How GDPR In SMS Communication Strategy Affects Your Business

by Harish Thyagarajan | Dec 6, 2018

The European Union’s General Data Protection Regulation (GDPR ) has been one of the pivotal points in shaping how companies communicate with their customers. Since it came into effect in May, 2018, companies have had to significantly modify their SMS communication strategy in order to avoid serious financial implications such as penalties amounting to up to €20 million. While it may seem complicated, at its core, the GDPR is just an enhanced effort to protect the customers’ privacy & fundamental rights. Even for businesses, it simply is an opportunity to adopt standardized business practices for customer interaction and data management. GDPR compliance for organizations is not just about confidentiality, it’s more about accountability and accuracy – and more importantly, it’s just a good business practice. In this article, we take a look at GDPR in SMS communication strategy and how it affects businesses world over. In order to understand how GDPR affects your business, you need to first determine whether your business is a controller or a processor as defined by GDPR. A controller is an entity that collects and maintains personal data while a processor handles and used this data. So, if your business collects user information and sends SMS to businesses or individuals as part of its marketing or customer experience management, you would qualify as both a controller and a processor.

Does the GDPR affect your business if it’s located outside the EU?

Irrespective of your location, if you collect, store, or manage the data of individuals who live in the EU, the GDPR affects you. Even if you have no entity or business presence in the EU, the GDPR applies to your company if you process the personal data of people who live there. While you can create a separate plan to manage data from EU contacts, it makes sense to bring the entire SMS strategy plan into compliance simply because more stringent data regulations across geographies are inevitable in the near future. Here are a few things you need to keep in mind to make sure your SMS strategy is GDPR compliant –

Explicit and informed consent

GDPR defines “consent” as “freely given, specific, informed and unambiguous indication of the data subject’s wishes by which he or she, by a statement or by clear affirmative action, signifies agreement to the processing of personal data relating to him or her”. This means that you give your customers the power to decide how to engage with your company. Users must actively and voluntary consent to receive your messages. A pre-checked box doesn’t work because it doesn’t show active, voluntary consent. Additionally, you must explain how you plan to use customer information before they give consent. To this effect, you will need to create and share a data use policy at the stage of consent collection so you’re 100% transparent about data use.

SMS- specific Marketing opt-ins

If your user general registration includes an SMS marketing opt-in in addition to other marketing channels such as email, in-app notifications, typically referred to as a ‘bundled’ opt-in – it is now essential to seek consent individually and separately for each channel. What this means is that your registration process should use a separate (unchecked) box for each channel and not a generic all in one opt-in as often used in the past. If this is an opt-in option for SMS, make sure that it is either blank or set to ‘no’ by default. If you do not have a checkbox for SMS Marketing, now might be a good time to add one.

Withdrawing permission and opt-out

The GDPR mandates that the opt-out process enables them to withdraw consent at any stage of the process. That’s not all. They must always be made aware that they have the right to remove consent. This means that every SMS marketing message includes an opt-out option in every message – in plain and simple language that is easy to understand. It is also essential to ensure that the option to opt-out of SMS Marketing communications is explicitly stated elsewhere such as on your website. Finally, your terms and conditions should also explain how to specifically opt-out of SMS communications.

Data handling and management

One of the overarching principles of the GDPR is that individuals have control of how their data is collected, processed, and used in decision making. Irrespective of how you collect the personal data for your SMS Marketing list – be it through your website, handwritten sign-up forms or direct SMS messaging, the GDPR places strict rules on how you manage this data. Ensure that you have measures in place to store and safeguard user data. An audit trail and documentation of permissions and consent at each stage can be highly beneficial in this case. Measures need to be incorporated to ensure there is a defined policy for how long personal data is retained and to make sure that it is not retained unnecessarily. In the event of a data breach that is likely to cause a higher risk to the freedom and rights of individuals, then you should ensure that customers are notified as well.

Conclusion

So far, we have seen the 4 major measures you need to incorporate into your SMS marketing strategy to ensure GDPR compliance. An SMS marketing platform can help you manage GDPR compliance via tools that help you create stronger consent forms, store data, access to time-stamped opt-in forms, and even to erase a customer’s data if requested. With SMS marketing being the medium of choice for most customers, compliance with all local regulations is imperative in order to build trust with consumers. The GDPR ensures that your customers will only receive the type of communications they really wish to receive, which will bring higher levels of brand trust and engagement. By adhering to the principles of explicit consent, segmented opt-in, and secure data handling, you can establish your business as one that prioritizes customers’ choice and places them at the center of everything the organization does.