GDPR: Treat EU as separate or roll out changes globally

[James_Gunn]

I'm interested to know how other companies who market and sell into the EU, as well as other regions of the world, are planning to roll out policies and procedures to support GDPR. My company has a UK business but our main presence is Australia and NZ. So my question is - Can we can box off our UK business and treat them as separate from a marketing perspective?

For example, have a UK specific, GDPR compliant privacy policy and double opt in on forms across our .co.uk site, plus all other requirements in order to be GDPR compliant. Or are we better off having a single global GDPR compliant approach for all customers and prospects whether they are in the EU or not?

As it's early on in our preparation for GDPR I'm still a little naive. Perhaps the complexities of separating out our UK marketing from the rest are too onerous. But I'm interested to hear what other people thing.

Thanks.

[SanfordWhiteman]

If you're asking whether people who sell both in and out of the EU are offering, say, the right to be forgotten for US customers  -- I have emphatically not seen anyone doing that, even if they're building the (mar)technical infrastructure to do it.

But perhaps I don't know what you mean by a global policy.

[James_Gunn]

Yes that is what I'm asking. Essentially, do we build out our (mar)technical infrastructure to apply to our global customer base, or just the UK.

From your answer it sounds like other organisations are implementing GDPR compliant procedures to apply to their EU audiences, but it's business as usual for the rest of the world - Correct? I thought this may become too difficult to manage in Marketo but encouraged to hear that may not be the case.

[SanfordWhiteman]

other organisations are implementing GDPR compliant procedures to apply to their EU audiences, but it's business as usual for the rest of the world - Correct?

Some organizations, for sure. Speaking here of 5 companies across a few verticals (finance, publishing).  I don't know who's done a wider study, but it would be interesting.

Bear in mind that marketing is still wild + unregulated in the US, as opposed even to our Northern neighbors. So while GDPR takes a praiseworthy (IMO) ethical stance, you're unlikely to find people self-regulating with GDPR as a guide. Using Canada's CASL as a baseline can be too much to bear 'round these parts.

[Anonymous]

Also, Australia has very strict anti-spam opt-in laws, so you should already have implemented that for them?!