Small Business GDPR Requirements Differ from Large Business

Are small businesses required to keep the same records of compliance as large businesses?

Although Article 30 of the GDPR states that companies must “maintain a record” of their processing activities, the provision contains an exemption for small businesses. Specifically, it states that if a company employs “fewer than 250 persons,” it is generally not required to maintain a record of its processing activities. The exception does not apply, however, if one of three conditions is present:

• The small business carries out processing that “is likely to result in a risk to the rights and freedoms of data subjects,”

• The small business carries out processing that “is not occasional,” or

• The small business carries out processing that “includes special categories of data” or that involves “data relating to criminal convictions and offense.”

The small-business exception been interpreted very narrowly by the Article 29 Working Party. A small business of course maintains personal data concerning its employees. As that data is maintained throughout the employment relationship (and typically beyond) it is subject to systematic and periodic processing (e.g., to run payroll, collect and pay taxes on behalf of employees, evaluate performance, etc.). The Article 29 Working Party assumes that such processing cannot be characterized as “not occasional.” In order for processing to be considered “occasional,” it cannot be “carried out regularly” and it cannot be carried out within “the regular course of business or activity” of the company.  In such jurisdictions that so permit, employers often collect “data relating to criminal convictions” prior to offering an individual employment and periodically throughout the employment relationship. It is also common for an employer to hold some information about employees’ health. As a result, even if a company has fewer than 250 employees, it may still be subject to the same record keeping requirements as larger companies with respect to its human resource related data. 

Read more here...

Small Businesses Need to Know about GSA Professional Services Schedule PSS 99

The Professional Services Schedule is the second largest GSA Schedule after IT70.  It is the combination of 30 unique professional services many of which have few similarities to each other.  Therefore, the reality is the Professional Services Schedule or 00CORP in many ways is the combination of many niche services to form one large inter working grouping.
 
The purpose of combining all these services into one schedule was to reduce the administrative burden for firms that need access to more than one of these unique niches.  We learned that most small businesses utilize on average 3.78 niches or SINs and most large businesses utilize 4.88 SINs.  Consolidation makes sense for ease of access and simplicity of award.

Professional services tend to have high sales volumes even though many of the firms in this grouping are niche players and often smaller than the average federal contractor.  The average small business that holds the Professional Services Schedule conducts over $1MM per year in federal sales.

On PSS, all GSA contracts under $10,000 will be direct no bid awards. (Small Business only)
All contracts under $250,000 will be GSA Small Business Elite Direct Awards. (Small Business only). GSA will break out over $900 million in GSA Prime Vendor Contracts for re-distribution to GSA Small Business Schedule Holders in 2020.

In FY2017, GSA saved taxpayers over 10% of the dollar amount spent through the GSA. This increased efficiency and reduction of administrative burned resulted in $6.8B in savings. GSA enables 15,000 small businesses $1MM plus per year in direct federal contract awards. This means 37% of every dollar spent through the GSA schedule system are with small business —  the highest utilization of small business throughout the federal government.

Read more at: https://gsa.federalschedules.com/industries/gsa-professional-services-schedule-pss/

The GSA PSS Contract only covers the categories detailed below. Certain IT, HR, and energy related services can be offered through PSS, but only to complement the core service offerings.

• Mission Oriented Business Integrated Services (MOBIS) (formerly Schedule 874)
• Professional Engineering Services (PES) (formerly Schedule 871)
• Financial and Business Solutions (FABS) (formerly Schedule 520)
• Advertising and Integrated Marketing (AIMS) (formerly Schedule 541)
• Logistics Worldwide (LOGWORLD) (formerly Schedule 874 V)
• Environmental Services (formerly Schedule 899)
• Language Services (formerly Schedule 738 II)

Services including IT, HR, energy, travel, security, and healthcare staffing can be offered under different GSA Schedules.

Want a Better Way to Do Things? Start Fresh with Zero Based Design

Want to achieve radical changes in your business? Have you become distracted from long-term goals? Are you too busy putting out fires to look past short-term tactics? Perhaps it is time to consider a shake-up

Zero-based design (ZBD)encourages people to cast aside assumptions to expand the scope of discovery. It comes from the term “zero-based budgeting,” an accounting principle that implies every line item in a budget is to be reevaluated on an annual basis, under the assumption that nothing should be sacrosanct.

The name was first coined by Paul Polak and Mal Warwick in their 2013 book, The Business Solution to Poverty. The authors delineated their methodology for building a business from a frugal, grass-roots “Zero Point,” that grew to deliver economic value on a societal scale.

While ZBD has evolved since 2013, a few activities stay central to its approach:

• Defining the Zero Point: More than a fictitious “blank slate,” the Zero Point is the suite of capabilities, systems, and processes you would keep if you were to rebuild your business all over again.
• Designing the North Star: A clearly articulated and accepted description of the ideal target state is given for the business, its people, and their customers.

With ZBD, it is necessary that the North Star is visionary. It frames the ambition for business and informs the roadmap of labor required to succeed in this best target state. It helps to elevate the thinking within the business and stimulate the proper designing and activity within the short and medium term.

ZBD starts with an observation, then looks for the simplest and most likely explanation. As a result, it can appear foreign to those familiar with the traditional inductive or deductive thinking that permeates business management. It some ways, it resembles the Lean (Toyota) Method for problem-solving.

For example, ZBD practitioners tend to observe human behavior and distill the most likely insights from what they have witnessed. Abductive reasoning is a form of logical inference which starts with an observation or set of observations then seeks to find the simplest and most likely explanation for the observations, and the resulting insights, then inspire designers to generate game-changing ideas and then pose the question “how might we” rather than ask “why can’t we.” Such priming questions are crucial, as they foster the belief that innovative outcomes are achievable and that we can overcome obstacles that would otherwise be considered insurmountable.

Take the Middle Man Out of More Transactions

Uber and AirBnB are in the vanguard of the P2P marketplace model -- their gradual but ultimately huge success of is opening up breakout growth, heralding an explosion in startups with similar models: Taskrabbit, Fivver and others. Marketplace startups are unique because they aren’t just serving one base of customers. These enterprises connect buyers and sellers, service providers and consumers. Their models work when they ensure users are having a good experience with each other, as well as with the respective companies.

Can you tell I am a big fan of P2P exchange-based marketplaces? Companies like AirBnB and Uber have their detractors — some very legitimate: there are some serious issues around discrimination, harassment and worse that these companies have to continue to address. But they also continue to battle against unfair regulations. Laws need to catch up to this new model, not hinder growth and progress.

Obviously, there is growing interest in services like ride-sharing and short-term rentals, where demand is not easily met by traditional means due to capital investment constraints. These new enterprises are simply too big and popular to be pressured to shut down. Nor should they — each new generation reveals in a new world order with new economic realities. Robot cars (and more disruptive, robot trucks) are *ahem* around the corner. Even money (in the form of crypto-currencies, traditionally controlled by governments, is throwing off the shackles of authoritarian overreach.

Poor Writing Does Not Have to Be a Cost of Doing Business

This article captures a common problem faced by institutions on a daily basis:

Poor writing creates a drag on everything you do. It functions like a tax, sapping your profits, and I can quantify it. American workers spend 22 percent of their work time reading; higher compensated workers read more. According to my analysis, America is spending 6 percent of total wages on time wasted attempting to get meaning out of poorly written material. Every company, every manager, every professional pays this tax, which consumes $396 billion of our national income. That’s more than half of what we pay for Medicare—but the poor writing tax pays for nothing but waste.

Read more here...

When Your Service Provider Can Sink Your Business

This is an amazing (and sad) story -- a mid-sized business relies on its web hosting service provider for its web site. Typical, really. But they were also utilizing the hosting service for their entire back-office data -- CRM, accounting, payroll, and more.

Without an understanding of the ramifications -- perhaps lacking even a systems administrator, let alone a CIO -- the company was processing and storing all its data on its website. One day, a developer was optimizing the database and removing records that the business no longer needed (so he thought). But a single, poorly formed delete query wiped out the database table. This minor error in a SQL command deleted the sum of the company's data; the company was rocked to the core. In a few months, they went belly-up.

Lesson: choose a proper SAAS provider that can handle your data properly. Know what you want, what you are getting into, and what happens to your data.

Read more here... Death by Delete