GDPR (or the General Data Protection Regulation) has been around for over two years now. And like most two-year-olds, people have found ways to get some kind of compliance under control. 

That’s not to say that there haven’t been bumps along the way. Organizations have balked at the international reach of the regulation. Technology solutions have lagged in comparison to the regulatory environment. Business processes have lagged as well. 

Yet GDPR has continued to gain traction, especially as consumers look to protect their personal information wherever possible. Similar laws are being passed and going into action in the United States – the California Consumer Privacy Act is the first, but definitely not the last – and Brazil, Australia, and other places. It’s a big deal, globally. 

And a big job. Compliance with GDPR is a significant undertaking for organizations. The first place we suggest starting? With a data inventory. And what does a data inventory require? Taking a good long look at Article 30 of GDPR. 

Quick reference: What is GDPR?

GDPR is the most in-depth, comprehensive set of data protection regulations. GDPR, which went into effect in May 2018, limits what organizations can do with an EU resident’s personal data and codifies that resident’s right to determine how their data is used. Organizations don’t have to be located in the EU to feel the pressure of compliance or even conduct business with EU residents – if you simply collect their data, you’ve got to comply. (Or face some pretty hefty fines.)

Moreover, GDPR was a significant piece of legislation because it shifted the landscape on how personal data was defined. We all have a general understanding of personal data as information that identifies an individual. It can be something we all clearly associate with personal information, like a name or birthdate. 

However, GDPR pushed the envelope. It’s definition included technology-specific items like digital identifiers like cookies. GDPR made a particular impact in creating special categories of personal data. These categories are more carefully guarded and include information about racial or ethnic origins, political or religious beliefs, genetic or biometric data, and more. 

But GDPR isn’t just about defining data – it’s about structuring how and why companies can use it. Under GDPR, organizations that collect personal data have to keep records of processing activities. Herein lies the function of Article 30. 

See a full list of special categories of personal data here. To do a deeper dive into GDPR issues, we have a helpful FAQ that reviews common issues and a wealth of detailed blog articles that explore GDPR

A few words about Article 30

If GDPR focuses on accountability, Article 30 is one of the main tools to help create it. It tells organizations exactly what they need to document to be GDPR compliant. We’ll cover exactly what you should document for Article 30 below, but just as important as the actual data is keeping it up-to-date and organized. 

This emphasis on organized data collection is why the process of data inventories is so important. You don’t actually need a data inventory to meet Article 30 requirements, but it would be next to impossible to do it without one. With a data inventory, you can establish data flows, you can figure out what is (or isn’t) accounted for, and pinpoint vulnerabilities resulting from information transfer.

Meeting Article 30 requirements

GDPR compliance isn’t something that can be handled overnight – it contains 99 articles with important definitions, instructions, and guidelines to incorporate into how your organization handles personal data. (And even when you’re done, you’re not really done – it’s an ongoing process. That’s why we serve as fractional CPOs to help companies manage the long-term work.)

But let’s zoom in on Article 30. Article 30 provides an important jumping-off point for any GDPR-related compliance by requiring that all organizations provide records of how all personal data is processed. This means providing an Article 30 report, though you might know this by the name of, yes, data inventories, but also data mapping or records of processing activities. 

What do you need to collect to put together a data map/data inventory/record of processing activities/Article 30 report? Let’s take a look at the overall requirements referred to in the article and what they mean. 

Get ready, get set, get your records ready

Under Article 30, any organization acting in a processing capacity has to keep a record of all categories of processing activities conducted on behalf of a controller. These records should contain the following information:

  • Name and contact details of the controller
  • Purpose of processing
  • Categories of processing activities that are carried out for each controller  
  • Categories of data subjects and processed data
  • Categories of processing activities that are carried out for each controller  

It’s important to remember that an organization can be both a processor AND a controller. How to tell the difference? If you’re determining what data is collected and why, then you’re the controller. If you’re just doing the processing at the behest of another organization, then you’re the processor. As with everything in life and work, situations aren’t always black or white. Additional professional and legal guidance can be a big asset in navigating them. 

Names and contact details of the controller

If applicable, you should include the name and contact details of your data protection officer and of any joint controllers that decide with you why and how personal data is processed.

Purpose of processing

One of the kickers of GDPR is that there needs to be a legal basis for collecting data. This can include (but again, isn’t limited to):

  • When consent is given by the subject for a given purpose
  • When data collection is necessary for a contract with the data subject
  • When there is a legal obligation
  • To protect the vital interests of the data subject
  • For public interest or in the course of official authority
  • The legitimate interests of the data controller or a third party as long as those interests don’t infringe on the rights of the data subject

Categories of processing activities that are carried out for each controller  

According to Article 30, “processing’ means any operation or set of operations which is performed on personal data or on sets of personal data…” 

That’s quite a broad definition, right? This broadness allows the regulation to apply to as many organizations that might have their hands on personal data as possible. 

Article 30 does provide a (non-exhaustive) set of examples for guidance, though. Data processing includes (but is in no way limited to), “collection, recording, organization, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction.”

As per this requirement, you don’t just have to pinpoint who is doing the collecting and processing. You also have to identify the “categories of recipients of personal data,” that is, anyone that you’re sharing collected personal data with. This could include vendors, government agencies, credit bureaus, and more. 

Categories of data subjects and of the categories of personal data

Article 30 requires that categories of data subjects and processed personal data are included in records of processing activities. In a more straightforward way, this just means what kind of information you’re collecting and about whom.

Personal Data

  • Name
  • Home address
  • E-mail address 
  • Personal phone number
  • Work phone number
  • Birthday/age Languages
  • Passport details
  • Social security number or other national identifiers


  • Driver's license details
  • Sex
  • Marital status 
  • Wage/salary
  • Bank account
  • Credit card details
  • Education level/diplomas

Data Subjects

  • Current personnel
  • Former personnel
  • Contractors/consultants/freelancers 
  • Students
  • Volunteers
  • Directors
  • Shareholders


  • Beneficiaries
  • Public officers
  • Consumers
  • Website end-users
  • Customers
  • Prospects
  • Suppliers

Special categories of data

  • Race and ethnic origin
  • Religious or philosophical beliefs
  • Political opinions
  • Trade union memberships


  • Biometric data used to identify an individual
  • Genetic data
  • Health data
  • Data related to sexual preferences, sex life, and/or secual orientation

Where applicable/possible

You may also need to include information on the following:

  • Identification of any transfer of personal data to another country or international organization. This needs to meet cross border transfer requirements.

  • Time limits for the erasure of different categories of data

  • General description of the technical and organizational security measures 

How to go about the work of meeting Article 30 requirements?

Data inventories don’t just create themselves! Knowing what you need to put together is half the battle, but you also need to determine effective internal processes to do the work. Some things to consider:

  • Are you starting from scratch or using an existing data map? 

  • How are you going to populate it: automated scanning? Questionnaires? API integration? 

  • How far back are you collecting data? 

  • Who is doing the work - your IT team? Legal? 

And, importantly, what is your long-term strategy for maintaining your records? Compliance is never a one-and-done deal. It requires care, attention, and strategy over time. 

If you’re ever feeling overwhelmed, let us know. We’re happy to advise. Red Clover Advisors has been a partner in guiding clients through the process of meeting GDPR compliance requirements for US. We help you create a comprehensive strategy covering data inventories, privacy policies, and data protection that are custom-built for your company’s needs. 

To get started with your own roadmap, reach out to set up a free consultation with our team today.

For many organizations in the US and abroad, the General Data Privacy Regulation (GDPR) and the California Consumer Privacy Act (CCPA) lay the groundwork for how data security and consumer privacy are approached.

These regulations have made big impacts in the data landscape. An important element of these legislative landmarks? The need for businesses to implement cookie banners across their website and app. But while it’s tempting to just add a cookie banner to your website and move on to your next project, do you know what the deal actually is with them – and how to make sure you’re truly compliant? 

Differences Between GDPR and CCPA: The Nutshell Version

Comparing GDPR and CCPA can be a helpful exercise in understanding data privacy issues. While the two regulations aren’t interchangeable, they both deal with similar issues and similar concerns in individual rights. Both of them create legal requirements around:

  • Transparency in businesses practices dealing with personal data 
  • Security and control over personal information for consumers
  • Defining digital identifiers (cookies) as personal information  

One of the big points of departure between GDPR and CCPA is the issue of user consent. Consent and data are approached from two different angles between GDPR and CCPA. GDPR centers on the user, requiring prior consent for collecting cookies. CCPA allows businesses the ability to collect data before getting consent as long as users have the ability to opt-out of collection.

Another significant difference between GDPR and CCPA is scope. While both have international reach, despite the fact they pertain to residents of specific territories, compliance mandates differ. Under GDPR, any website, organization, or business has to comply with the regulation if it’s processing the personal data of EU residents. (Even if they aren’t actually located in the EU.)

On the other hand, the CCPA requires companies or for-profit businesses or organizations have to comply – and only if they meet the following criteria:

  • Has a gross revenue of more than $25 million
  • Buys, receives, sells, or shares personal information of more than 50,000 consumers, households, or devices each year for commercial purposes
  • Derives 50% or more of annual revenues from selling consumers’ personal information.

Meet Your GDPR Cookie Banner Compliance Requirements

GDPR compliance. We’ve been talking with that for a little bit, haven’t we? Seeing that GDPR has been in effect since May 25, 2018, you may have already grappled with cookie banners and consent.  

A key tenant – perhaps even THE key tenant – of GDPR requirements is that EU residents have the right to be informed when a business or organization collects their personal data. And it’s not just that they’re collecting the data – businesses and organizations have to tell people why they’re collecting it, how long they’re keeping it, and who they’re sharing it with. If an individual doesn’t want their data used in that manner, they have the right to object.

But how does this actually play out on websites? Websites and apps that are used by visitors from the EU must implement a consent banner that complies with GDPR and it has to have several pieces in place. 

Opt-in Cookie Consent

When you set up your cookie banner, the safest way to approach cookie consent is to take an opt-in approach. The opt-in approach means that website visitors have to actively give you permission to drop cookies. (At least those that aren’t essential for site functions.)  

How do you get that consent? By an opt-in button. But remember, your text has to be crystal clear in communicating that the user is agreeing to cookie deployment. 

More on Cookie Deployment

Let’s expand on cookie deployment just a little bit. According to GDPR, your website needs to be sufficiently detailed so that visitors are able to give informed consent about accepting cookies. A key piece of this information is the whats and whys of your cookies. What kinds of cookies are you using? Why do you want the data and how are you going to use it? 

Third-Party Data Sharing

When we talk about how we’re using visitors’ data, one topic that comes up time and again is sharing with third-party vendors. Third-party vendors provide businesses with valuable services, but they also pose a security risk. For transparency, you need to inform users who else has access to their data. 

Link to the Website’s Cookie Policy. 

You’ve got a cookie policy. (Right?) Don’t be shy about sharing it with your website visitors – it’s part of your compliance journey. 

The most straightforward way to get people to your policy is by adding a link to your website’s cookie policy in your cookie banner. Your cookie policy should cover the details of how cookies are used on your site and include an exhaustive list of all the cookies you’ve put into place. 

Win Brownie (Err…, Cookie) Points

You don’t have to do this, but your visitors will appreciate it if you add a link to your cookie settings within the cookie banner. Yes, it’s not strictly required by GDPR as long as visitors have the choice to refuse all cookies. Website users, unsurprisingly, appreciate the option to control their user experience and their data. 

Meet Your CCPA Cookie Banner Compliance Requirements

The CCPA went into effect on January 1, 2020, but only recently became enforceable as of July 1. Similar to GDPR, CCPA gives California residents the right to be informed when a business or organization collects their personal data. In fact, California residents even have the right to bring suit against businesses in certain cases. 

Under CCPA, website owners have to inform users about what information they’re collecting, how they’re processing it, and with whom they share it. That part is very similar to GDPR. 

However, there is a big difference between GDPR and CCPA: CCPA takes an opt-out rather than an opt-in approach. While CCPA doesn’t require a banner to facilitate the opt-out, it’s currently the best practice to make sure you’re giving visitors the ability to opt-out at the time of – or before – collection.  

The CCPA does restrict one aspect of data collection for websites: the sale of personal data for visitors under 16 years old. These underage visitors are required to opt-in rather than opt-out. So if you’re not sure you don’t have visitors under the age of 16, it’s better to use the opt-in approach. 

With all that in mind, let’s take a look at the Ingredients for a CCPA-compliant cookie banner. You should include the following in your cookie banner. 

Information About Cookie Use

CCPA requires websites to provide users with the details about why they’re collecting and using cookies and if they’re going to be sharing or selling that information to third parties. 

A Button to Accept Cookies

As noted above, there’s not an opt-in requirement under CCPA. However, you can include a link that allows users to accept cookies. (But you can fire cookies before the website user accepts them as long as you give them the information about data you’re collecting at the point of collection.) 

As in the GDPR version of a cookie banner, you have the option of including a link to a cookie setting page that allows users to opt-in or out. No, it’s not necessary, but yes, it’s a good step towards transparency and user experience. 

Do Not Sell Button

Under CCPA, you’ve got to give your users the ability to opt-out not just of data collection, but of the sale of personal information. According to CCPA, selling includes the following: “selling, renting, releasing, disclosing, disseminating, making available, transferring, or otherwise communicating orally, in writing, or by electronic or other means, a consumer’s personal information by the business to another business or a third party for monetary or other valuable consideration.” With such a broad definition, it’s important for companies to understand the data that is collected and shared and specifically what the third party is doing with the information to determine if data is classified as a sale under CCPA 

(One issue to be mindful of is how you or your partners are using ad tech. While not all ad tech is considered selling, some uses may fall into the category of sales.) 

To uphold CCPA requirements, you need to provide the option of opting out. CCPA is specific on how you should do this: include a link or button to an opt-out form on your website’s home page. 

Your “Do Not Sell” needs to include some specific information, as well. It needs to have:

  • A link to your website’s privacy policy
  • A button that allows them to opt-out of personalized ads

Let us reiterate: Your “Do Not Sell” button isn’t the same thing as or interchangeable with a cookie banner. Don’t treat it as such. It’s a separate function. However, it’s smart to use it alongside your cookie banner to help your website use cookies to process data in a CCPA-compliant manner.

Tying it all together

Yes, both GDPR and CCPA have a lot of moving pieces that you have to address in your cookie banners. And yes, it’s tempting just to find a customizable cookie banner online and wash your hands of it. 

But we don’t recommend this approach. Cookie banners don’t exist in a vacuum. Cookies change and have to be updated. It should all be part of your larger privacy strategy.  

If this feels overwhelming, we hear you. That’s why we work closely with clients to build a manageable strategy for long-term business goals. Ready to take the next step? Give us a shout. We’d love to chat.

Third-party agreements

You’re only as strong as your weakest link.

And most companies are blissfully unaware of their weakest link when it comes to compliance with new and forthcoming privacy regulations.

This hidden danger? Third-party agreements. Truth is, they can make or break your privacy rights implementation.

Third-party vendors are fast becoming the fashion of the day. The General Data Protection Regulation (GDPR) refers to them as processors. Under the California Consumer Privacy Act (CCPA), they include true third party services, as well as service providers.

Outsourcing specialized or less intensive tasks (think technology, marketing, and IT) to experienced outside resources seems like a no-brainer. In fact, it’s proven more efficient and cost-beneficial for most companies that use it.

Because of the increasing demand for third-party vendors, the risks they bring to the table also escalate dramatically. And the responsibility for managing that liability falls fully on the company to which the third-party vendor is contracted.

In other words, you.

Paying attention to what your third-party vendors are sending – and what those third parties are doing with that data – isn’t just a suggested best practice anymore. Regulatory oversight has expanded to make monitoring sensitive data and processes of third parties critical to a company’s operational success.

If you’re a business that doesn’t have vendor evaluation and monitoring processes in place, you’re not alone. Even if you have created these elements, chances are they’re completed and managed on Excel spreadsheets. Worse, you’re probably using a one-size-fits-all approach for analyzing every vendor.

This is a huge red flag.

Not all vendors are the same. A small consulting firm won’t pose the same risks as a large IT database company. Evaluating both of these vendors on the same scale, with the same criteria, is inefficient and ineffective. It’s essential to customize third-party evaluations based on each company’s size.

Proper third-party agreements protect your company from reputational damage and inadvertently violating laws. Because third-party agreements are an essential part of regulatory compliance and can’t be overlooked, all companies should follow a complete privacy checklist to execute them consistently and accurately.

#1 – Nail Down your Vendor List

Sure, you can probably reference a list of vendors, suppliers, distributors and contractors with whom you do business. But under most regulatory guidance, the definition of a third-party vendor is more nuanced than just a simple list.

Many companies don’t understand that it covers any business arrangement between an organization and another entity, by contract or otherwise.

Under this definition, a third-party agreement includes undocumented, verbal, and hand-shake contracts. These could have been established recently or many years ago by someone who doesn’t work at your company any longer. It doesn’t matter. These contract manufacturers, brokers, agents, and resellers all count as vendors and must be a part of your evaluation of third-party agreements.

To take it a step further, some third parties actually outsource some of their own projects to additional resources. If this comes as a shock, don’t worry. It’s standard practice for vendors to do this without the consent or knowledge of the company they’re working for. However, it’s an essential piece of managing third-party agreements.

Point is, you probably have more third-party agreements than you thought. Nailing down your vendor list – including their own subcontractors – is an essential first step for privacy compliance.

#2 – Review and Update Contracts

Cybersecurity tips for small businessesThe next step on the checklist is reviewing and updating your third-party agreements. You’ll have to read through each contract to make sure it adheres to best practices for cybersecurity, data security, and privacy rights. Doubtless you’ll have to update the verbiage in these contracts to reflect privacy standards and clearly lay out duties for each entity to follow.

In order to maintain a clear definition of responsibility for data, you must follow a process to make sure all your vendors are compliant.

The first step in this process is creating and updating an evergreen inventory of security and privacy updates and requirements. You can then use this database to perform a comparable scan of each of your vendor contracts. You’ll want to hone in on specific contract terms and data processing agreements (DPAs) within contracts.

If you’re wondering if your work completed under the GDPR requirements applies for the CCPA, it doesn’t. There are specific requirements for each regulation, so you’ll need separate inventories supporting each standard.

Once you’ve extracted the outdated language from each vendor contract, it’s time to update it with the correct text. Traditionally, this has been the responsibility of the legal team and focused on data security topics. Now the privacy team also needs to have a say because of the privacy risks and stipulations so prevalent in legislation. Individual rights is an especially important part of this, with amendments limiting the use of data only to a specific purpose. Third parties must agree to honor these individual rights requests on your company’s behalf.

If the privacy team doesn’t lay out how and where data should be managed and stored, the security team can’t protect it. Because of this, all new contract language should be pre-written and pre-approved by the legal, security, and privacy teams.

Most importantly, all companies should have an established method for alerting stakeholders when vendors are subject to breaches or regulatory enforcement. The key to reviewing existing third-party agreements is to pinpoint high risk vendor relationships. When you’ve identified these organizations, you can put extra care around monitoring and preventing risks. This will ensure vendor accountability and compliance across the board.

#3 – Create a Third-Party Risk Management Process

Top 5 To Dos to Make Your Digital Strategy Privacy-FriendlyThe final task on your privacy checklist for evaluating third-party agreements is planning for the future. It’s not enough to ensure your existing vendors are up-to-snuff. You must also create a bulletproof plan for assessing, onboarding, and monitoring vendors you’ll add to your roster in the time ahead.

First, get your team on the same page. This means organizing cross-functional stakeholders from procurement, IT, finance and executives to whom the vendors will report – and privacy officers, of course – to help perform and review new third-party agreements. Next, identify the critical risk categories on which you’ll assess new third parties: strategic, reputational, operational, financial, compliance, security, and/or fraud.

Remember, you also have to make sure appropriate questions are asked to organizations based on their sizes. A simple way to determine evaluation criteria and scoring is through third-party questionnaires. These tools are lifesavers when it comes to evaluating vendors for compliance, security, and other risk factors. Non-profit privacy organizations offer high-quality questionnaires to their members. In addition, any third-party risk management software will normally include these questionnaires for free as a part of a subscription cost.

You may be surprised to learn the most important part of these evaluations is not the completion of them by the vendors in question. It’s critical the team assigned to review these questionnaires – and accept or deny the vendor – actually completes its responsibility, and does it in a timely manner. This cross-departmental group should weigh the scores based on risk impact so vendors can be categorized and prioritized in tiers.

The steps of this third-party risk management plan should be written down and kept on hand by anyone who deals with onboarding new vendors at your company. It should be followed to the letter to ensure all third-party agreements meet company and regulatory standards. And of course, ongoing training is essential. New and existing employees should complete rigorous training on the new third-party risk management process.

Conclusion: Get a Handle on Your Third-Party Agreements

Today’s consumers hold more power than ever before. If there’s an issue with how their data is being managed or used, they’re not going to point the finger at the third-party vendor responsible for the misdemeanor. They’re going to fully blame you – the vendor’s employer.

If you don’t want to get in trouble for something you didn’t do, completing due diligence with your third-party agreements is crucial.

The good news is, risk management software can help you complete this privacy checklist for evaluating third-party agreements in the least amount of time, effort and expense. It allows you to ditch the Excel spreadsheets and dusty digital files. Instead, you’ll be able to utilize a cost-effective, intuitive system that’s applicable to each new vendor.

Hiring a Fractional Privacy Officer (FPO) can also give you a leg up. This individual is adept at creating the review process, managing it from end-to-end, analyzing the assessments, and making it right inside the organization. If you’re interested in seeing how an FPO can exponentially benefit your vendor management process, we’ve got a team of experts who are well-versed in this high-risk area.

Reach out today to schedule a free consultation!

 

Schedule a free consult!

Press Release issued April 15, 2019:

Red Clover Advisors, a national consulting firm advising businesses on privacy and its opportunities, is proud to announce national certification as a Women’s Business Enterprise by the Greater Women’s Business Council, a regional certifying partner of the Women’s Business Enterprise National Council (WBENC).

“As one of the few WBENC certified privacy-focused consultancies, clients can benefit from our unique perspective while demonstrating their commitment to fostering diversity within their supply chain,” said Jodi Daniels, Founder and CEO of Red Clover Advisors. “Clients receive concierge level service with the added advantage of working with a professional services partner holding a nationally recognized certification.”

WBENC’s national standard of certification implemented by the Greater Women’s Business Council is a meticulous process including an in-depth review of the business and site inspection. The certification process is designed to confirm the business is at least 51% owned, operated and controlled by a woman or women.

The inclusion of women owned businesses among their supply chain demonstrates the commitment of companies to foster diversity and accelerate the maturity of their supplier diversity programs.

To learn more about Red Clover Advisors, please visit redcloveradvisors.com.

About Red Clover Advisors:

Red Clover Advisors creates customized and affordable privacy programs to fit the size and diversity of each business. Our privacy consultancy is dedicated to understanding the ins and outs of balancing customer data collection and use, GDPR and US privacy law compliance, operationalizing privacy, digital governance, online data strategy, and much more. Our job is to simplify privacy practices so your business can gain a competitive advantage through trust. We believe privacy is just good business.

About WBENC: 
Founded in 1997, WBENC is the nation’s leader in women’s business development and the leading third-party certifier of businesses owned and operated by women, with more than 13,000 certified Women’s Business Enterprises, 14 national Regional Partner Organizations, and over 300 Corporate Members. More than 1,000 corporations representing America’s most prestigious brands as well as many states, cities, and other entities accept WBENC Certification. For more information, visit www.wbenc.org