The correct handling of user data can become a lucrative market niche. For a start-up in particular, investing in the sensitive data business can be worthwhile.

The European General Data Protection Regulation came into force on May 25, 2018. It has now been in force for more than three years. And there is still a great deal of uncertainty among many companies. For many, the European law from Brussels is an expensive and unwieldy set of regulations. And handling sensitive customer data is not easy.

But this law, if applied and marketed correctly, can become a lucrative market niche. Companies that specialize in the following areas in particular can make money with the General Data Protection Regulation:

• GDPR-compliant processing of personal data
• Function as data protection officer
• Interdisciplinary advice on data protection issues

What is the General Data Protection Regulation?

The General Data Protection Regulation (GDPR) came into force in 2016 and has been applicable throughout the EU since May 2018. It serves to establish a uniform data protection law in the European Union and regulates which data about each individual consumer may be collected, (further) processed and commercialized.

What does the GDPR regulate?

In order to ensure the best possible data protection, this regulation sets out the rights of consumers, the obligations of data controllers and the following principles of data processing. These include:

1. legality

In principle, data may only be stored or processed if the GDPR authorizes this. For example, if the data subject has given their express consent or if there is a legal basis for this.

2. transparency

According to recital 58, the principle of transparency means that information intended for the public or the data subject must be precise, easily accessible and comprehensible, written in clear and plain language and, where appropriate, accompanied by visual elements. In addition, all information on data processing must be accessible to the data subject at all times in plain language.

3. earmarking

Data may only be collected for clear and legitimate purposes, which must be defined in advance.

4. data minimization

Companies may only collect as much personal data about an individual as is necessary for the specified purpose.

5. correctness of the processing

Accordingly, companies must ensure that their customers’ data is factually correct and up-to-date.

6. memory limitation

According to this principle, personal data may only be stored for as long as is necessary for the purpose for which it was collected. They must then be deleted. However, this principle conflicts with statutory archiving obligations. There may also be exceptions for scientific or historical research purposes.

7. integrity and confidentiality:

The security of the data (e.g. protection against loss, unintentional destruction and unauthorized or unlawful processing) must be guaranteed at all times by technical and organizational measures (TOMs).

With the help of these principles, EU data protectionists want to prevent companies from collecting unnecessary amounts of customer data. This means that consumers and their fundamental rights are also protected when it comes to data traffic within the EU. The transfer of personal data to countries outside the EU is also only permitted if the third country can guarantee adequate protection similar to the EU GDPR.

Particular caution is required in the case of data transfers between the EU and the USA. The reason for this is that the European Court of Justice (ECJ) overturned the Privacy Shield in July 2020. Since then, the transfer of personal data to American service providers is no longer permitted without additional security measures.

How private individuals benefit from the GDPR

The EU General Data Protection Regulation is about protecting the user. The correct and secure handling of personal data is becoming increasingly important to users. User trust is becoming a decisive factor for business success. If users know what happens to their data and how it is handled, they are more inclined to disclose it.

How smart companies benefit from the GDPR

For companies specializing in personalized advertising or the analysis of personal data, the European regulation was a major blow. And the high fines for breaches of the General Data Protection Regulation were also a horror for many companies.

The principles of data processing under the EU GDPR result in numerous obligations for companies. These affect digital subscription providers, among others, as they have to collect a large amount of personal data in order to provide their services, e.g. subscriptions.

Companies should also check the contracts with their employees, agencies and suppliers. The reason for this is that the GDPR distinguishes between the data controller (company that requires data) and the processor (company that processes the data on behalf of the data controller).

One thing is certain, every company in the European Union has to deal with data protection. And if you can’t manage on your own, you should turn to experts to take over the processing of sensitive data.

How nexnet deals with the GDPR

nexnet also operates its servers exclusively in Germany and attaches great importance to data protection.

As one of the market leaders for bulk billing, competent and professional handling of sensitive personal data is one of our quality features.