GDPR Compliance in 4 Steps - Graphic Sector

Personal data in the graphic sector

As a graphic company, you work with client files every day. Many of those files contain personal data: address lists for mailings, personalisation for invoices, business cards with contact details, annual reports with employee photos.

On top of that, you have your own client and employee data. The GDPR definitely applies to you.

Step 1: Map your processing activities

Identify which personal data you process:

As a controller (your own data):

• Client data: contact persons, billing details, quote history
• Employee data: employment contracts, payslips, sick leave records
• Supplier data: contacts at paper suppliers, freelancers

As a processor (your clients’ data):

• Address lists for personalised mailings
• Files with personal data for printed materials (certificates, diplomas, badges)
• Photos and images featuring identifiable individuals

Step 2: Arrange your data processing agreements

If you process personal data on behalf of clients, you are a processor. You need a data processing agreement (DPA) with every client that provides personal data. The agreement covers:

• What data you process and why
• How you secure the data
• What you do with the data after the job
• How you handle data breaches

GDPRWise generates these agreements automatically.

Step 3: Secure your systems and files

Graphic companies work with large files that are often exchanged via FTP, WeTransfer, or email. Ensure:

• Secure file transfer - use encrypted connections
• Access control - not every employee needs access to every client file
• Deletion after delivery - establish a policy for deleting client files after the job
• Backup policy - backups containing personal data must also be purged after the retention period

Step 4: Document and maintain

Create your processing register, publish a privacy policy, and train your employees on handling personal data. Schedule an annual review to keep everything up to date.