Good privacy is good for startups

Privacy is very important for startups, although it may not seem that way in the beginning, it’s a requirement as you grow your business.

When you have an exciting new idea that you are trying to bring to market, it is natural to focus your limited energies on quick wins, and leave the worrying about the long term to a time when you are more confident there is going to be one.

Those quick wins usually revolve around getting your offering to market, getting your first customers and getting their feedback for your next iteration. In the fast paced world of tech start-ups these priorities are often even ahead of considerations like how the business will actually make money.

It is therefore easy to put issues like compliance and privacy into the ‘difficult things to do later pile’. After all, what’s the point of worrying about protecting customer data until you have enough of it, right? And the more data you have, the better placed you will be when you can figure out how best to make use of it, surely?

Unfortunately, this is the wrong way to look at things. And in a world where customer data is central to more and more business, getting privacy right is not just about boring compliance, it’s about the foundations on which your business will be built, including two of the most important – Trust and Value.

Gaining trust is key to any new business, you cannot grow your customer base without it. You want customers to trust you in what you do, like deliver your service promise. If you use customer data in ways they don’t like, or even lose control of it in a security breach – the resulting loss of trust can sink your business very quickly.

Many start-ups also look for outside investors to help them grow. An investor may like your idea but will be looking for a valuation that will give them the biggest possible stake. One of the key ways they do this is look for uncontrolled risks in the business. Risks attached to your data privacy practices and compliance, even if they are currently more theoretical than real, are an opportunity to lower the valuation, and leave you owning a smaller percentage of your business.

So how do you get privacy right first time and avoid this?

The two most important pieces of legislation you need to worry about from a privacy perspective in the UK are the Data Protection Act (DPA), and the Privacy and Electronic Communications Regulations (PECR). These laws are enforced by the Information Commissioners Office, and their website has a lot of very helpful guidance.

Here are some basics:

The DPA covers the rules on the handling of personal data – which is any information that is or can be linked to an individual.

Generally you should only collect data if you need it, use if for stated purposes only, and dispose or archive it when you don’t need it any more. You also need to tell your customers how you use their information in a privacy policy.

PECR largely governs rules on contacting people for marketing purposes by either telephone or email. Telephone calling in particular is something you should be careful about, as the ICO has issued lots of large fines in recent months. The bottom line here is that to be safe, you should have very clear consent to communicate with people like this.

PECR also covers the rules on the use of cookies on a website. Although risk of enforcement in this area is low, there is a lot of consumer mistrust about how data is collected in this way, so expect this to become of increasing importance.

Getting cookie compliance right also helps you to prepare for upcoming changes to legislation in this area, which are set to make privacy issues even more central. The EU General Data Protection Regulation (GDPR) is a major overhaul of privacy rules across Europe, which are due to take effect sometime in 2017/2018. This may seem a long way off now but the changes will require some preparation. Expect to hear a lot about the details of this early next year as the legislation is finalised, but one sure fire headline grabber will be the levels of fines available to regulators, which may go as high as 5% of turnover.

Two important ideas in the GDPR, are Privacy by Design (PbD), and Privacy Impact Assessments (PIAs). PbD is a set of principles for building privacy into systems and processes from the beginning, rather than bolting it on afterwards. The GDPR requires you to follow these principles when handling personal information. Privacy Impact Assessments are project tools designed to help you follow PbD principles. The GDPR is very big on the idea of organisational accountability, and it is likely that being able to demonstrate that you have gone through a PIA process in certain circumstances will become mandatory under that new laws.

There is some light in that the smallest businesses may be exempt from some requirements of the GDPR. However, if you plan to grow quickly, you could equally quickly find yourself bound to comply – so it makes a lot of sense to think about these issues right at the beginning, or they may become a drag on your ability to build your business as you would like.