Data protection for small and medium enterprises | SMEs

You do many things every day – with the most important being – staying in business. If your small or medium enterprise (SME) processes personal data, one of the things you need to do is to protect it.

• Focus on getting the essentials right quickly and cost-effectively.
• Build trust with your customers and stay on the right side of the law. 
• Don’t get caught up doing things you don’t have to – there are things that SMEs are (or should be) exempt from having to do.
• Find the right tools or software to help you manage privacy properly.

This lens will help you get this right without breaking the bank. Most of what is written about data protection on the internet is intended for large organisations (like banks and healthcare providers). This content just isn’t relevant for an SME. What an SME needs to do is very different from what a large organisation needs to do.

Data protection is important because it protects people from harm. It is one of the cornerstones of democracy, protects individual freedoms and enables the free flow of data. If data is the new oil in the information age, then any laws that regulate how an organisation can process personal data become crucial. Oh, and the law also requires data protection.

The problem is that data protection is complex and hard to get right on your own. The risks of getting it wrong are significant. Many organisations have found out the hard way and suffered the consequences. Their brands have been severely damaged, they’ve lost the trust of their customers, or they’ve been fined large amounts.

Getting data protection right can be expensive. Many organisations have spent lots of money on consultants trying to put controls in place to protect the personal data they process without really getting practical and effective results. Without guidance, people in organisations have spent hours and hours trying to get their heads around data protection. Data protection is difficult to understand and apply to your specific circumstances because it is complex and deals with intangible concepts. The focus should not be on compliance but rather on the outcomes the law is seeking to achieve. You also want to do things in the right order.

Getting expert guidance and assistance makes a lot of sense. We have put all our knowledge, expertise and experience into this lens along with the core programme. We’ve spent thousands of hours creating it so that you can protect the personal data you process in a practical and effective way. This lens contains the knowledge we’ve gained through many years of practically applying the topic and helping other SMEs (guidance in a structured format), easy access to relevant laws, tools for you to use (like templates, frameworks and presentations), and a programme group or forum for discussion about shared issues. A place for members to talk to each other. Many people face the same challenges and there is no competitive advantage in dealing with them. Collaborating with others to solve common issues makes a lot of sense, especially when our common goal is to protect people from harm. There is no need to reinvent the wheel.

This lens will help you process personal data lawfully and embed a culture of data protection and build capacity in your organisation. Use your resources, but with our expert guidance. Transfer skills to the relevant people in your organisation and empower them.

This lens is for small or medium enterprises (SMEs). A small-sized enterprise has between 1 and 49 employees and includes sole traders and micro-businesses. A medium-sized enterprise has between 50 to 249 employees. It is suited specifically for SMEs on which data protection has a high impact – the risks are high. For example, you process sensitive personal information. Here is what low-risk small business should and shouldn’t do for data protection.

This lens is for organisations that have to comply with multiple data protection laws (like the GDPR, the CCPA, the UK DPA, the POPI Act or other data protection laws of Africa). If your organisation only has to (or wants to) comply with the South African Protection of Personal Information Act (POPI Act or POPIA) you can look at the topic through the POPI lens, which is included in this subscription. We also have specific lenses for manufacturers, non-profit organisations, schools, community schemes and in healthcare. If you are one of those, you can also look through that lens.

Types of organisations

• Organisations on whom the impact of data protection is high, especially organisations that have many natural people as customers.
• Organisations whose activities involve significant processing of personal data.
• This lens is not for large organisations.

Types of people

The people from an organisation who get the most value from this lens are the people planning, deciding and implementing actions to protect personal data. For example, the founder, managing director, CFO, finance manager, COO, operations manager, in-house legal, data protection (or information) officer or managers. This lens is not for customer-facing employees.

• We believe in using the law as a tool to prevent harm from coming to people.
• We have significant practical experience dealing with data protection.
• We cover only those areas of data protection law that are most relevant to you, saving you time and money.
• We provide insight and simplify the issues, empowering you to work through the obligations yourself.

A lens is a complimentary programme that you get access to by joining the data protection programme. It contextualises data protection for a particular audience, such as community schemes, non-profits, or schools.

These lenses serve as an additional guide as you work through the core programme.

100% Money Back Guarantee

We will refund you if you do not think you received value.