Skip to the main content.

SERVICES

Marketing Strategy
- Annual Marketing Planning
- Product Launches
- Marketing Audits

Brand Marketing
- Brand Positioning and Messaging
- Targeted Messaging
- Rebrand and Acquisition Marketing

Content Marketing
- Content Planning
- Content Development
- Content Programs

 

Marketing Automation
- HubSpot Onboarding + Training
- Integrate HubSpot With Your CRM
- HubSpot Audits + Optimization

Sales Enablement
- Sales Enablement Strategy
- ABM Strategy
- Thought Leadership Content

Website Services
- Website Strategy
- Technical Web Content
- Corporate Web Pages

4 min read

A Complete Guide to GDPR Compliance for Engineering Companies

Since its introduction in 2018, GDPR has had a significant impact on how companies collect and use personal data of European Union (EU) citizens. It is crucial for all companies, regardless of location, to comply with GDPR if they process or hold personal data of any EU citizens. 

 

A Complete Guide to GDPR Compliance for Engineering Companies

 

What is GDPR?

 

GDPR, or the General Data Protection Regulation, is an EU regulation governing privacy laws for all EU citizens. It replaces the 1995 EU Data Protection Directive.

GDPR is designed to strengthen and align data privacy laws across Europe, protecting and empowering citizens to take control of their data privacy. It also has a big impact on how all companies collect, store and use personal data of EU citizens.

 

Who does GDPR impact?

 

GDPR impacts all companies, in all countries, that process or hold personal data of any EU citizens.

You do not need to be an EU-based company, have an office in the EU or even do business in the EU; if you have contacts in your CRM from the European Union, this regulation impacts you.

 

So GDPR impacts me: what do I do?

 

First, do you do business in the EU or have a reason to contact EU residents? If the answer is no, remove these contacts and develop a strategy moving forward to ensure you’re not collecting information from EU residents.

If you do have business in the EU or a legitimate reason to contact EU residents, keep reading to learn how to develop a compliance strategy by May 25.

 

What is needed to be GDPR compliant?

 

GDPR has 99 articles, but the points below will most significantly affect marketers. Read the full text of GDPR here.

Please note- this is not legal advice for your company to use to comply with GDPR but rather background information to help you better understand the regulations. If you have questions about how GDPR impacts your organization and how to ensure compliance, please consult an attorney

  1. Clear consent and opt-in from EU contacts

    Implied consent is not enough- contacts must have clearly opted-in to receive emails from you. Opt-ins need to occur for each communication type you’re sending as well. If a contact is opted in to blog posts only, you can’t send sales emails or newsletters.

    This includes 1:1 sales emails! Unless the contact has clearly opted-in or has reached out to you first requesting information, you cannot send a sales email.

    Contacts must also give clear consent for you to process their data- so, be sure to include a consent checkbox or statement on any forms. If you do use a checkbox, be aware that contacts will not be able to submit forms without agreeing to data processing.

  2. Only collect the information needed to accomplish the task initiated by and consented to by the contact.

    If you don’t expressly need to know the contact’s industry to send him/her weekly blog posts, you can’t ask. However, you can ask industry if you send out different blog notification emails based on the contact’s industry- you just have to explain this on the form when you ask for the information.

  3. Citizens have a right to access the information you have on them.

    If an EU citizen requests access to the data you have on him/her, you must give them access to all data and information on how it’s being used within 30 days (some exceptions- see the full GDPR text).
     
  4. Right to be forgotten

    At any time, the EU citizen can request to have any or all of his/her information permanently deleted.

  5. Data breaches must be reported within 72 hours of becoming aware of the breach.

 

How do I Ensure My Company is GDPR Compliant?

 

There are several steps that can be taken to ensure any ongoing data collection and correspondence is compliant with GDPR.

  1. Send a Re-Engagement Email Campaign to EU Contacts

    When GDPR took effect in 2018, we sent a targeted email to all EU contacts to ask them to opt-in to the types of email they are interested in receiving. Any contacts that didn’t opt-in were deleted from our HubSpot CRM. We also deleted any contacts who fully opted-out of email communications.

  2. Update Forms

    As HubSpot Marketing Hub Professional users, we have the option to make forms “smart” based on visitor information. We built GDPR-compliant forms for all our resources and enabled smart forms on all landing pages to show these compliant forms to EU residents.

    If we didn’t have the smart form option, we would've needed to update all forms across our site to be compliant, with clear email opt-in options and only necessary form fields included.

  3. Update Cookie Policy

    Visitors to your website must consent to being tracked. As part of GDPR readiness, we updated our cookie policy to include express opt-in to cookies and a link to our updated privacy policy.

    Screen Shot 2018-05-21 at 12.11.51 PM

  4. Ongoing Email

    To be sure any bulk email sends are reaching the correct, opted-in people, we built contact lists for each email type (blog, newsletter, marketing info, etc.). Email campaigns only go to these opted-in segments, rather than to a larger group or whole database.

    If you're using marketing automation software, such as HubSpot, you're already protected from sending emails to contacts who have opted out of all or specific types of emails. With a little more caution, you can switch your strategy to only send emails to contacts expressly opted-in as well.
     
  5. Educate Your Team

    Since GDPR affects all types of email communication, we held an internal meeting to cover the regulation and its impact on our ability to communicate with contacts. Everyone from sales to PR to marketing is now aligned with regards to what is and is not allowed under GDPR.

  6. Implement an Ongoing Compliance Plan

    Our ongoing compliance plan ensures we continue to use compliant forms; address information and deletion requests as they come in; send emails by type to only the opted-in contacts; and continue to improve internal procedures.

What are the penalties for non-compliance?

 

Organizations found to be in breach of GDPR can be fined up to 20 million Euros (about $24.5 million) or 4 percent of annual global revenue- whichever is higher. Fines are tiered and affect both data controllers (the company collecting the data) and data processors (the company processing the data).

 


 

Are you a HubSpot user, wondering how you can use the tool to be compliant? Learn more about HubSpot’s GDPR product updates.

 


 

TREW is a marketing agency dedicated to reaching engineering and technical audiences through a range of marketing initiatives. Contact us today to learn more about the services we offer. 

 

SUBSCRIBE TO OUR BLOG FOR THE LATEST UPDATES

 

Erin Moore

Erin has worked with more than 40 technical companies across website strategy, content development, sales enablement, and marketing tool stack development. She’s a strategy-first marketer with a passion for persona development and a deep understanding of how marketing metrics tie into the bottom line. Erin holds a B.S. in public relations with a minor in anthropology from the University of Florida. She lives in Austin, TX, with her husband John and their dog and cat.



About TREW Marketing

TREW Marketing is a strategy-first content marketing agency serving B2B companies that target highly technical buyers. With deep experience in the design, embedded, measurement and automation, and software industries, TREW Marketing provides branding, marketing strategy, content development, and digital marketing services to help customers efficiently and effectively achieve business goals.