GDPR- Unlearn and re-learn: Busting the GDPR Myths

GDPR- Unlearn and re-learn: Busting the GDPR Myths

If a sapling was planted every time there was a misconception about GDPR, we'd have probably defeated global warming by now. Any new revolution, be it in technology, philosophy or any other dimension, always creates chaos and confusion during its inception, bringing along with it, a plethora of misconceptions as well. However, it is time we got it all cleared from our heads. 

You might have been a victim of this contagion as well, or have you not? Let us unlearn the (un)popular misconceptions and try to bring in the clarity of crystals to our GDPR understanding.

Consent is an alias of GDPR

The worst of dreams by the GDPR experts will probably involve them yelling 'Consent alone is not GDPR!!', into the psychic space of their co-workers. Because this is, by far, the biggest misunderstanding. GDPR does put high emphasis on consent, but it is not the whole picture. 

There are six lawful bases and they're all equally valid. Say you are a firm based out of Amsterdam and you are employing locals. You don't need to get their consent for storing their information on your register, because the law mandates it. It will fall under the 'legal obligation' umbrella. If a person gets interested about your product and asks for a quote, you don't have to bother him with consent. Because you can process his contact information based on 'Contract'.

Hence, we must keep an open eye and consider all the six lawful bases before applying them to our data processing activities.

Consent is just a check box

Most of us are thinking that the holy check in 'I agree to the Terms & Conditions and Privacy Policy' is the consent we need. Well, no! In fact, that is the first example of what is not a consent, in the ICO website.

There are specific rules to be kept in mind when consent is taken. We must first state all ways in which we shall process the data we are collecting. And furthermore, we must not make it a precondition of a service, which is exactly what we do with the 'I agree to the Terms & Conditions and Privacy Policy' check box. Consent must be given freely with no pre-checked boxes. And even if the boxes are not checked by the subject, the service must not be denied. Hence, before taking the consent route, the whole processing tree must be analysed, and the decision on whether or not to take this route should be made.

GDPR is the Villain


When GDPR first came into picture, there was a massive wave of negativity that accompanied it. Social media was flooded with posts talking about how GDPR will cause a huge expense hole in organisations’ budget and why it will create so many problems that didn’t exist in the first place. Many organisations, by default, assumed that they shall end up non-compliant and some of them even expressed their idea of conjuring up funds for a possible fine due to non-compliance. One could almost feel the need to hit the psychological reset button.


However, we must understand in our bones that GDPR is a set of laws that just demand  Good Business Practice; GDPR must be welcomed with positivity because not only does it provide a company with a better legal and policy framework, but it brings acompetitive advantage as well.


GDPR, in many ways, will change the way businesses are conducted, but one of the main shall be the cognitive advantage that a company shall possess in the minds of its clients, when it becomes GDPR compliant. A GDPR compliant company shall do better positioning in their customer’s head when they can flaunt their compliance tag.


My business is small, so I'm kind of exempt.


Only in specific cases like the one for appointing a DPO, does the GDPR talk about company sizes. GDPR has an attitude and it doesn't care about your firm's size. If you happen to, in anyway, cross any data path of any EU resident, you are under the GDPR radar.

Forget small business! Even if you're a solo-pruner who runs a fashion blog, with an emailing list under your sleeve, you must be GDPR compliant.


I don't collect data from users, so I'm cool.


No, you're not. GDPR originates from 'what data you hold', which means that not only a massive introspection into
your data inventory is needed, but also an analysis of 'all' data that you have on subjects is required. Even if you don't collect data through web forms or portals, you still need to worry about the data pertaining to EU subjects. 

You might scrap the publicly available information on individuals and try to convert them into leads. You might even have purchased your competitor's leads (Highly not recommended, though. Just saying) or it could be a person on social media who has liked your page. In all these cases, though you haven't obtained data from the user directly, you still have to respect the data you have on him/her and process it under the GDPR.


There is only one type of consent


Firstly, there's private data and sensitive data. The former refers to data like the IP address, pin code etc., while the latter covers aspects like religion, sexual orientation etc. Naturally, the consent mandated for these types vary.

There are two types of consent : Explicit & Implied Consent


Implied consent is when the subject, by providing you a particular data, is accepting it to be used in a certain way. In effect, you don't have to shout out loud by asking him to check a box, but you can just 'imply' consent by stating the way the data is going to be used. But it does have to be unambiguous, which means there should not be more than one interpretation possible for that particular way in which you plan to use the data. Explicit consent is where the subject literally says 'I agree' to your consent statement, which must clearly state what data you are collecting, how you are going to use it, what it means to your subject and how this data will be transferred and the related risks of the transfer.Yeah, that's a lot. But this consent is required only when sensitive data is collected. 


I need to be a data democracy: All rights to all


The data subject rights caught so much attention that GDPR pursuers became too obsessed with it. For example, right to be forgotten was seen as a white elephant in the room and it perhaps got too much attention. Not all rights need to be given all the time. GDPR gives us six lawful bases, which is nothing but the underlying reason behind processing of data. And as your reason varies with the kind of data and processing method, the data rights you need to offer shall vary as well. 


Lawful Basis(row)/Rights applicable (column)

Right to be informed

Right of access

Right to rectification

Right to erasure

Right to restrict processing

Right to data portability

Right to object

Rights related to automated decision making

Consent

 Y

 Y

Y 

 Y

 Y

Y

 

Contract

 Y

 Y

 Y



 Y


 Y

Legal Obligation

 Y

 Y

 Y

 Y




 Y

Vital Interests

 Y

 Y

Y 






Public Tasks

 Y

 Y

 Y




 Y


Legitimate interests

 Y

 Y

 Y

 Y

 Y


 Y

 Y


Consider the above depiction, which correlates between rights and the lawful basis. A data field processed on a basis of contract, cannot be asked to be erased as such. Similarly, a data processed for vital interests cannot be objected. So, being aware of why you process the data that you do, and categorizing them based on applicable rights and lawful basis is an extremely crucial function.


I can use 'Legitimate Interest' for marketing uses relating to personal data, without consent.


The best one is saved for the last, because this is something that can really get you into trouble. Legitimate interest is not the silver bullet you can use when you have run out of options. Usage of legitimate interest has to be weighed against the privacy of the user before it can be applied to a marketing related activity(Any activity, for that matter! ). Even though marketing is an example of legitimate interest given by the ICO itself, it does not rule out the fact that the user must agree to be communicated for marketing. 


A clear 'Opt-in' is always preferred, which is not treated as consent, and it is, in some form, necessary to proceed with marketing communications.

 



    • Recent Topics

    • "notes"-field in a task to full width?

      Hi, Is there someone that can tell me how to adjust the "notes"-field in a task, to full width? I already played around with 1 or 2 columns, but this has nu effect on the standard width. Thx in advance for your help. Cheers, Ralph.

    • How to download Job Sheets in Zoho FSM?

      Hello, I'd like to download copies of completed job sheets as PDF's for upload to a workdrive to keep an audit record of completed Job checkout sheets. I do not see download of this file type as an option - any help is appreciated!

    • [Webinar] Zoho Writer for law firms and legal professionals

      Are manual processes slowing down your legal practice? Are you ready to simplify document management and free up more time for your team to focus on what truly matters? Join us on January 16, 2025, for an exclusive Zoho Writer webinar designed specifically

    • Introducing Bin Locations In Zoho Inventory

      Hello users, We are excited to let you know that your wait for the Bin Locations feature has now come to an end! Yes, you heard us right! We are here to introduce the much-awaited Bin Locations now in Zoho Inventory. But before we dive into the feature

    • How to send mail with js SDK

      Hell o I'm using https://live.zwidgets.com/js-sdk/1.2/ZohoEmbededAppSDK.min.js, for my widget in CRM (built with sigma) Is it possible to send email from js file, I try ti use that ZOHO.CRM.API.sendMail({ "Entity": "Accounts", "RecordID": sharedVariableEntityId,

    • Cannot add Zoho Forms link to LinkedIn

      Hello, We have encountered a problem where we are unable to share a Zoho Forms link on LinkedIn. This is what we got from LinkedIN, but we have not heard back from Zoho Support as yet, and we are meanwhile stuck... "It seems the URL does not scrape the

    • Feature request - pin or flag note

      Hi, It would be great if you could either pin or flag one or more notes so that they remain visible when there are a bunch of notes and some get hidden in the list. Sometimes you are looking for a particular name that gets lost in a bunch of less important

    • i keep see there is a connetion issue connecting 3rd party api on zoho when using zia

      hi there , i have set up open ai api to zoho zia (copied and pasted to zoho zia) but I keep getting notificaiton "there is a connetion issue connecting 3rd party api on zoho" when using zia on top when click zia and try to type in word there

    • SendMail in CRM Deluge function rejects a validated email address

      In a CRM Deluge function, the email address is considered invalid. Is there another method by which it can be validated? It's unacceptable in my current situation to use either the zoho.loginuserid or adminuserid as the From address.

    • how do i remove a specific Zoho Service from my account

      I no longer need Zoho CRM, ZRM Assist nor ZRM BugTracker. How do I remove them from the list of apps for my account?

    • Introducing 'Queries' In Zoho CRM

      Hello everyone! We are here with an exciting feature - Queries in Zoho CRM! A little context before we dive right into the feature specifics :) In today’s fast-paced business environment, immediate access to relevant data is essential for informed decision-making.

    • Build custom AI solutions with Catalyst’s QuickML capabilities in CRM

      Hello everyone, We’re thrilled to announce an improvement for our Zoho CRM Enterprise users: the ability to create custom AI solutions using Catalyst’s QuickML directly from Zoho CRM. As you may already know, Zia, Zoho CRM’s AI-powered assistant, offers

    • Unveiling Cadences: Redefining CRM interactions with automated sequential follow-ups

      Last modified on 01/04/2024: Cadences is now available for all Zoho CRM users in all data centres (DCs). Note that it was previously an early access feature, available only upon request, and was also known as Cadences Studio. As of April 1, 2024, it's

    • Pay Contractor Timesheets

      I have contractors that fill out a timesheet. Each hour must be assigned to a current client. I need the easiest way to get the contracts paid. They are paid on an hourly bases. How can this be done?

    • Set up slack alert based on a field changing from one option to any other

      Hi, I'm trying to set-up a workflow to send a slack alert if a field changes from one option to any other. I've set-up a workflow to trigger on Edit and when a specific field gets modified but the only option I have 'is modified to' when really it should

    • Better UI more user friendly

      Hello everyone, I think all finance apps, especially Zoho Books, would benefit from the following suggestions/ notes: 1. Grouping Fields in Zoho Books: Unlike Zoho CRM, Zoho Books does not seem to have an option to create sections or group fields. This

    • Chronicles of 2024: The Year in Retrospect

      As we close out 2024, let’s take a moment to highlight the new features and updates that have enhanced Zoho Invoice in 2024. Among the exciting enhancements, we have launched a new AI-powered chatbot designed to assist you in understanding the app's features

    • Power of Automation :: Automatically archive your inactive Projects

      Hello Everyone, A custom function is a software code that can be used to automate a process and this allows you to automate a notification, call a webhook, or perform logic immediately after a workflow rule is triggered. This feature helps to automate

    • 554 5.1.8 Email Outgoing Blocked

      HELP!!!!! My e-mail marymariya@zoho.com is blocked. Error: 554 5.1.8 Email Outgoing Blocked The third day I am writing to the forum, but zohosupport is not responding. Why? What is the problem? I ask to help solve the problem, because I can not communicate with my customer base.

    • Zoho Inventory: Rewinding 2024

    • Custom Modules Now available for Standard and Professional Editions with Expanded Limits across all editions

      #CRM25Q1 Hello Everyone, We are here with an exciting update to Custom Modules in Zoho CRM. Custom modules will now be available to Standard and Professional Edition users, with expanded support across all editions. The standard modules offered in Zoho

    • Assistance with Custom Attendance Report in Zoho People

      Hi, I created a custom report in Zoho People 5.0 to track employee attendance according to our specific needs, as the existing reports do not include all the required details. However, I’ve noticed that the report doesn’t update continuously or on a daily

    • Zoho analyticsでのタブを跨いだ集計

      Zoho analyticsまたはCRMレポートなどを用いて、 見込み客タブと商談タブで共通するユニークキー(リード管理番号)を軸に、「共通選択リスト」で設定した項目別の集計を行うことは可能でしょうか？ ・要望 ①リード管理番号をキーに、見込み客テーブルと商談テーブルを結合したRAWデータを作成したい ②具体的には下記表のように「共通選択リスト」項目(サービス)別のマーケ数値を一表にしたい 　※リード＝見込み客タブ　商談・成約＝商談タブ 　　　　　リード数　商談数　成約数 サービスA　　　10　　　5　　　2

    • Key Highlights of 2024: Recalling a Year of Progress and Advancements!

      As we step into 2025, we’re excited to share the progress and developments we’ve made to simplify and streamline your travel and expense management in the past year. Let’s take a look back at some of the key updates and enhancements that have helped us

    • How to refresh the page by widget in related list?

      Hello, ZOHO.CRM.UI.Popup.closeReload method does the thing I need. But in my case, I'm not using popup. I have a widget in related list and I want to refresh the page when I'm done with it. I searched for it but I wasn't able to find it. Is there an any

    • your phone line in the uk doesnt work i need help now

      i need to speak with customer service urgently

    • Top Menu Disappeared from Blog Page

      Hi, Our top menu disappeared at Blog Posts page. However, it's still visible any other page on the website. I attached two screenshots, so it can be understood clearly. How can we bring back top menu? Thanks, K.

    • Missing phone numbers

      yesterday I have noticed that most contacts' phone numbers are missing. At first I thought it is a synchronisation problem with my Android phone but as I have found later, numbers are missing on Zoho. I have tried to reimport contacts from a backup but

    • Customise 404 page in Zoho Sites 2.0

      Is it possible to customise the 404 page in Zoho Sites 2? You use to create a new 404 page and that became the default 404 page, but this does not seem to work anymore? Any pointers/suggestions/support appreciated :)

    • [Important announcement] Zoho Writer will mandate DKIM configuration for automation users

      Hi all, Effective Dec. 31, 2024, configuring DKIM for From addresses will be mandatory to send emails via Zoho Writer. DKIM configuration allows recipient email servers to identify your emails as valid and not spam. Emails sent from domains without DKIM

    • Create workflow rules based on notes

      Last modified on 17/04/2023: Creating Workflow rules based on notes is now available for all Zoho CRM users in all DCs. Note that it was an early access feature available only upon request. As of April 13, 2023, it is rolled out for al Zoho CRM accounts.

    • Workflow sync between zoho books and zoho inventory

      Hello, While the custom fields, validation rules and even custom buttons are sync'd between zoho books and zoho inventory, the workflow rules do not. Not sure if this is an intentional purpose of zoho team for some good reason or if it's in the development

    • Item sales account via api

      Hey everyone, I’m making an invoice using the create invoice endpoint on the api. Is it possible to set a sales account in the line_items attributes?

    • Zoho Please change your ways

      I started using Your new Zoho bookings in earnest 3 days ago. What a mistake.  Once again, everything is backwards and upside down.  I had to spend 5 hours testing how the thing works in order for me to understand how to acutally use it.  When i started using google calendar years ago.  it took seconds to figure out how it works. Why is that. bc they put everything in places where it makes sense.  Today, I needed to add an appointment as well as a time off.  Stupid me i added the time off first,

    • Make a ticket visible in the Community

      Hi there, It is possible to have a conversation with a customer via a ticket and eventually the proposed solution isn't possible yet. Therefore you want to add it as an idea in the Community, available and open to everyone that is in the community, so

    • Zoho email folders gone

      Hi, All my email folders are gone, i cant found any email, except sent. Also before folder rulesas was changed and i didnt fixed them, could you please check it?

    • Pause/Resume Subscrtiption API

      I don't see the option to Pause/Resume a subscription using the API, is it in the pipeline?

    • Update Department on Ticket (with applied Blueprint)

      Hello, Is it possible to update the Department of a ticket which is dictated by a blueprint, e.g. I would like to change departments at different states in the Blueprint. I do not see this is an option in workflow rules or blueprint transition actions,

    • ERROR_CODE :554, ERROR_CODE :rejected due to spam

      Please verify bounce message: This message was created automatically by mail delivery software. A message that you sent could not be delivered to one or more of its recipients. This is a permanent error. xxx@thalesesec.com Error, ERROR_CODE :554, ERROR_CODE

    • Can't verify domain with AWS Route53

      I have a domain successfully transferred to AWS Route53 from NameCheap. When I try to CNAME or TXT Records as suggested, they are added in AWS console however zohomail does not verify them. For the TXT record zohomail says the value is wrong, whereas

    • Next Page