Identify the most common questions you\u2019ll be asked<\/h2>\n
This should be your starting point. Think about what industry you\u2019re in, what partners you share data with and just generally how data flows through your organization. This shouldn\u2019t be difficult, as you\u2019ve already had to do it to become compliant in the first place. So, it should be fresh in your mind.<\/p>\n
Using our organization as an example, here were the questions we came up with:<\/p>\n
- \n
- What is GDPR?<\/li>\n
- Does the GDPR affect non-Europeans?<\/li>\n
- Are you GDPR compliant?<\/li>\n
- What are you doing\/have you done to be compliant?<\/li>\n
- What information are you collecting about me?<\/li>\n
- What are you doing with my data?<\/li>\n
- Are you Privacy Shield certified?<\/li>\n
- What technical safeguards do you have in place?<\/li>\n
- Can I get a Data Processing Addendum from you?<\/li>\n
- Is the GDPR retroactive?<\/li>\n
- Are your partners GDPR compliant?<\/li>\n
- How can I verify that you\u2019ve really done all this?<\/li>\n
- How do I modify or delete my information?<\/li>\n<\/ul>\n
Obviously, the questions you field will be largely dependent upon your organization. If you\u2019re in the healthcare sector, you may be asked how GDPR affects HIPAA compliance<\/a>. Likewise, the financial sector may have to explain how the GDPR meshes with various financial regulations. Only you will be able to identify the key questions your company or organization will need to answer.<\/p>\n
Create a customer service cheat sheet<\/h2>\n
The nice part about the questions we just discussed is that you can go ahead and refine your answers ahead of time and then just list them on a cheat sheet. While I\u2019m hesitant to load the one we will be using (after all, it\u2019s a proprietary document) I can suggest just creating a simple two column table in Word (or whatever word processing program you use) and then putting the questions down the left side and the answers down the right.<\/p>\n
This way, your customer service department won\u2019t be asked to think on their feet about a topic they likely aren\u2019t all that familiar with. Instead, they can just give a bottled answer and satisfy the question. This will also be a good way for your customer support team to familiarize themselves with the new regulation, as the document will contain the majority of the information they need to understand it.<\/p>\n
Create supplemental content for your customer service team to reference<\/h2>\n
Don\u2019t just stop at a cheat sheet, go ahead and toss a couple of pages or a PDF on your website so your customer service team can point customers to them. Oftentimes this can save you an entire conversation. You may want to have a specific page that is dedicated to your GDPR efforts. It may also be beneficial to build one for Privacy Shield and one for data rights, too. That way when a customer requests information on a policy, you can easily just send them a URL or a PDF and provide them with the resource they\u2019re looking for.<\/p>\n
While writing GDPR content is another topic entirely, try to at least remember to make yours friendly. And by that I mean write clearly, avoiding technical jargon and acronyms, so that customers can read it once and feel like they have a good sense of your data practices. People notoriously don\u2019t read privacy policies or terms of service because the are long dense and boring. So don\u2019t make these pages feel like that. After all, you\u2019re trying to build trust and nothing builds it quicker than being straightforward and easy to understand.<\/p>\n
![\"GDPR\"](\"https:\/\/www.thesslstore.com\/blog\/wp-content\/uploads\/2018\/05\/bigstock-Gdpr-Line-Icons-Set-On-White-B-240508939.jpg\")
<\/p>\nThese last two topics also deal with compliance, which makes them especially important.<\/p>\n
Train your customer service team to escalate certain requests<\/h2>\n
There are two scenarios where you may want your customer service team to escalate a call. The first has to do with a customer exercising their data rights. We\u2019ll refer to this as a data request. The GDPR gives customers a lot of control over their data. They are allowed to get a copy of what you have collected about them, they can choose to modify it or the Right to be Forgotten means they can even ask you to delete it entirely. Unless you plan on training you customer support team to handle data requests themselves (which is ill-advised), they\u2019re going to need to escalate the call to some one who can.<\/p>\n
![\"Customer](\"https:\/\/www.thesslstore.com\/blog\/wp-content\/uploads\/2018\/05\/bigstock-Woman-Screaming-On-Telephone-C-17814479-300x200.jpg\")
I’d say this escalation went well.<\/figcaption><\/figure>\n The second, far less frequent scenario is that you\u2019re going to get the occasional caller that is asking deeper questions than your customer support team can comfortably handle. A lot of times these are just extremely judicious customers, but it\u2019s also possible that come Friday (May 25, when the GDPR becomes enforceable) there will be some unscrupulous types that will be probing for potential issues they can exploit. Either way, you don\u2019t want to give your customer service team the opportunity to mis-speak or get something wrong. Again, this is not meant as a slight towards customer support reps \u2013 they are the backbone of many companies \u2013 it\u2019s just a matter of GDPR not being a familiar topic.<\/p>\n
So, if questions are a little too specific, or beyond the knowledge of the customer service department – or you are dealing with a data request – you need to train your team to escalate the request. The hierarchy you put in place is up to you. You may want to put a manager up the next rung, provided they are more familiar, as a buffer. Regardless, at the top of the food chain should be your Data Protection Officer (or the employee that oversees your GDPR and Data Security efforts). You may choose to put any questions or requests in writing, in the form of a ticket, before passing it up the chain, but the GDPR requires you to have an accessible DPO in Europe, and while US companies aren\u2019t required to have a DPO, they still need someone to run point on data requests.<\/p>\n
Remember, you also have to list that person’s contact details on your privacy page. Just don\u2019t be fooled into thinking that listing it there will stop customers from dialing up support to get their questions answered though. It won’t. People are still going to call. So make sure your team knows which questions to field and when to say, \u201cLet me connect you with someone who can better answer that question.\u201d<\/p>\n
If you\u2019re recording the call, make sure you notify the caller<\/h2>\n
This is already considered a best practice, and while the GDPR is ambiguous in a number of areas\u2014this is one issue where it is not. It\u2019s quite clear that you need to notify a data subject anytime you collect data. I know right now you may be asking, \u201cbut this is a telephone, I thought the GDPR was for computers<\/em>.\u201d In reality, those are both wrong. The GDPR is about personal data. And yes, you may be collecting it on a telephone but you\u2019re likely entering it into a computer to look up and account or an order\u2014that\u2019s processing. So you definitely need to make certain notifications over the phone.<\/p>\n
![\"GDPR](\"https:\/\/www.thesslstore.com\/blog\/wp-content\/uploads\/2018\/05\/bigstock-207676075-300x200.jpg\")
“By the way, I’been recordin’ ya the whole time.”<\/figcaption><\/figure>\n Now, I don\u2019t think you need to be as granular as you would be on a website. There are certain implications with phone calls. For instance, if someone calls about an order, there\u2019s no need to say, \u201cI will use your name to look up your account.\u201d Simply requesting the name serves as notification enough, the user can easily imply that it\u2019s going to be used to look up his order.<\/p>\n
However, you can make no such case for recording someone. And here\u2019s the other thing, unless you\u2019ve got a legal basis for recording the calls (contractual, legal obligation, legitimate interests, etc.) you also need to get a caller\u2019s consent. Like I said, there are five alternative legal bases to use. But failing the other five, you have to get compliance to record calls. Obviously, in this case a pre-recorded message played at the start of the call is no longer sufficient unless it provides an option to consent or decline. It will be important for you to not only train staff on making the notification, but you may also want to try and refine the notification, and the way it\u2019s pitched, to maximize positive outcomes.<\/p>\n
And one more time, while the need for consent may be debatable, the need for notification is not.<\/p>\n
A closing thought on preparing customer support for GDPR<\/h2>\n
The GDPR requires any company that does business with Europe to review and adjust its data policies. But for a great number of the companies and organizations affected, the bulk of their effort has been spent on websites and email.<\/p>\n
Don\u2019t forget about the people answering the phones and manning your live chat. They are public facing and will likely have some interaction with GDPR-related topics. It\u2019s not hard to schedule a quick meeting (or multiple ones if you can\u2019t leave the floor empty) just to go over the basics, show them some online content they can reference and provide them with a cheat sheet. It will go a long way.<\/p>\n
As always, leave any comments or questions below.<\/p>\n
Hashed Out GDPR Compliance Series:<\/h2>\n
- \n
- GDPR: Introduction to a Series<\/a><\/li>\n
- GDPR: How it affects the Domain Industry<\/a><\/li>\n
- GDPR: How it affects Web Hosts<\/a><\/li>\n
- GDPR: Problems for ICANN\/WHOIS?<\/a><\/li>\n
- GDPR: Complying with EU-US Privacy Shield<\/a><\/li>\n
- GDPR: What is a Data Protection Officer?<\/a><\/li>\n
- GDPR: Best Practices for Privacy Notices<\/a><\/li>\n
- GDPR: What you need to know about Cookies<\/a><\/li>\n
- GDPR: What is the Right to be Forgotten?<\/a><\/li>\n
- GDPR: How to perform a Data Audit<\/a><\/li>\n
- GDPR: Encryption Best Practices<\/a><\/li>\n<\/ul>\n\n","protected":false},"excerpt":{"rendered":"
Your customer service team is going to get questions about GDPR. Make sure they know what to say. You can\u2019t spell GDPR without the PR, and that also holds true…<\/p>\n","protected":false},"author":6,"featured_media":6467,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"inline_featured_image":false,"footnotes":"","tve_updated_post":"","tve_custom_css":"","tve_user_custom_css":"","tve_globals":{},"tcb2_ready":0,"tcb_editor_enabled":0,"tve_landing_page":"","_tve_header":"","_tve_footer":""},"categories":[16],"tags":[5742],"class_list":["post-6465","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-hashing-out-cyber-security","tag-gdpr","post-with-tags"],"views":16735,"jetpack_featured_media_url":"https:\/\/www.thesslstore.com\/blog\/wp-content\/uploads\/2018\/05\/bigstock-Gdpr-general-Data-Protection-235058500.jpg","_links":{"self":[{"href":"https:\/\/www.thesslstore.com\/blog\/wp-json\/wp\/v2\/posts\/6465","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.thesslstore.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.thesslstore.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.thesslstore.com\/blog\/wp-json\/wp\/v2\/users\/6"}],"replies":[{"embeddable":true,"href":"https:\/\/www.thesslstore.com\/blog\/wp-json\/wp\/v2\/comments?post=6465"}],"version-history":[{"count":0,"href":"https:\/\/www.thesslstore.com\/blog\/wp-json\/wp\/v2\/posts\/6465\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.thesslstore.com\/blog\/wp-json\/wp\/v2\/media\/6467"}],"wp:attachment":[{"href":"https:\/\/www.thesslstore.com\/blog\/wp-json\/wp\/v2\/media?parent=6465"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.thesslstore.com\/blog\/wp-json\/wp\/v2\/categories?post=6465"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.thesslstore.com\/blog\/wp-json\/wp\/v2\/tags?post=6465"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}
- GDPR: How it affects the Domain Industry<\/a><\/li>\n
- GDPR: Introduction to a Series<\/a><\/li>\n