Continuing our Enclude Essentials series on Best Practice in Data here are some straightforward, practical steps that any Non-profit can take today, to help manage their data for GDPR Compliance. These steps are relevant whether you’re using a CRM, Excel spreadsheet or email inbox to manage your data (obviously we wouldn’t recommend the last two, learn more about what a CRM is and why you might need one here).
Review who can access your data
Regularly check who has access to your data. How you do this, and what you need to consider, can look different depending on how and where you’re storing your data, but it is essential in protecting the integrity and confidentiality of your data.
- If you’re using a CRM, check your licenced users. Are they all current employees? Do they still need access? Do they all have secure passwords? When was the last time they changed their passwords?
- If you’re using a tool such as Google Workspace or Microsoft 365, again check your users, are they current employees, are their passwords secure, and do they only have access to the spaces they need access to.
- If you’re storing special data in Google Sheets or Excel, check who has access to these files. Make sure access is only given to named individuals who need access. Avoid shared or generic accounts where you don’t have control over who could be logging in and viewing data – e.g. info@yourorg.com or yourorg@gmail.com.
Check for duplicates in your data
If you have multiple people accessing your data, or frequently bring multiple data sets together, duplicates can easily appear. As well as impacting your own reporting, this can make it harder to manage personal data and maintain its accuracy. This in turn can impact the service received by your clients or service users, and makes it much it harder for you to remain GDPR compliant when it comes to data access or deletion requests.
Ensure you have a process in place to check for, and handle duplicates. Many tools include functionality that allows you to check for duplicates, and merge records.
Don’t forget not all duplicates are identical! Sometimes a typo, missing accent or punctuation mark can create duplicate records. E.g. Enclude vs Include CLG vs Enclude CLG. vs Enclude Company Limited by Guarantee. Don’t forget to check for these as well.
Make sure you’re not keeping data longer than you should
Your privacy policy will include a statement on how long you retain data. To ensure you’re abiding by this, ask yourself –
- Are you capturing and managing data collection and expiration dates?
- Have you decided whether your policy will be to delete or anonymise the data?
- How do you identify those contacts due for deletion / anonymisation?
- How do you carry out the deletion / anonymisation? Is there a clear process in place?
- Are you also addressing related Files, Notes and Attachments?
Data deletion may be more straightforward. However, anonymising data means you have more data available for historical reporting which can be essential when demonstrating your organisation’s impact through data.
There’s a lot to consider, but making sure that you have robust processes that check these three areas will make life easier!
More Information
If you need help:
- Our Membership Services team is available to support our Salesforce CRM clients with all the above. If you’re interested in finding out more get in touch.
- If you’re not currently using a system such as Salesforce, and aren’t sure what it is or whether you need it, learn more here.
- If you know you want a CRM but aren’t sure where to start, then our Discovery Service may be helpful.
For more information on your obligations under GDPR –
