Your Data Protection Program and bxp - Revision history

Robert Carson at 13:14, 12 February 2019

2019-02-12T13:14:33Z

Philip Lacey: /* Next Steps */

2016-02-01T22:24:31Z

‎Next Steps

Philip Lacey at 22:22, 1 February 2016

2016-02-01T22:22:53Z

Philip Lacey: Created page with "= Overview = Data Protection is an essential part of any business solution that retains potential and existing customer data. It is important for you to know what you're e..."

2016-02-01T19:58:06Z

Created page with "= Overview = Data Protection is an essential part of any business solution that retains potential and existing customer data. It is important for you to know what you're e..."

New page

= Overview =

Data Protection is an essential part of any business solution that retains potential and existing customer data. It is important for you to know what you're entitled to keep and not to keep and for how long. It is also important to know how bxp can help you in adhering to your legal requirements.

This article provides an outline program to help you navigate what bxp can do for you.

= PII =

''Personally identifiable information (PII) is any data that could potentially identify a specific individual. Any information that can be used to distinguish one person from another and can be used for de-anonymizing anonymous data can be considered PII.
''
https://en.wikipedia.org/wiki/Personally_identifiable_information

Predominantly a US concept, the term equally applies globally and will be used throughout this article.

= Laws =

It is important for you to understand the data protection laws that apply to your country and your data. We provide an article to help you navigate this complicated area. [[Data_Protection_and_Data_Retention]]

If you feel more comfortable chatting to an experienced practitioner of the area, then get in touch with us at sales@bxpsoftware.com and we'll help to find you someone appropriate to help.

= The program =

== PII fields ==

So at this stage, you recognise that you have some requirements upon you that you need to comply with. You understand the types and period of data that must be kept and that which must be removed. Generally information will now be clear to identify as PII and not-PII information.

Take for example, the following list of fields:

* Firstname
* Surname
* Street
* Area
* County
* Country
* Phone
* Email
* Industry worked in
* Number of children
* Children's names

As you have probably worked out there is PII and non-PII information in that list.

* PII - Firstname
* PII - Surname
* PII - Street
* Non-PII - Area
* Non-PII - County
* Non-PII - Country
* PII - Phone
* PII - Email
* Non-PII - Industry worked in
* Non-PII - Number of children
* PII - Children's names

== Time ==

Once you have identified the PII fields in your data, the next important piece of information is time. For how long can you keep data? For how long must you keep data? Depending on the industry you're in, it will need to be ascertained for how long you can keep the data. Let's look at a few examples.

If the person is still a customer, (an active customer) then you need to keep PII so as to be able to work with the customer. Please remember that the information stored should not be excessive but rather enough to enable trade. As long as the customer is trading with you, then you can keep the data.

If the person was enquiring for a price (a prospect), then you are going to have a much shorter time window for retaining data. Essentially, the person has nothing to do with your company so you really shouldn't be storing data about them. 6 to 12 months is a rule of thumb to follow.

If you have traded with the person but they're no longer actively trading with you, e.g. a once off purchase (a passive customer), then you can only keep data up to a certain point. Essential, after your trade the person will revert to being a prospect in the same amount of time as a prospect.

The only over-riding length of time on a prospect is for legal reasons. (legal retention). If you trade with the customer and the law of the land requires you to keep data on customer available for a given period, e.g. in the financial industry, then you must not delete the PII information.

The only final exception to data retention is if the customer explicitly wants you to retain information about them. This consent is not implied and must be explicitly stated. A customer cannot opt out of your retention of their data, they must explicitly opt in. This law varies by country, but in most modern European countries the law requires explicit opt in from the customer. You must also in your communications give the customer easy ability to have their data removed without hesitation.

← Older revision		Revision as of 13:14, 12 February 2019
Line 128:		Line 128:
	That MetaData program can then be kicked off by manually running the program. Alternately you can contact bxp support and we can cause it to run on a scheduled basis for you.		That MetaData program can then be kicked off by manually running the program. Alternately you can contact bxp support and we can cause it to run on a scheduled basis for you.

		+
		+	The new General Data Protection Regulation (GDPR) came into effect on the 25 May 2018, which has reshaped the way in which data is handled across every sector. https://eugdpr.org/
		+
		+
		+	bxp has addressed this by introducing a simplified approach to automatically removing PII so that your data is in line with these new regulations.
		+
		+
		+	We call this the "bxp Scheduled Data Protection Routine" [[Form_-_Data_Protection_-_Scheduled]]

← Older revision		Revision as of 22:24, 1 February 2016
Line 140:		Line 140:


−	Now that you have a plan it becomes easy to set up the processes within bxp.	+	Now that you have a plan it becomes easy to set up the processes within bxp. If you are comfortable setting this up yourself that's great, but always remember that there is a team here in bxp support to help you get your processes sorted out. So feel free to get in touch or email us on support@bxpsoftware.com and we can help you deliver your data compliance.
		+

@@ Line 35: / Line 35: @@
 == PII fields ==
 So at this stage, you recognise that you have some requirements upon you that you need to comply with.  You understand the types and period of data that must be kept and that which must be removed.  Generally information will now be clear to identify as PII and not-PII information.
@@ Line 89: / Line 90: @@
 The only final exception to data retention is if the customer explicitly wants you to retain information about them.  This consent is not implied and must be explicitly stated.  A customer cannot opt out of your retention of their data, they must explicitly opt in.  This law varies by country, but in most modern European countries the law requires explicit opt in from the customer.  You must also in your communications give the customer easy ability to have their data removed without hesitation.