GDPR- Unlearn and re-learn: Busting the GDPR Myths

GDPR- Unlearn and re-learn: Busting the GDPR Myths

If a sapling was planted every time there was a misconception about GDPR, we'd have probably defeated global warming by now. Any new revolution, be it in technology, philosophy or any other dimension, always creates chaos and confusion during its inception, bringing along with it, a plethora of misconceptions as well. However, it is time we got it all cleared from our heads. 

You might have been a victim of this contagion as well, or have you not? Let us unlearn the (un)popular misconceptions and try to bring in the clarity of crystals to our GDPR understanding.

Consent is an alias of GDPR

The worst of dreams by the GDPR experts will probably involve them yelling 'Consent alone is not GDPR!!', into the psychic space of their co-workers. Because this is, by far, the biggest misunderstanding. GDPR does put high emphasis on consent, but it is not the whole picture. 

There are six lawful bases and they're all equally valid. Say you are a firm based out of Amsterdam and you are employing locals. You don't need to get their consent for storing their information on your register, because the law mandates it. It will fall under the 'legal obligation' umbrella. If a person gets interested about your product and asks for a quote, you don't have to bother him with consent. Because you can process his contact information based on 'Contract'.

Hence, we must keep an open eye and consider all the six lawful bases before applying them to our data processing activities.

Consent is just a check box

Most of us are thinking that the holy check in 'I agree to the Terms & Conditions and Privacy Policy' is the consent we need. Well, no! In fact, that is the first example of what is not a consent, in the ICO website.

There are specific rules to be kept in mind when consent is taken. We must first state all ways in which we shall process the data we are collecting. And furthermore, we must not make it a precondition of a service, which is exactly what we do with the 'I agree to the Terms & Conditions and Privacy Policy' check box. Consent must be given freely with no pre-checked boxes. And even if the boxes are not checked by the subject, the service must not be denied. Hence, before taking the consent route, the whole processing tree must be analysed, and the decision on whether or not to take this route should be made.

GDPR is the Villain


When GDPR first came into picture, there was a massive wave of negativity that accompanied it. Social media was flooded with posts talking about how GDPR will cause a huge expense hole in organisations’ budget and why it will create so many problems that didn’t exist in the first place. Many organisations, by default, assumed that they shall end up non-compliant and some of them even expressed their idea of conjuring up funds for a possible fine due to non-compliance. One could almost feel the need to hit the psychological reset button.


However, we must understand in our bones that GDPR is a set of laws that just demand  Good Business Practice; GDPR must be welcomed with positivity because not only does it provide a company with a better legal and policy framework, but it brings acompetitive advantage as well.


GDPR, in many ways, will change the way businesses are conducted, but one of the main shall be the cognitive advantage that a company shall possess in the minds of its clients, when it becomes GDPR compliant. A GDPR compliant company shall do better positioning in their customer’s head when they can flaunt their compliance tag.


My business is small, so I'm kind of exempt.


Only in specific cases like the one for appointing a DPO, does the GDPR talk about company sizes. GDPR has an attitude and it doesn't care about your firm's size. If you happen to, in anyway, cross any data path of any EU resident, you are under the GDPR radar.

Forget small business! Even if you're a solo-pruner who runs a fashion blog, with an emailing list under your sleeve, you must be GDPR compliant.


I don't collect data from users, so I'm cool.


No, you're not. GDPR originates from 'what data you hold', which means that not only a massive introspection into
your data inventory is needed, but also an analysis of 'all' data that you have on subjects is required. Even if you don't collect data through web forms or portals, you still need to worry about the data pertaining to EU subjects. 

You might scrap the publicly available information on individuals and try to convert them into leads. You might even have purchased your competitor's leads (Highly not recommended, though. Just saying) or it could be a person on social media who has liked your page. In all these cases, though you haven't obtained data from the user directly, you still have to respect the data you have on him/her and process it under the GDPR.


There is only one type of consent


Firstly, there's private data and sensitive data. The former refers to data like the IP address, pin code etc., while the latter covers aspects like religion, sexual orientation etc. Naturally, the consent mandated for these types vary.

There are two types of consent : Explicit & Implied Consent


Implied consent is when the subject, by providing you a particular data, is accepting it to be used in a certain way. In effect, you don't have to shout out loud by asking him to check a box, but you can just 'imply' consent by stating the way the data is going to be used. But it does have to be unambiguous, which means there should not be more than one interpretation possible for that particular way in which you plan to use the data. Explicit consent is where the subject literally says 'I agree' to your consent statement, which must clearly state what data you are collecting, how you are going to use it, what it means to your subject and how this data will be transferred and the related risks of the transfer.Yeah, that's a lot. But this consent is required only when sensitive data is collected. 


I need to be a data democracy: All rights to all


The data subject rights caught so much attention that GDPR pursuers became too obsessed with it. For example, right to be forgotten was seen as a white elephant in the room and it perhaps got too much attention. Not all rights need to be given all the time. GDPR gives us six lawful bases, which is nothing but the underlying reason behind processing of data. And as your reason varies with the kind of data and processing method, the data rights you need to offer shall vary as well. 


Lawful Basis(row)/Rights applicable (column)

Right to be informed

Right of access

Right to rectification

Right to erasure

Right to restrict processing

Right to data portability

Right to object

Rights related to automated decision making

Consent

 Y

 Y

Y 

 Y

 Y

Y

 

Contract

 Y

 Y

 Y



 Y


 Y

Legal Obligation

 Y

 Y

 Y

 Y




 Y

Vital Interests

 Y

 Y

Y 






Public Tasks

 Y

 Y

 Y




 Y


Legitimate interests

 Y

 Y

 Y

 Y

 Y


 Y

 Y


Consider the above depiction, which correlates between rights and the lawful basis. A data field processed on a basis of contract, cannot be asked to be erased as such. Similarly, a data processed for vital interests cannot be objected. So, being aware of why you process the data that you do, and categorizing them based on applicable rights and lawful basis is an extremely crucial function.


I can use 'Legitimate Interest' for marketing uses relating to personal data, without consent.


The best one is saved for the last, because this is something that can really get you into trouble. Legitimate interest is not the silver bullet you can use when you have run out of options. Usage of legitimate interest has to be weighed against the privacy of the user before it can be applied to a marketing related activity(Any activity, for that matter! ). Even though marketing is an example of legitimate interest given by the ICO itself, it does not rule out the fact that the user must agree to be communicated for marketing. 


A clear 'Opt-in' is always preferred, which is not treated as consent, and it is, in some form, necessary to proceed with marketing communications.

 



    • Recent Topics

    • sync data from outside of zoho plateform

      hii team , i am creating a platform using zoho platform, i want to sync the data from out side of the platform like people-soft, but i am not able to sync the data , if it is possible , then suggest me how can i do it , i want to sync data from other

    • How to add a Data Updated As Of: dynamically in text?

      I need to add a "Data Updated As Of" in the dashboard to show when was the last date the data was updated. I tried to create a widget but it does not look really good, see below. Is there a way I can do this through the text widget and update it automatically

    • Automate search in customer list and easilly initiate email

      Hello and happy new year ! I have a customer list with name, telephone, emails and some criterias like location, type of customer, etc. I want to search that form to extract part of it, for example all customers that have a location of "Québec city" and

    • "Select All" item in the context menu

      In the Client on Android, there is a “Select all” item in the note’s context menu. There is no such item in the PC client. Can it be added in future versions of the client?

    • Syncing Leave Calendar With Shared Google Calendar Does Not Remove Canceled Leaves

      Our organization has each employee sync their Leaves calendar with a shared Google calendar, but am I right that if an employee cancels a Leave in Zoho that it will not be removed automatically from the shared Google calendar through the same sync m

    • Is it possible to display formulas in cells instead of calculated results?

      I want to export my Zoho sheet as tab separated text without losing the formulas. In excel, I would use the settings Options - Advanced - show formulas in cells instead of their calculated results then save as tab separated values. How do I do this in

    • Creator Simplified #11: Create a custom button to download files

      Hey there! This time, let's see how to create custom buttons to download the files uploaded in the file upload field. Sample use-case A training app has a module that provides the materials for all the available courses. Students can click on the corresponding

    • Zoho vault uses only password to unlock not a TouchID

      TouchID works when normally openning app but when called from keyboard while browsing or trying to log to another app it shows only password option to unlock. This behaviour is only on iPad Mini witch latest 18.2OS

    • Batch Tracking Enhancements In Zoho Inventory

      Hello users, We’re excited to announce that we’ve taken batch tracking to a whole new level in Zoho Inventory! We’ve made it more accessible and easier to use than ever. Here’s a quick look at the improvements: 1) A New Way To Create or Modify Batches

    • Zoho Payroll's Year in Review 2024

      As we roll into 2025, we'd like to pay tribute to all the milestones we hit in 2024! From releasing out new features that streamlined your workflows to updates that made payroll management smoother, we’ve had a prolific year—all while keeping you, our

    • Zoho Desk Mobile App Year-End Roundup - 2024

      Hello Everyone, Greetings! As you gear up for the festive season, we are excited to share a quick journey into all that is released in 2024! Availability of each feature in iOS and Android released in 2024 are as follows: For more information on the above

    • Task Completion vs Estimated Time

      I need to represent the Estimated Date vs Actual Completion Date for multiple Tasks. How Can I Do this in Zoho Analytics.

    • Upload Field - cannot be checked in rules configuration.

      We wanted to create a process to verify whether the upload fields are empty or not. If empty, then it should deny during submission. We don't want to use the mandatory field setting because in a 10 pager form, some upload field located in page 1 will

    • CRM x WorkDrive: File storage for new CRM signups is now powered by WorkDrive

      Availability Editions: All DCs: All Release plan: Released for new signups in all DCs. It will be enabled for existing users in a phased manner in the upcoming months. Help documentation: Documents in Zoho CRM Manage folders in Documents tab Manage files

    • Is it possible to hide Developer Space for all user in Zoho Projects

      Hello! I am Zoho admin in a company and we want to use Zoho Project to manage projects, but after a few days of testing we are not able to "hide" the Developer Space from all kind of users except the admin. To sum up, I want to hide this for all users.

    • Chat function not working properly

      Ever since upgrading to plus, the chat is all messed up. it is coming up behind the web page so that I cannot see what I'm typing and cannot read replies. I can only see the bottom of the text box at the bottom of the page, and then it is blocked. I've

    • Wrong Time on Exported Records

      Hello, All records in my exported Notes .csv file have the incorrect time for Created Time. They are all 8 hours ahead. I've already verified that my time zone is correct in both Personal Settings and Company Settings. Is there any way to fix this?

    • Sync workspace - table

      I have connected two workspaces and I have imported two different query tables from one workspace to the other one, that was a succes. But now I want to import another query table from the same workspace to the other but I get an error. Why is that? (there

    • Subir o Preço Unitário já acrescido de um valor

      To com um desafio grande, e se alguém conseguir me ajudar, seria ótimo! O que eu preciso é que o na hora de adicionar um item no subformulário dos itens cotados do módulo Orçamentos, o preço de lista do item venha acrescido de 20% automaticamente e de

    • Ring in the New Year with Guided Conversations for Smooth Offline Support

      As we step into the new year, it’s time to refocus, re-energize, and gear up for fresh opportunities. But what about your customers as they begin the year with their own set of challenges or queries to resolve? With Zoho Desk’s Guided Conversations (GC),

    • Exploring SalesIQ's Top Features of 2024: An Insider's Look 🔍

      As we wrap up another year at Zoho SalesIQ, it's time to reflect on how far we've come. This year has been incredible for us in our journey to build a more powerful, flexible, and customer-centric engagement platform. We've introduced several features

    • Free user licenses across all Portal user types

      Greetings everyone, We're here with some exciting and extensive changes to the availability of free user licenses in CRM Portals. This update provides users with access to all Portal user types for free to help them diversify their user licenses and explore

    • How to map a global picklist from one module to another

      Hi there, i currently have a new field that is called sales office which we use for permission settings between our different offices located in different countries. It is a global set picklist with three different options: MY, SG and VN. I want to be

    • updateTask Zoho Connect API

      When I do POST request by https://connect.zoho.com/pulse/api/updateTask with parameters scopeID, taskId, title, status and with header Zoho-oauthtoken, I got next response: {'updateTask': {'reason': 'You are not authorized to do this action.', 'result':

    • Alert for Back Navigation in Zoho Creator Widgets on Mobile Apps

      In Zoho Creator widgets, when a user navigates back on mobile devices, the data within the widget is reset. This leads to a loss of any unsaved changes or inputs, causing frustration for users. To enhance user experience, we need to implement a confirmation

    • Can Creator integrate with a CRM Sandbox

      zoho & Creator Noob -  I would like to build a Creator App and integrate it to the CRM Sandbox.  Then, when I have the bugs worked out integrate it to the production CRM account.  Can Creator do this ?  I built a test Creator App and integrated it to the CRM in a test zoho account fairly easily.  

    • Allow Multiple Scheduled Appointments with Zoho Support

      Dear Zoho Team, I hope you're doing well. First, thank you for introducing the option to schedule support calls via the Zoho CRM booking link. This has been a fantastic enhancement, eliminating the need for back-and-forth coordination when scheduling

    • Zoho CRM - best way to search an account and assign to a deal

      Hi Everyone I am looking for some advice. I want to find the best way to complete the below steps. We have a deal and once it reaches a certain stage we need to allocate a supplier / vendor to this deal along with the salesperson. I want to add (ideally

    • Zia Call Intelligence only up 10 License

      I have been trying to install Call Intelligence for two days now, but strangely, the button is missing at this point. The documentation could be better, but most importantly, someone should inform small businesses like us that they don’t even bother enabling

    • Accrue Leave by Hours Worked?

      My locality (Michigan, US) has enacted a law that requires that 1 hour of sick leave be accrued for every 30 hours worked. I cannot see how to implement this policy in Zoho People. There does not appear to be a mechanism for accruing leave proportional

    • Fixed assets recording

      Hello there, I recorded a bill for a vendor contain (Computer) so the PC is a fixed assets, do I need to do a manual journal to include this PC under the fixed assets category (furniture & equipment)? If yes, please take me through the manual journal

    • error in importing customers

      get this error message while importing customers, there is no column for COUNTRY CODE in sample excel file

    • Workflow Based on Manual Journal

      Manual journal entries are one of the few areas that cannot kick off a workflow automation in Zoho Books currently. I would propose considering adding that. My use case is that the payroll provider I use (a flavor of SurePayroll) has a Zoho Books automation

    • Digest Décembre - Un résumé de ce qui s'est passé le mois dernier sur Community

      Bonjour chers utilisateurs, Toute l'équipe Zoho france vous souhaite une année remplie de joie, de réussite et de prospérité. Alors que nous débutons cette nouvelle année avec des projets innovants, des astuces, des produits et bien d'autres choses encore,

    • New Year Wishes to the Zoho Finance Developer Community!

      Hello developers, Happy New Year! As we step into 2025, we wish you a journey filled with growth, success, and exciting opportunities ahead. We’re thrilled to announce that we have something exciting in store for you. Welcome to the Zoho Finance Developer

    • Button Display Conditions

      Hi Guys, Is it at all possible to have extra button conditions? Context: We have data in our deals module which has a custom button which converts the deal into contacts + set up relationships between them. At the end of the conversion we set a field

    • Ayuda con zoho creator x zoho Crm

      Hola a todos, Estoy teniendo dificultades al sincronizar datos entre Zoho Creator y Zoho CRM. Mi objetivo es lo siguiente: Busque un registro en el módulo Contactsde Zoho CRM utilizando el correo electrónico del registro de Zoho Creator. Si se encuentra

    • How to Replace an Assessment in a Job Opening on Zoho Recruit

      Hi everyone, I’m currently using Zoho Recruit and would like to replace the assessment linked to a specific job opening. I want to remove the existing assessment and add a new one. What is the best way to do this without losing any important data or affecting

    • Fixed asset management

      I want to know if there is any individual module for fixed assets management

    • Input GST Reversal for damaged goods

      In our line of business, some items are damaged and we are doing inventory adjustments to remove them from stock. However, as per GST guidelines, there is a specific rule that we have to reverse Input GST availed for such items and needs to be reported

    • Next Page