If not, then you might want to read the below……….
Last week the General Data Protection Regulation (GDPR) came into force, and if you’re not compliant, then you could well be facing substantial fines (1% of revenue).
For smaller businesses, it's tempting to pretend it isn’t happening, or to put off what now needs to be done urgently. As Mike Cherry, national chairman of the Federation of Small Businesses (FSC) described it: "GDPR is the biggest shake-up in data protection to date and many small businesses are concerned that the changes are too much to handle."
It is going to be costly - The FSC estimates it could add another £508 to a small businesses’ data protection bill. But ignoring it is not an option. If the deadline has passed you by and you’re still in the throes of adapting your processes, then I’m sure you join a healthy number of other small businesses but that’s not a reason to cut corners. If you are running digital advertising campaigns, using social media or email marketing, then there will be things you’re required to do to be compliant. Over the past few weeks, we’ve been looking at what steps you’ve needed to take to be compliant in each area. This week, we tackle email marketing and in particular the level of consent you now need in order to email the people in your database.
In this blog post, much of our focus will be on the consent needed for emailing your consumer database ie. current patients and potential patients but before we do, we will quickly cover off what the GDPR has changed with regard to Business to Business (B2B) communications.
Email marketing to other businesses
At one time it did look as if the rules governing B2B marketing were going to be far more draconian than they now appear to be. In fact, where they ended up meant a lot less than anticipated needed to be changed to previous provisions for data protection.
Business to Consumer (B2C) email marketing
So let’s take the same example and see what’s changed with regard to emailing your patients and potential patients in a business to consumer setting. You’re using some kind sign up device from your social media marketing, or a potential new patient has completed a form on your website. What can you do with that information?
In the first scenario where you are using some kind of ‘lead magnet’ ie. give me your email address in return for this vital piece of information or promotion - then you can email them the ‘thing’ but you are not permitted to continue emailing them and you cannot continue to store their details on your database, unless you have gained their specific consent to do so.
In the second scenario - the individual has signed up on your website perhaps for a call back about an appointment. Again, GDPR is a fairly blunt instrument. Once you’ve called them back and potentially set them up with an appointment you can only keep their details on your database if you have told them why you are doing so and how their data will be used.
How to protect your B2C email marketing under GDPR?
Ok so it’s a little more taxing than before, but most email marketing providers (the good ones at least) have helpfully pre-designed GDPR compliant templated forms for you to easily incorporate into your campaigns in order to obtain and record consent. These forms typically include:
What is perhaps rather more demanding is what needs to happy to ensure that your existing data is GDPR compliant.
Collecting consent from existing customers
If you haven’t collected consent from contacts on your marketing database already then to the true letter of the law you are now not permitted to email them to refresh consent. As ICO Head of Enforcement, Steve Eckersley put it, “Sending emails to determine whether people want to receive marketing without the right consent, is still marketing and it is against the law…”
The reality is you might still decide to repermission and for some you might be quite within your lawful right to do so. If the original consent given was in line with GDPR requirements then there is actually no need to seek fresh consent. you would have been required to re-permisson if for example you’d always used a ‘pre-checked’ box for ‘consent by default’ - which is no longer lawful under GDPR. If active consent has not been received from your contacts then they should be removed from your mailing lists.
Were you still to email those on your marketing database to refresh their consent to hear from you and we are certainly not encouraging you to break the law, but you would now need to be as specific and granular as possible as to what you are asking them to subscribe to - newsletters, promotions/offers, appointment alerts etc and via which channels - sms, email, direct mail, phone etc. The more granular you are the less likely your existing customers will be to accidentally opt of communications they may still wish to receive.
GDPR is here, we know, but if you are still working on your processes, then the ICO has a wealth of practical advice on how to comply with the new rules - checklists, guides and a telephone helpline. If you’re unsure about anything you’ve implemented or are implementing that’s as good as any a place to start https://ico.org.uk/for-organisations/business/
And if you’ve decided it's now become too complicated for you to do your digital marketing yourself and be compliant, then we would love to help. Check out our service pages or give us a call. Book a strategy call today.
Treat your practice to a Facebook Messenger Chatbot this Christmas and watch sales soar in 2019
What we discovered by calling 22 dental practices as a mystery shopper
Listen Up Dentists! Don’t be duped. Adwords Express is dangerous
[Dentists] – Get ready now for the ‘New Year, New Me’ phenomena with our ‘Campaign in a Box’