• Home
  • Work with CfB
  • Contact
    • Bloglovin
    • Facebook
    • Instagram
    • Pinterest

Cutting for Business

  • New? Start Here!
  • Visit the Shop
    • Ebooks
    • Business Names
    • Craft Business Consultations
    • Order Forms
    • SVG Files
    • Etsy Shop
  • Must Have Products
  • Join the Insider’s Club
  • Etsy Shop
  • Free Cut Files
  • Free Etsy Listings


Affiliate links may be present in the following article. For my full disclosure policy, see this link.
Additionally, as an Amazon Associate I earn from qualifying purchases.

The GDPR for Craft Businesses

Filed Under: Miscellaneous

The GDPR. The internet has been buzzing about it for months now, and it’s been general panic in the last few weeks as more details have emerged. So, let’s look at it today from the perspective of an at home craft business owner.

What is the GDPR?

The GDPR stands for the General Data Protection Regulation, abbreviated GDPR. It’s a new set of laws that take effect May 25th, 2018. This new set of regulations is being enacted in the EU (European Union). However, it is a worldwide measure that all companies that have website visitors, customers, or mailing list subscribers in any country in the EU must abide by. To refresh your memory, the countries in the EU include: Austria, Belgium, Bulgaria, Croatia, Republic of Cyprus, Czech Republic, Denmark, Estonia, Finland, France, Germany, Hungary, Ireland, Italy, Latvia, Lithuania, Luxembourg, Malta, Netherlands, Poland, Portugal, Romania, Slovakia, Slovenia, Spain, Sweden, and the UK.

What is the purpose of the GDPR?

The GDPR sets standards for the way personal data is handled by businesses. It’s the first major update to EU privacy laws since the 1990’s. Take a minute and think about life in the 1990’s. Technology has advanced substantially since then, so it’s time that these laws be rewritten.

What is the gist of the GDPR?

Let’s break down some of the important aspects of the GDPR that relate to craft business owners.

  • Yep, it applies to you: If you have any website visitors, track website data, have comments or reviews on your website, offer freebies, run a subscription service, embed content from other websites, have mailing list subscribers, show ads, or collect data of any resident of any of the countries in the EU, the GDPR applies to you. This means that most small business owners across the world fall into this category.
  • Controllers versus Processors: The GDPR sets out two different requirements. The first is for Controllers. A Controller is the person who decides what to do with the data. In contrast, the Processor is a third party company that collects the data and gives it to the Controller. From a craft business perspective, you, as the owner, are the Controller. You might use a Processor like a mailing list provider to get you data.
  • Personal Data: You must keep personal data of others up-to-date and secured.
  • Personal Data Transparency and Consent: You must tell people how you will use the data and what you will do with it. You cannot do things outside of the scope of what you tell people. For example, if you collect personal data (like an email address) to send periodic marketing emails, you must clearly disclose this. You would not be able to then sell your email list to another company, because that is not what purpose you informed individuals of.
  • Proof of Consent: If asked, you must be able to prove you got consent before using the data. For example, I cannot add someone to my mailing list without getting recorded consent. Oh, and no one under the age of 16 can legally provide consent.
  • Don’t collect sensitive data: Sensitive data is considered race, political views, sexual views, criminal data, and so on. For the average craft business owner, there is no reason to collect any of this anyway.
  • Make sure people can understand you: You must use easy to understand, clear language when obtaining consent and being transparent. Hooray for this one! Talk to people in a way that they can understand. If you don’t know what this means, pretend that your 102 year old grandma is reading it. She should be able to quickly understand it. Honestly, most craft business owners do this anyway and don’t hide their policies in complicated legal language.
  • Be able to tell people what data you have collected about them: If someone asks you for the information that you have on hand about them, give it to them in a reasonable time frame. Also, if they want the information deleted, you’d have to delete it and prove it was deleted.
  • Provide clear links to your policies: For example, if you are collecting an email address of an EU resident for the purpose of emailing them a free cut file, also provide them with a link to your privacy policy written in clear language.
  • Ability to opt out: If you use data to shape what users see, they should have the ability to opt out. For the most part, I don’t see this happening as craft business owners.
  • Keep a record of the steps that you’ve taken to address the GDPR: For a craft business owner, this is as simple as a spreadsheet log. On 5/10/18 I updated my website’s privacy policy, on 5/11/18 I updated links in my mailing list, and so on.
  • Data sharing: If you share data with another business, you’ll both need to be clear on what you each do with the data and be sure that your policies are both up-to-date.
  • Use GDPR compliant Processors: If you use 3rd party data collection tools, be sure that you work with ones that are GDPR compliant. I don’t think this is something to worry much about if you are using a large corporation. The fines for GDPR non compliance are hefty, so it’s likely that you’ll see all the corporations comply.
  • Data breaches must be reported: If your small business is hacked, you must report it within 72 hours to GDPR authorities. You also must report the data breach to the people. This is as easy as an email to them.
  • A new board was formed: A board was created within the EU to make sure that companies are following GDPR rules. Each country in the EU has a representative.
  • Fees and Fines: There’s hefty fees and fines up to millions of dollars for not abiding by GDPR rules.

What steps should I take to become GDPR compliant?

Now, this is where the online information gets fuzzy. There is tons of information about what the GDPR rules are, but there is not a lot of information that gives actionable steps. However, you must be compliant by May 25, 2018 with the GDPR. From all the information that I’ve been able to collect, these are the steps I think you should take:

  1. Do more research: In order to get your head wrapped around the GDPR laws, I suggest you do more research on how it applies to your specific craft business situation.
  2. Document as you go: As you research, document what you’ve learned and from where. Document the steps you take along the way and the steps you will need to continue to take.
  3. Audit your business: Do an audit of your craft business and see the different ways that you are collecting personal data about EU members. Actually, I’m pretty sure that other countries are working on their own GDPR-like laws. Best to do an audit of all the ways that you collect, store, and use personal data.
  4. Write a Privacy Policy: Make sure your website has a clear, easy to understand Privacy Policy. Within the Privacy Policy you should lay out why you have it, what you do with it, who has accessed the data, how you store the data, how long you store the data, how they can see the data you’ve stored, how they can delete the data, and how they can contact you.
  5. Use GDPR compliant services: From your website theme to your mailing list, from your stat collector to your marketplace provider use companies and providers that are GDPR compliant.
  6. Double opt in for mailing lists: If you have a mailing list, make sure it is double opt in and that you have a link to your clear privacy policy located at sign up.

What should you not do related to the GDPR?

  1. First, don’t panic. Overall, these laws are a good thing.
  2. Next, don’t do nothing. These laws are serious. While it isn’t fun, it is a part of being a business owner.
  3. Don’t block all the EU countries from your website or mailing list. That’s pretty extreme and a way of hiding from the laws. Instead, get compliant. Like I mentioned above, I’m sure GDPR-like laws are being written for other countries.
  4. Don’t spend a bunch of money. I’m angry at some of the lawyers out there selling huge packages to small business owners – and some bloggers perpetrating these packages. Don’t go out there and spend a few thousand dollars on a compliance kit. Do your own research and work to get compliant before May 25th, 2018. If your business has particular situations that you can’t figure out, consult an attorney before spending thousands of dollars on a ‘compliance kit’.

Remember, I’m not a lawyer or attorney and this isn’t legal information. It’s always best to consult your legal team for help in implementing the GDPR.

Where can I read more about the GDPR?

You can read the full text of the GDPR for more information. I’ll warn you, it is heavily written in legal language. I’d recommend multiple cups of coffee before diving into it! The best translation into plain English I have found online is at this link. Also, this UK based government site has great self directed quizzes and infographics to help you in your research.

As more information becomes available, I’ll continue to add to this post.

Get the information out there – save this post to Pinterest.

The GDPR for Craft Businesses - A good read for Silhouette and Cricut crafters with websites, Shopify stores, and Etsy shops. By cuttingforbusiness.com.

Related Posts

  • 12 Things I Wish Someone Had Told Me About the Silhouette Alta12 Things I Wish Someone Had Told Me About the Silhouette Alta
  • Budgeting Business Expenses: 3 Different TypesBudgeting Business Expenses: 3 Different Types
  • Free ‘You & Me’ Wedding and Anniversary SVG Cut FileFree ‘You & Me’ Wedding and Anniversary SVG Cut File
  • Free Christmas SVG for Silhouette or CricutFree Christmas SVG for Silhouette or Cricut
  • Blog Recap – Jan, Feb, and March on Cutting for BusinessBlog Recap – Jan, Feb, and March on Cutting for Business
  • FAQ: Printers in CraftingFAQ: Printers in Crafting

Connect with Cutting for Business

  • Bloglovin
  • Facebook
  • Instagram
  • Pinterest

Get Cutting for Business in Your Inbox

Buy Books


Cutting for Business is a participant in the Amazon Services LLC Associates Program, an affiliate advertising program designed to provide a means for sites to earn advertising fees by advertising and linking to Amazon.com and affiliated sites. See the disclosures page for full disclosure information.


« 30+ Camping Sayings for Crafters
How to Make Money on Amazon Without Selling Anything »

Comments

  1. Christy says

    May 13, 2018 at 8:08 am

    Thank you for this. I put a simple privacy and use statement on my website a couple of months ago. It looks a little like I may need to add a couple of additional things.

    Reply
    • Christine says

      May 22, 2018 at 12:56 pm

      Happy to share!

      Reply

Comments on Cutting for Business are moderated before posting. This ensures that this blog does not get overrun by spam or inappropriate comments. Please allow up to 7 days before you'll see your comment. Thanks, Christine

Leave a Reply Cancel reply

Your email address will not be published. Required fields are marked *

Make Money

Love to craft and ready to make some money? You're in the right place! Whether you own a Silhouette Cameo, a Cricut Maker, a Silhouette Curio, a Cricut Joy, or even a Glowforge, get tips and tricks to make an income with your machine.



Ready to Buy Craft Business Names



Free Fonts

Copyright © 2021 · Cutting for Business
Disclosures · Privacy Policy
This site is not affiliated with Silhouette America or Cricut (Provo Craft & Novelty, Inc.)

This website uses cookies to improve your experience. We'll assume you're ok with this, but you can opt-out if you wish. Cookie settingsACCEPT
Privacy & Cookies Policy

Privacy Overview

This website uses cookies to improve your experience while you navigate through the website. Out of these cookies, the cookies that are categorized as necessary are stored on your browser as they are essential for the working of basic functionalities of the website. We also use third-party cookies that help us analyze and understand how you use this website. These cookies will be stored in your browser only with your consent. You also have the option to opt-out of these cookies. But opting out of some of these cookies may have an effect on your browsing experience.
Necessary
Always Enabled

Necessary cookies are absolutely essential for the website to function properly. This category only includes cookies that ensures basic functionalities and security features of the website. These cookies do not store any personal information.

Non-necessary

Any cookies that may not be particularly necessary for the website to function and is used specifically to collect user personal data via analytics, ads, other embedded contents are termed as non-necessary cookies. It is mandatory to procure user consent prior to running these cookies on your website.