Retail isn’t ready
A Compuware study of late 2016 revealed that as many as 77% of retailers in major EU markets don’t yet know how they’ll respond to GDPR.
Only 47% said they were well briefed on the subject and the impact it will have on their collection and use of customer data.
The era of ‘indiscriminate collection’ is over
Permission requirements now mean that you must be much more discerning and strategic about how and when you gather customer data. It also means you must be much more careful about where data is stored.
PII (‘Personally Identifiable Information’) on your customers as defined by GDPR can now include almost anything that can be directly linked to a name1.
This poses a particular challenge in a sector where around 84% of companies do not currently obtain consent before using customer data2, and where 66% feel they would not be able to comply with provisions like the right to be forgotten3.
As we’ve stated already, some major vendors like Microsoft are already making it easier to ensure compliance on the second point. The responsibility, however, is still yours.
You need to be ready to tighten up the online side of your business
Your online arm collects more customer data than any other – including their most sensitive private and financial information.
This information is always regarded as high risk, so breaches here could signal the deathblow for your business.
Since many retailers (53%) have cited the difficulty of keeping up with digital change as a major challenge to GDPR compliance4, this will be a key area for development.
With that in mind, you’ll need a secure internet gateway solution to guard against the most common entry points for attack. You’ll also need a robust password management program with ample security training for all your people.
Your loyalty programmes need to change. A lot.
Most programmes are based on customer data collection and utilisation. And that means you’ll now need to be explicit on how you’re using that data, who has access, what protects it, and where it’s stored.
You’ll also need to accept that customers can choose to take that data back from you or demand that it be transferred elsewhere. That means the apps you use and develop must be fully compliant.
If they aren’t, you won’t be able to account for every copy of a customer’s data, and if you retain anything after receiving a deletion order, you’ll face a fine.
External sources
Thank you to all of the external sources below in helping to put this research together
