GDPR

How it works

• It covers personal data about people in the EU, wherever the business sits.
• People can ask what you hold, ask for corrections and ask for it to be erased.
• You need to know where the data is, why you keep it and when you delete it.
• It applies to a small Canadian business when it has EU customers or visitors whose data it handles.

What can go wrong (example scenario)

A three-person Canadian tour operator with European guests kept booking records in a spreadsheet forever. A guest asked for her data to be erased and the owner had no idea where all the copies were. The follow-up complaint cost weeks of correspondence.

How WILDCARD handles it

A privacy policy and a data map are vCIO outputs available today. Compliance documentation as its own card is still being shaped.

• A law firm with European clients needs a data processing record and a breach procedure.
• A retailer shipping to the EU needs consent captured for its newsletter and a way to delete subscribers.
• A non-profit with EU donors needs a privacy notice that says what is collected and why.

Example scenario: A small language school in Canada with students from Europe received a data access request. Because they had a short data map listing their four systems, they answered in a week with everything held about the student. The request that could have been a crisis became a routine task.

A question owners ask

I'm in Canada. Does GDPR apply to me?

If you market to or serve people in the EU, yes, in principle. If all your clients are Canadian, PIPEDA is your law. Either way the good habits are the same.