New Food: Our 5 Steps to GDPR Compliance

The team at New Food has spent nearly a year getting ready for GDPR. We take data protection seriously, which is why we have prepared this document to share the 5 key steps we decided to take to ensure we are GDPR compliant now and in the future.

Our 5 Steps to GDPR

Step 1. Awareness

In early 2017, key members of our data and marketing teams attended industry conferences and training sessions with speakers from leading organisations such as the Information Commissioner’s Office and Direct Marketing Association, to assess the new legal obligations and to understand any impacts on how New Food conducts its business.

Over several months we then drew up a plan of action. This included internal workshops across all departments at New Food, so that every member of the team, whether they work in Sales, Marketing, Editorial, Events, Accounts or Senior Management, was made fully aware of the new legislation.

Together, we discussed how we all play a part in protecting our readers, suppliers and advertisers personal data.

Step 2. Audit + Clarity

Tim Martin, Head of Data

A vital start to our journey to GDPR compliance was conducting a rigorous data audit, ensuring we had traceability for all our records (see Consent & Legitimate Interest Step 5 below). You can only move forward with GDPR by looking back at your data’s past to understand what you are currently managing.

It was a painstaking process for our Head of Data (and new GDPR Compliance Officer) Tim Martin and his team, but they identified all the personal data we currently hold and went through record-by-record, deleting anything which was not compliant.

As luck would have it, Russell Publishing, the publishers of New Food, had also invested in a completely new Customer Relationship Management (CRM) database, which meant most of our auditing had already started, so the two projects could run side-by-side. The new CRM also features ‘Contact Preference Centres’ allowing anyone we email to change their preferences easily and securely.

Rolled in with the Audit was a root-and-branch review of our Terms and Conditions and Privacy Policy. It was no surprise to find that over the course of time, both of these pages had become littered with legal jargon. We felt they needed improving to meet GDPR guidelines on clarity. If you click to view them now, we hope you agree they are much easier to read and that they give our users a clearer idea of how we use and protect their data.

Step 3. Communication

We conducted the groundwork, we assessed best practice and we also cleaned our data. Now we needed to communicate our new policies to our audience.

Our marketing team prepared a number of short, simple messages, and sent them to our audience in advance of the 25 May deadline, explaining our approach to GDPR and notifying everyone of our new terms and conditions and privacy policies.

We also decided to prepare this document (the one you are reading now) as another way to communicate to our audience – and we hope you are finding it informative and reassuring.

Step 4. Process

An essential part of GDPR compliance, and Step 4 of our action plan, was to check our data procedures, to ensure they cover all the rights individuals have. This included establishing a clear process for deleting personal data and to enable ‘Subject Access Requests (SAR)’ from anyone appearing in our database. Under GDPR, data subjects have the right to request:

• Confirmation that their data is being processed by us (i.e. we have a record on our database with their details, and we have a clear source)
• Access to their personal data
• Other supplementary information (which should correspond to the information outlined in our privacy policy and terms and conditions)  

New Food now has a process in place for any SARs, which includes the following vital criteria in order to meet GDPR guidelines:

• Any information requested must be given free of charge
• Any information requested must be provided without delay and within a month
• Data subjects can make requests easily, including electronically

Step 5. Consent & Legitimate Interest

Article 6 of the GDPR sets out six lawful bases for processing personal data:          

1. Consent: the individual has given clear consent to process their personal data for a specific purpose.
2. Contract: the processing is necessary for a contract with the individual, or because they have asked to take specific steps before entering into a contract.
3. Legal obligation: the processing is necessary to comply with the law (not including contractual obligations).
4. Vital interests: the processing is necessary to protect someone’s life.
5. Public task: the processing is necessary to perform a task in the public interest or for official functions, and the task or function has a clear basis in law.
6. Legitimate interests: the processing is necessary for legitimate interests or the legitimate interests of a third party unless there is a good reason to protect the individual’s personal data which overrides those legitimate interests.

The final, and some would say most important step New Food decided to take, was to confirm our approach to data acquisition and future marketing. We value our readers enough to know that when they give consent to subscribe to our journal, they trust us with their data. Equally, we value our wider audience enough to know that relevance and targeted marketing is the way forward – gone are the days of buying in poor quality lists or followers.

GDPR has been an opportunity for our brand to reaffirm what has always been our approach to growing our readership, namely, that we will continue focus on organic growth, with both consent and legitimate interest the primary (but not exclusive) methods for us holding personal data.

We based this on published guidelines from the Information Commissioner’s Office which states:

“You should consider which lawful basis best fits the circumstances. You might consider that more than one basis applies, in which case you should identify and document all of them from the start.

You must not adopt a one-size-fits-all approach. No one basis should be seen as always better, safer or more important than the others, and there is no hierarchy in the order of the list in the GDPR.”

Consent

New Food will never sell or pass a contact’s data to any third party without their express permission. When a user completes our simple subscription form or downloads any materials from the site they must opt in to be contacted by the third party.

Legitimate Interest

New Food uses three elements to assess a contact’s legitimate interest in our content:

• Does the contact have a legitimate interest?
• Do we need to process the data to achieve it?
• How do we balance it against the individual’s interests, rights and freedoms?

In compliance with Step 4 above, anyone making a Subject Access Request will be informed by us of where we sourced their data, what data we hold, and why we hold it. Our preferences centre and easy unsubscribe enables our audience to control communications from us and should they choose to be deleted, our processes will allow us to do so quickly and compliantly.

GDPR Compliance = Peace of mind for our Readers and Advertisers

By taking the 5 Steps above to achieve GDPR compliance, New Food will continue to deliver great content that is relevant to our readers. We like making connections and helping people to discover new solutions as well as to learn and hear about the latest developments from all areas of the industry.

New Food’s purpose is to act as a voice for the industry, and we feel strongly that our advertisers also have something of value and interest to say to our readers. Many of our advertisers are just as forward thinking as we are, and with GDPR in place, they wouldn’t work with us if we didn’t meet these high standards.

View our Media Planner

If you would like to know about our advertising opportunities and the peace of mind our GDPR compliant media channels can offer your business, please contact [email protected]

About us

New Food is one of the leading sources of news, analysis, products, services and research communities in the industry. We publish content every day on our website, or as digital documents in a range of easy-to use formats, such as PDFs and graphics, or as high-quality print periodicals.