Bots

7 Ways a Chatbot can boost GDPR Compliance

This blogpost looks at how bot technology can be applied to managing the customer engagement processes around GDPR.

Table of Contents

1. The GDPR Deadline has Passed!
2. GDPR Readiness is Not So Simple
3. Bots to the Rescue: Introducing GDPRBOT
4. How GDPRBOT can Help
5. The Features of GDPRBOT
6. Eight Requirements of GDPR: One Bot
7. A View on the Consent Requirement
8. Conclusion

The GDPR Deadline has Passed

The General Data Protection Regulation (GDPR), which came into effect across the EU on May 25th 2018, is the biggest change to data protection in the last 20 years. 

The regulation has significant implications for all businesses that offer goods and/or services to citizens of the European Union, even if the company is  not based in the EU.

Failure to comply resulting in fines that could  amount to €20m or 4% of global annual turnover for the preceding fiscal year – whichever is the greater!

GDPR is about giving customers more control over their personal data and how it is used. However, whilst the principal sounds simple, the act of implementations is not so. With customers now having more rights to view, amend, transfer and remove personal data and organizations required to make available, record and verify consent, the day to day compliance with GDPR is critical for organizations wishing to be seen as putting their customers first.

GDPR Readiness is Not So Simple

GDPR has significant impacts on the administrative, policy, and compliance processes and workflows that impact the gathering and use of personal data but, with the risk of hefty fines, there has been significant concern among businesses across the globe over the past year or so to implement plans in preparation for complying with the regulation. While it may appear to be an onerous task, implementing GDPR requirements gives businesses an opportunity to review current privacy policies, how individual’s data is managed, and make the necessary changes that future-proof their digital business.

Several surveys point to the fact that, despite the buzz and concern, many businesses are still not fully compliant with all aspects of the regulation. For example, according to a GDPR benchmarking survey conducted by Deloitte across a sample of organizations in EMEA, only 15% of organizations surveyed expected to be fully compliant by May 2018, with the majority instead targeting a risk-based, defensible position.

This indicates the degree of complexity in meeting all aspects of the regulatory requirements, for example, in the case of managing and tracking customer consent, which can have significant impact on outbound marketing efforts. And, in many cases, it probably points to some uncertainty as to how customers will exercise their rights under GDPR. For example, will users look to have their personal information erased, and if so how much traffic can an organisation expect and how can they plan the customer service resources and processes to handle such requests?

While the deadline for GDPR compliance has passed, the true implications will possibly emerge over the coming months as new compliance workflows are launched, tested, and adapted to meet the real demand from customers and other individuals. A recent pulse survey conducted by pwc indicated that some companies had only just begun GDPR preparations a few months prior to the deadline and are still at the assessment and operationalization phase, so there’s still a way to go for businesses to become fully compliant and streamline their processes around this new regulation.

How will the majority of businesses manage these new and changed compliance processes efficiently and accurately without escalation of costs? The Deloitte  survey indicated that 96% of respondents have, or are, investigating the use of tools to help with GDPR compliance. In pwc’s Pulse Survey, many respondents cited that they will be implementing technology in the coming year in order to remain compliant. More than half (56%) are considering AI as part of this technology investment.

This is where bot technology comes in to help automate workflows and respond to customer requests.

Bots to the Rescue: Introducing GDPRBOT

GDPRBOT can help. Deployed on your website, social channel, in a mobile app or via SMS or email within hours, the AI-powered ServisBOT provides a simple way to satisfy GDPR obligations.

By connecting into your CRM and/or marketing databases, GDPRBOT can provide individuals with a seamless experience to view, amend, confirm and remove their personal details for marketing purposes and without the cost, time delays or input errors associated with human processing. In addition, the GDPRBOT can maintain an electronic journal of all customer GDPR interactions including a double opt-in check for on-going consent.

Your GDPRBOT can be accessed by your customers directly through your website, app and even phone channel or distributed ‘on-demand’ by your service advisors via SMS and/or email.

How GDPRBOT can Help

How can GDPRBOT help to take the pain and cost out of the ongoing management of individual’s rights under GDPR? There are many ways in which the bot can help with different requirements but overall benefits of using the bot are:

1. It can simplify a complex subject by providing direct answers to customer questions without requiring customers to sift through pages of legal jargon
2. It can answer questions precisely without overwhelming individuals with too much information.
3. It can escalate queries to humans where needed. Some complex queries may require human interaction in which case the bot can transfer this over.
4. Workflows that handle GDPR requests can be automated, eliminating costly manual and human-intensive management of inbound requests.
5. Enable backend workflows to ensure obligations are met
6. GDPRBOT can be deployed quickly and cost effectively, and updated with ease.
7. Being AI-powered, the bot gains intelligence the more it is exposed to these processes, making it more intuitive and handling requests more effectively.

The Features of GDPRBOT

The bot can be designed to handle varying degrees of complexity in providing information, handling simple requests, automating workflows, and providing updates. The common capability of GDPRBOT includes:

• Providing  a clear and simple explanation about consumer rights under GDPR
• Allowing users to ask simple or detailed questions and get instant responses
• Verifying user identity, if required
• Letting users make requests with regard to changes in their data
• Notify other applications if an individual requests changes to data
• Automating the sharing of user-requested data via email, post, direct to screen etc.

GDPRBOT also doesn’t have to act alone. At ServisBOT we have an Army of Bots, including AI customer service bots, that can work in unison or alone to tackle specific tasks. To read more about some other ServisBOTS you can download a copy of our recent eBook: Transform Customer Engagement with an Army of Bots.

Eight Requirements of GDPR: One Bot

Here are eight requirements pertaining to the regulation where GDPRBOT can be implemented to automate workflows and handle requests.

• Right of Access. Individuals can directly access their personal data and view how their data is used after it has been gathered. GDPRBOT can handle these simple requests and provide this information to the individual.
• Right of Erasure. If consumers are no longer customers, or if they withdraw their consent from a company to use their personal data, then they have the right to have their data deleted. GDPRBOT is the simplest way to give previous and existing customers access to their data, visibility as to how it is used, and the capability to be forgotten if they choose.
• Right of Portability. Individuals can request a transfer of their data to an alternate service provider and in a machine readable format. Again, GRPRBOT can respond to this request and initiate the data portability process.
• Right to have Information Corrected. With GDPRBOT, individuals can easily update their own data if it is out of date or incorrect.
• Right to Restrict Processing. Likewise, the bot helps individuals view and amend how their data is processed. Their record can remain in place but not be used.
• Right to Object. Individuals themselves can stop the processing of their data for direct marketing with processing ceasing as soon as the request is received. The bot can handle this request and initiate the subsequent workflow in ceasing the processing of the data.
• Right to be Notified. If there has been a data breach which compromises an individual’s personal data, the individual can be informed via your GDPRBOT within the required 72 hours.
• Right to Complaint. Your customers have, without prejudice to any other administrative or judicial remedy, the right to lodge a complaint with a supervisory authority. By providing clear & seamless access to this process via GDPRBOT, organisations can monitor the volumes and types of complaints raised to continuously update their processes & procedures.

A View on the Consent Requirement

One of the challenging requirements in GDPR is around an individual’s consent to having their date processed, an area that greatly impacts how a business can engage with and market to their customers. Article 7 of the regulation outlines how a company will need to demonstrate that an individual has consented to the processing of their data. When seeking consent, an individual needs to be informed by the company, whereby they can either agree or decline. And once they have consented, they  also have the right to withdraw this consent at any stage.

While the matter of consent is a thorny issue,  it doesn’t have to be all bad news. As organizations get to grips with the ins and outs of GDPR they will quickly realise that consent doesn’t have to be an all or nothing decision for themselves and their customers and that it can be managed at a much more granular level and by channel.

 

In the above example, customers are presented with more detailed options around consent for individual channels. However, managing the diversity of options can be challenging for the organisation and confusing for the customer. With GDPRBOT, your communication options are laid out in an easy to access, read-and-amend format so you can remain engaged with your customers on their terms.

Conclusion

There’s good reason why there’s been some panic and buzz around the introduction of GDPR in the EU, but progressive companies will see this as an opportunity for their business to protect the privacy of customer and employee data especially in this era where digitalization has transformed how people share their information and interact across new channels. The good news is that some of these same digital technologies can be leveraged to help organizations adapt and operationalize their processes to become compliant. It’s not just a pesky regulation that has to be implemented – rather, it’s about how businesses can take a mindful approach to customer engagement and respect the interests of their stakeholders.

Download the info sheet on our GDPRBOT to learn more.