In the world of brokerage where navigating regulation is an everyday occurrence, one that must not be ignored is that of the General Data Protection Regulation. This is particularly true for those who may be open to selling their firm on retirement, as a vender will no doubt carry out their due diligence; because who wants to be standing knee deep in files when they could be perfecting their next round on the golf course.
Another opportunity of “fresh starts” comes when a broker transfers from sole trader to limited company or where a broker may take the opportunity to go from “paper, paper everywhere” to that of a more sustainable and mostly headache free, paperless office.
Understanding the importance of compliance while recognising the challenges brokers face, we came up with five practical, time-saving tips designed to streamline GDPR compliance processes. From managing retention timelines to ensuring the safe transfer of personal data.
- Efficiently Managing Retention Timelines
One of the most effective ways of avoiding a breach of data, is not to hold on to the data in the first place. However while the regulation mandates that personal data should not be held on to longer than is necessary, there are other obligations on brokers to incorporate timelines of retention.
A Retention Policy and Schedule should hold details of the types of data brokers collect and the purpose of each data type. How long each type should be retained for will depend on legal requirements and business needs. For instance, while GDPR does not specify retention periods, the Consumer Protection Code and the Financial Services & Pensions Ombudsman recommends 6+ years, 3 years after last transaction for many policies.
There are other data types to factor in, such as personnel files, financial records and emails and these timelines will vary, so it is important to become familiar with them and have that easy reference point in place.
Automate where possible and leveraging your CRM to managing data retention can significantly reduce the manual workload. Investigating if your client platform can automate the classification and deletion of data, having everything in the one place and collating by date format will help in managing the timelines.
Employee training for anyone involved in processing personal data within your firm ensures that the Retention policy and timeline requirements are recognised. Selecting a “housekeeping” day on a quieter time of the year is a practical way of getting everyone involved in actively implementing those timelines.
- Ensuring the safe transfer of Personal Data
Brokers often find themselves needing to transfer personal data to other entities who process the data on their behalf such as a CRM. Or circumstances may occur where a referral comes in from a non-Central Bank regulated entity such as an accountancy practice. The GDPR set stringent guidelines for the transfer of personal data, aiming to ensure that the same level of data protection is maintained regardless of where the data is sent. This is particularly relevant when data is transferred to countries not governed by GDPR like laws.
Not understanding the importance of Data Transfer compliance especially to non-EU countries carries risks. It is crucial that brokers understand these risks and take steps to mitigate them, ensuring that client data remains protected. It is worth highlighting that data may be transferred outside the EEA by simply using a server which is not based within Europe, and so may not have the same protections as it would if it was on a server in Dublin.
If for some reason a broker must transfer personal data outside of the EEA, verify first if the country is recognised by the EU Commission as a safe country, if not then consider implementing safeguards such as standard contractual clauses to ensure data protection measures are equivalent to those required by GDPR.
Data Transfer Agreements are required when any third parties are processing personal data on your behalf. Entities such as CRM platforms are data processors and a contract is required which outlines the responsibilities and obligations around the protection of data.
Transparency with your client about how their data is processed is important and consent must be obtained when sharing personal data with another entity. The most common form of this type of data transfer occurs when a broker is operating as part of a wider group such as an accountancy practice, for example, and clients are referred for other services. It is recommended in this instance that consent to transfer personal data from one entity to another be retained on file.
- Implementing Efficient Data Security Measures
In this digital age, safeguarding personal data is paramount and recent Central Bank Roadshows and their outlook reports reiterates the scale of the impact that lack of cyber security has on the financial world.
For brokers implementing efficient data security measures not only complies with the GDPR but also serves as a critical defence against data breaches and cyber threats. Simple adjustments on how to do business and manage data will go far in protecting against a data breach and the reputational damage that goes with it.
Updating devices is a simple but effective way to secure your business from hackers. Reviewing software on devices and the business website on regular basis will ensure that any updates are applied. When a manufacturer releases an update it may mean there are vulnerabilities in place which need to be patched. The longer an update is left, the more at risk a system or device is to hackers who may be aware of the vulnerability.
Encrypting Sensitive Information on personal data both at rest and in transit adds another layer of security that makes data unreadable to unauthorised parties, protecting it in the case of a breach.
Sharing personal data securely can be easily done. Simple measure such as encrypting a word document containing sensitive data by making it a password protected PDF will go along way. Thus making it safe to send via email, just be sure to send the password separately. Advising clients sending ID by email to do so in a secure manner demonstrates that you value their security and will ultimately build more trust.
Implementing Access Controls to ensure that personal data is accessible only to those who need it for processing will also reduce the risk of accidental or unlawful processing. Use role based access controls to limit access, this might mean restricting access within the system network to ensure that your financial support/team doesn’t have access to client files or having a separate password protected folder to hold sensitive information.
- Leveraging Automation to Streamline GDPR Compliance
Technology is another opportunity to come away from the ever growing cabinets of client files. Automation can significantly reduce the manual burden associated with compliance tasks such as data retention, access controls and security and chances are it is already at your fingertips.
Maximising CRM efficiency by ensuring the your CRM serves as the single source of truth for all client interactions and information. Making it your one stop shop and getting used to consolidating data from various sources will help minimise discrepancies and duplications. This unified approach simplifies compliance checks and reporting.
Integrating with existing systems by ensuring that any automation tools adopted can integrate easily with existing systems. This includes CRM platforms, email marketing software and data storage solutions.
Regular Training; Compliance is not solely a technology issue, it is also about people. Availing of training refreshes by CRM providers will ensure that you know how to use your CRM in line with the latest regulatory requirements. A knowledgeable team is your first line of defence against compliance missteps.
- Engage with good support
In an industry that must keep up to speed with all new regulation and changes in legislation while battling with the evolvement of technology and the ever increasing cyber security threats, having support when you need it is paramount to the success of a small brokerage.
Engaging with support in the areas of Compliance and IT is a simple but effective way of ensuring that important issues are not left on the long finger to ensure compliance with current regulations but also ensures brokers are well prepared for future changes.
Having IT support in place equally will provide that peace of mind that your systems are robust against any security threats and vulnerabilities. Equally they will guide you on the security enhancements such as multi factor authentication that are so vital in today’s security conscious world.
A compliance expert can help demystify GDPR requirements and other regulatory issues you may have, helping you implement robust data protection strategies that safeguard client information and ensure compliance. This peace of mind will allow you to focus on what you do best; serving your clients.
