Getting compliant in half a day

Compliance scares people because they imagine it as a major undertaking. For an SME in ordinary use, it's half a day, once, then a yearly review.

Step 1: the usage register

A table, five columns: the use, the tool, who uses it, what data goes through it, and whether it decides anything about a person.

This table is the most useful document of all. It almost always reveals two or three uses that management was unaware of, and that's the real risk: not what you've decided, but what has crept in on its own.

Step 2: sorting

For each row, the question from lesson 2. The vast majority will fall into minimal risk. The rare rows touching on recruitment, credit, or evaluation of individuals are the ones to take seriously.

Step 3: the one-page note

The one from the previous lesson. Dated, circulated, with an acknowledgement of receipt, even informal.

Step 4: contracts

Check that the tools you use seriously are on a professional version, with a written commitment not to use your data for training. It's often the same price as an individual version and it changes everything legally.

Step 5: the review date

Set an annual reminder to re-read the register. Uses change faster than the texts.

On the timeline

The regulation's application is staggered over time, and implementing texts continue to appear. Don't rely on a date read in a course, this one included: check the deadline that applies to you against an official source when you're asking the question. The structure of the text, for its part, doesn't change.