EclectiC’s GDPR compliance strategy featured by DocuSign EMEA blog

EclectiC’s GDPR compliance strategy featured by DocuSign EMEA blog

Founded as an executive search company in 1992, EclectiC has become an international staffing company, focusing largely on senior IT and business professionals for project assignments and interim management roles.

Director of Operations and HR Stephanie Hain talked to us about how EclectiC is using DocuSign to enhance the company’s effort to comply with the GDPR ahead of the May 25^th enforceability date.

STEPHANIE, CAN YOU PROVIDE AN OVERVIEW OF ECLECTIC?

EclectiC International Consulting has been in the market for 25 years now. We provide IT staffing to corporate clients that are typically based in the Netherlands, with an international decision-making centre for IT hiring.

We have 180 consultants in the market, including our own and independent consultants too, which we can hire for clients’ projects. That means we have many contracts, assignment confirmations, NDAs and user allowances that need to be signed. Therefore, we handled a lot of paperwork before working with DocuSign. We’ve been a DocuSign customer for about four years now.

HOW DOES ECLECTIC APPROACH DATA PRIVACY AND SECURITY?

For us, it has always been a very important topic as we handle personal data. So, when the topic of data privacy and the GDPR came up a year or two ago, we thought about how we should address the regulatory objectives. It’s not just about how we gather data, but also how we share data with our clients. We, of course, do this with their permission, but we have to keep them updated.

Looking at EclectiC’s GDPR compliance story, we had to find a practical approach. I conducted an analysis of the business’ data storage and flows, including where the data goes and who is aware of that. I have developed procedures in case there is a data leak, or a hosting partner does not have the right security, or if a laptop goes missing, for example. We checked with all of our suppliers that we share employees’ data with and any third party we are working with to check if they are compliant with the GDPR.

The last bit we needed to take care of was the data transfer, which typically occurs when we introduce candidate CVs to our clients. We considered encrypted software and then I realised we already have the solution in place. We have DocuSign. The data is encrypted and safe and stored in a European data centre. Rather than receiving an email with an attachment, recipients receive a link to sign a document, and we can make sure it can’t be printed or rerouted.

In order to make sure everyone is aware of this, we created a cover letter to accompany CVs so that the recipient signs, confirming that it contains sensitive data that needs to be treated in compliance with the GDPR.

ARE YOU SEEING THE GDPR AS AN OPPORTUNITY TO RECONNECT WITH THE PEOPLE YOU SERVE, TO BE TRANSPARENT AND BUILD TRUST?

You need to make the story positive. It is a headache as you have to do a lot, and the biggest problem people face is knowing where to start; there is no given structure that you can just adapt. You have to start from scratch.

But on the plus side, you have a topic to talk about with the people you’re approaching. You can ask if they are aware of the company having their data and present yourself as a serious party. In our industry, data is crucial. We have a lot of players who all seem to do the same, but you can differentiate yourselves. This is an opportunity to build a reputation as a serious player and to make sure you do your best to protect personal data.

ARE YOU WORKING WITH INTERNAL TEAMS TO ADDRESS COMPLIANCE?

We don’t have a formal ‘GDPR team’, but rather a group consisting of the IT manager, the owner of the company and myself. We’ve formalised the process and documented it. I researched the regulation via reports and webinars specific to our industry and began the documentation. While doing that, I recognised the gaps we had and how to address them.

AS YOU’RE EVALUATING THE VENDORS YOU CURRENTLY WORK WITH AND WILL WORK WITH IN THE FUTURE, WHAT’S IMPORTANT TO YOU AND ECLECTIC?

For us, it’s important that vendors take a serious approach to data privacy. We want to make sure that data is protected. It’s unlikely we’ll be getting audited on the 26^thMay, but if we do, we will be able to demonstrate that the company is doing its best to protect the data it holds.

ARE THERE ANY SPECIFIC DOCUSIGN FEATURES THAT YOU’RE UTILISING TO DEMONSTRATE COMPLIANCE?

The Certificate of Completion is very important to us in providing an audit trail. In our case, this will include a cover letter that has been digitally signed by our data subjects to show that they understand how EclectiC will handle their data in line with the GDPR regulation.

WHAT ADVICE WOULD YOU GIVE TO ANYONE LOOKING TO IMPLEMENT DIGITAL TOOLS TO BECOME GDPR-COMPLIANT?

First of all, review the tools you have. We were evaluating complex software solutions, when in fact we had the solution already. There are very simple solutions out there without the need to implement expensive and complex solutions.

WHAT ARE THE NEXT STEPS FOR ECLECTIC AS WE APPROACH THE DEADLINE?

We need to finalise our policies and documentation and ensure our partners and suppliers have GDPR policies in place. We will also be running an internal workshop to make everyone aware of the regulation and the work we’ve done to be compliant, and show what the workflows will be in the future using DocuSign.

THANKS FOR SHARING YOUR INSIGHTS, STEPHANIE!

docusign.co.uk/blog/eclectic-gdpr-compliance-strategy/