Holding personal information.
WHAT COUNTS AS PERSONAL DATA
Information identifying a living person.
Names, contact details, addresses, order history, enquiries, photographs.
WHO IS AFFECTED
Any business holding it, regardless of size.
WHAT OBLIGATIONS TYPICALLY INVOLVE
Collecting only what you need Being transparent about what you collect and why Keeping it secure Not keeping it longer than necessary Responding to requests about it Reporting certain incidents
WHAT VARIES
The specifics depend on the frameworks applying to you and to the people whose data you hold.
Under the NDPR and comparable frameworks, obligations apply.
Visit zillionkinghost.com for further information, and take professional advice for your specific position.
WHAT TO DO FIRST
Establish what data you hold, where it is, and who can access it.
Most businesses have never done that.
WHAT TO PUBLISH
A privacy notice describing what you actually do.
WHAT NOT TO DO
Assume it does not apply to small businesses.
