this in

    • Creator Simplified #11: Create a custom button to download files

      Hey there! This time, let's see how to create custom buttons to download the files uploaded in the file upload field. Sample use-case A training app has a module that provides the materials for all the available courses. Students can click on the corresponding

    • Batch Tracking Enhancements In Zoho Inventory

      Hello users, We’re excited to announce that we’ve taken batch tracking to a whole new level in Zoho Inventory! We’ve made it more accessible and easier to use than ever. Here’s a quick look at the improvements: 1) A New Way To Create or Modify Batches

    • Zoho Desk Mobile App Year-End Roundup - 2024

      Hello Everyone, Greetings! As you gear up for the festive season, we are excited to share a quick journey into all that is released in 2024! Availability of each feature in iOS and Android released in 2024 are as follows: For more information on the above

    • Task Completion vs Estimated Time

      I need to represent the Estimated Date vs Actual Completion Date for multiple Tasks. How Can I Do this in Zoho Analytics.

    • Upload Field - cannot be checked in rules configuration.

      We wanted to create a process to verify whether the upload fields are empty or not. If empty, then it should deny during submission. We don't want to use the mandatory field setting because in a 10 pager form, some upload field located in page 1 will

    • Next Page