In the digital age, data privacy has become a critical concern for businesses of all sizes, and the European Union’s General Data Protection Regulation (GDPR) has emerged as a pivotal piece of legislation that aims to safeguard the personal information of individuals. For small businesses operating in the United Kingdom, compliance with GDPR is not only a legal requirement but also a strategic imperative that can bolster their reputation, strengthen customer trust, and protect them from potentially crippling fines.
This comprehensive guide will walk you through the key steps small businesses must take to achieve GDPR compliance, ensuring that your organisation is well-equipped to navigate the complexities of data protection and privacy regulations. By following this step-by-step approach, you can position your small business as a responsible, accountable, and forward-thinking entity, ultimately gaining a competitive edge in the marketplace.
Key Takeaways
- GDPR applies to all businesses that process personal data of EU residents, regardless of their size or location.
- Compliance with GDPR can provide small businesses with a competitive advantage through improved data management and enhanced customer trust.
- Non-compliance with GDPR can result in hefty fines of up to £17 million or 4% of global annual revenue, posing a significant risk for small businesses.
- Understanding data subject rights, such as the right to access, correct, erase, and portability of personal data, is crucial for GDPR compliance.
- Investing in GDPR training and expertise can help small businesses navigate the complexities of the regulation and mitigate the risk of non-compliance.
What is GDPR and Does it Apply to Small Businesses?
The General Data Protection Regulation (GDPR) is a set of data protection and privacy rules that govern how companies and organisations collect, handle, and safeguard personal data. Originally introduced by the European Union (EU) in 2018, the GDPR has since been incorporated into UK law as the UK GDPR, even after the country’s exit from the EU.
Contrary to common misconceptions, the UK GDPR applies to businesses of all sizes, including small enterprises. Regardless of the number of employees, any organisation that processes personal data must comply with the regulation’s requirements. This includes maintaining appropriate data protection policies, securing personal information, and upholding the rights of individuals over their data.
Understanding the Impact of UK GDPR
The UK GDPR has a significant impact on small businesses that handle personal data, such as customer or employee information. These organisations must understand and adhere to the regulation’s core principles, including lawful, fair, and transparent data processing, purpose limitation, data minimisation, and storage limitation.
Additionally, small businesses in the UK must be prepared to respond to data subject requests, such as providing individuals with access to their personal data or allowing them to object to certain processing activities. Failure to comply with the UK GDPR can result in hefty fines and reputational damage, making it crucial for small enterprises to prioritise data protection and privacy.
Does GDPR Still Apply After Brexit?
Despite the UK’s departure from the European Union, the GDPR provisions have been incorporated into UK law as the UK GDPR. This means that businesses operating in the UK must still comply with the regulation’s requirements, even in a post-Brexit environment. The UK GDPR continues to apply to any organisation that processes personal data, including small businesses within the United Kingdom.
In summary, the GDPR, now known as the UK GDPR, is a critical data protection regulation that affects companies of all sizes, including small enterprises. Regardless of Brexit, small businesses in the UK must understand and adhere to the UK GDPR’s requirements to avoid penalties and safeguard the personal data they handle.
Complying with UK GDPR: Key Steps for Small Businesses
As a small business owner, navigating the complexities of GDPR compliance can be a daunting task. However, with a strategic approach, you can ensure your organisation meets the necessary requirements and safeguards the personal data of your customers and employees. Here are the key steps small businesses should take to comply with the UK’s data protection regulations.
For Established Businesses
For small businesses that have been operating for some time, the focus should be on reviewing and amending existing data entry forms, policies, and procedures. Ensure transparency in data collection by clearly informing individuals about how their personal data will be used. Demonstrate the necessity of the personal data you process and have the right security measures in place to protect it. Additionally, establish robust processes to handle data subject requests, such as providing individuals with copies of their personal data or deleting it upon request.
For New Businesses
For small businesses that are just starting out, it is crucial to plan for GDPR compliance from the very beginning. Integrate data protection methods and policies into your business model, making it easier to comply with the regulations from the outset. Review your data processing activities, ensure you have a lawful basis for collecting personal data, and implement the necessary security and transparency measures right from the start.
Regardless of whether your small business is established or new, compliance with the UK GDPR is essential. By following these key steps, you can demonstrate your commitment to protecting the personal data of your customers and employees, while also avoiding potential fines and reputational damage.
The Eight Rights for Individuals Under UK GDPR
The UK General Data Protection Regulation (GDPR) outlines eight fundamental rights for individuals, known as data subjects, regarding their personal data. Small businesses must ensure they uphold these rights and have the necessary processes in place to respond to data subject requests. Let’s explore these key rights in detail:
- The Right to be Informed – Businesses must provide specific privacy information, such as details about the organisation, purposes for processing personal data, data sharing, retention periods, and available rights.
- The Right of Access – Individuals can request and receive a copy of their personal data, known as a Subject Access Request (SAR), which businesses must respond to within one month unless specific circumstances apply.
- The Right to Rectification – Individuals have the right to have inaccurate or incomplete personal data corrected within one month of receiving a request.
- The Right to Erasure (Right to be Forgotten) – Individuals can request the deletion of their personal data under certain conditions, with businesses required to respond within one month or two months in complex cases.
- The Right to Restrict Processing – Individuals can request the limitation of the processing of their personal data under specified circumstances, with businesses having one month to respond.
- The Right to Data Portability – Individuals can receive a copy of their personal data for personal use or transmit it from one controller to another, applicable when processing is based on consent or contract and carried out automatically.
- The Right to Object – Individuals have the right to object to processing their personal data in certain situations, such as direct marketing purposes, with businesses needing to stop processing unless they can demonstrate compelling legitimate grounds.
- The Right Not to be Subject to Automated Decision-making – Individuals have the right not to be subject to decisions based solely on automated means or profiling, with businesses required to ask for consent if data processing is automated for evaluation purposes.
Upholding these GDPR individual rights and ensuring data subject rights are a crucial aspect of GDPR compliance for small businesses in the UK.
“Protecting the fundamental rights and freedoms of natural persons, and in particular their right to the protection of personal data, is a core value of the UK GDPR.”
Do Small Businesses Need to Hire Staff for GDPR Compliance?
The implementation of the UK General Data Protection Regulation (UK GDPR) has raised questions among small businesses about the need for dedicated staff to ensure compliance. While the GDPR does mandate the appointment of a Data Protection Officer (DPO) for certain organizations, this requirement may not apply to most small businesses.
The Role of a Data Protection Officer
According to the UK GDPR, businesses are required to appoint a DPO if they engage in large-scale, systematic monitoring of individuals or process significant amounts of sensitive personal data, such as in the healthcare, insurance, and financial services sectors. However, small businesses with limited data processing activities may not be obligated to have a dedicated DPO.
Nonetheless, small businesses may still find it beneficial to assign one or more staff members to oversee data-related obligations and GDPR compliance. These GDPR compliance staff would be responsible for ensuring the organization’s adherence to data protection regulations, including monitoring compliance, advising on data protection impact assessments, and serving as a point of contact for the Information Commissioner’s Office (ICO).
The GDPR responsibilities of these staff members may include providing employee training, maintaining data processing records, and implementing appropriate security measures to protect personal data. By allocating these tasks to designated personnel, small businesses can demonstrate their commitment to GDPR compliance and safeguard the rights of their customers and employees.
| Sector | Need for a Data Protection Officer |
|---|---|
| E-commerce, Online Advertising, Market Research | Mandatory if core activities involve large-scale, systematic monitoring of individuals |
| Healthcare, Insurance, Financial Services | Mandatory if processing significant amounts of sensitive personal data |
| Small Businesses with Limited Data Processing | Not mandatory, but may still benefit from assigning GDPR compliance staff |
By understanding the GDPR requirements and the potential benefits of having dedicated staff for data protection, small businesses can develop a strategic approach to ensuring compliance and safeguarding the personal information of their stakeholders.
Defining GDPR Compliance and Its Goals
GDPR compliance refers to an organisation meeting the requirements for properly handling personal data as set out in the UK General Data Protection Regulation (UK GDPR). This includes adhering to the seven key principles of the GDPR: lawfulness, fairness and transparency; purpose limitation; data minimisation; accuracy; storage limitation; integrity and confidentiality; and accountability.
The primary goals of GDPR compliance are to establish and protect the fundamental privacy rights of individuals, unify privacy laws across the UK, and adapt privacy regulations to reflect changes in technology and data processing. Failure to comply with GDPR can result in significant financial penalties, with the maximum fine reaching up to 4% of an organisation’s global annual turnover or £20 million, whichever is higher.
GDPR compliance is crucial for small businesses, as data breaches can lead to damage to reputation, loss of customers, legal challenges, and regulatory investigations. Personal data under GDPR includes information such as name, address, email, phone number, and IP address, as well as sensitive personal data like health information, sexual orientation, and religious beliefs.
| GDPR Compliance Goal | Description |
|---|---|
| Protect individual privacy rights | GDPR aims to safeguard the fundamental rights and freedoms of individuals, particularly the right to privacy and the protection of personal data. |
| Unify data protection laws | GDPR establishes a consistent set of data protection rules across the UK, replacing the patchwork of national laws that previously existed. |
| Adapt to technological changes | GDPR is designed to adapt to the rapid advancements in technology and evolving data processing practices, ensuring data protection keeps pace with innovation. |
Key GDPR Terminology for Small Businesses
As small businesses navigate the complexities of the General Data Protection Regulation (GDPR), understanding key terminology is crucial. GDPR aims to strengthen data privacy and protection for individuals, and small firms must familiarise themselves with these important terms.
Data subject: Any person whose personal data is collected, held or processed. This includes customers, employees, and other individuals whose information is handled by the business.
Data controller: The entity responsible for determining the purpose and legal basis for processing personal data. Small businesses that collect and use personal data are typically data controllers.
Data processor: The individual or organisation responsible for processing personal data on behalf of the controller. This could be an external service provider or third-party vendor.
Processing: Any operation performed on personal data, such as collection, recording, organisation, structuring, storage, adaptation, retrieval, use, disclosure, and erasure.
Personal data: Any information that can directly or indirectly identify a natural person, such as a name, email address, IP address, or location data.
| GDPR Terminology | Definition |
|---|---|
| Data Subject | Any person whose personal data is collected, held or processed |
| Data Controller | The entity responsible for determining the purpose and legal basis for processing personal data |
| Data Processor | The individual or organisation responsible for processing personal data on behalf of the controller |
| Processing | Any operation performed on personal data, such as collection, recording, organisation, structuring, storage, adaptation, retrieval, use, disclosure, and erasure |
| Personal Data | Any information that can directly or indirectly identify a natural person, such as a name, email address, IP address, or location data |
By understanding these key GDPR terms, small businesses can ensure they are compliant with the regulation and protect the personal data of their customers, employees, and other stakeholders.
Determining if GDPR Applies to Your Small Business
As a small business owner, it’s crucial to understand whether the UK General Data Protection Regulation (GDPR) applies to your organisation. The GDPR has a broad territorial scope and material scope, which means it can impact businesses of all sizes, even those based outside the UK.
The Material Scope of GDPR
The material scope of the GDPR covers any automated or manual processing of personal data, regardless of the size of your business. Personal data includes information that can identify an individual, such as names, email addresses, and customer or employee records. If your small business handles any kind of personal data, the GDPR’s requirements for data processing are likely to apply.
The Territorial Scope of GDPR
The territorial scope of the GDPR extends beyond the UK’s borders. The regulation applies to any organisation, even those based outside the UK, that processes personal data of individuals located in the UK. This includes businesses that offer goods or services to UK residents or monitor the behaviour of UK-based individuals.
Even if your small business is not physically located in the UK, the GDPR’s extraterritorial application means you may still need to comply with its requirements if you handle the personal data of UK citizens. This is an important consideration for non-UK businesses that operate internationally or have UK-based customers or clients.
| GDPR Applicability Criteria | Explanation |
|---|---|
| Material Scope | GDPR applies to any automated or manual processing of personal data, regardless of business size. |
| Territorial Scope | GDPR applies to organisations, even outside the UK, that process personal data of individuals located in the UK. |
| Extraterritorial Application | Non-UK businesses that offer goods/services to UK residents or monitor their behaviour must comply with GDPR. |
By understanding the material scope and territorial scope of the GDPR, small businesses can determine whether the regulation applies to their operations and take the necessary steps to ensure compliance.
Understanding Data Subject Rights Under GDPR
The UK’s General Data Protection Regulation (GDPR) empowers individuals with a set of fundamental rights over their personal data. As small businesses navigate the compliance landscape, it is crucial to understand and uphold these data subject rights. These include the right to be informed, the right of access, the right to rectification, the right to erasure, the right to restrict processing, the right to data portability, the right to object, and the rights in relation to automated decision-making and profiling.
Businesses under the scope of the GDPR must provide transparent privacy policies that specify the legal basis for processing personal information and implement technical and organisational measures to secure data. Non-compliance can result in hefty fines of up to £17.5 million or 4% of a company’s global annual turnover, whichever is higher.
Key Data Subject Rights
- The right to be informed: Individuals have the right to know how their personal data is being used.
- The right of access: Individuals can request a copy of their personal data held by an organisation.
- The right to rectification: Individuals can request the correction of inaccurate or incomplete personal data.
- The right to erasure: Also known as the “right to be forgotten”, individuals can request the deletion of their personal data.
- The right to restrict processing: Individuals can request the limitation of how their personal data is used.
- The right to data portability: Individuals can obtain and reuse their personal data for their own purposes.
- The right to object: Individuals can object to certain types of processing, such as direct marketing.
- Rights in relation to automated decision-making and profiling: Individuals have the right to not be subject to solely automated decision-making, including profiling.
Small businesses must ensure they have the necessary processes in place to uphold these rights and respond to data subject requests in a timely manner. By respecting individual privacy rights and maintaining GDPR compliance, businesses can enhance customer trust and protect themselves from potential fines.
| Data Subject Right | Description |
|---|---|
| The right to be informed | Individuals have the right to know how their personal data is being used. |
| The right of access | Individuals can request a copy of their personal data held by an organisation. |
| The right to rectification | Individuals can request the correction of inaccurate or incomplete personal data. |
| The right to erasure | Also known as the “right to be forgotten”, individuals can request the deletion of their personal data. |
| The right to restrict processing | Individuals can request the limitation of how their personal data is used. |
| The right to data portability | Individuals can obtain and reuse their personal data for their own purposes. |
| The right to object | Individuals can object to certain types of processing, such as direct marketing. |
| Rights in relation to automated decision-making and profiling | Individuals have the right to not be subject to solely automated decision-making, including profiling. |
By understanding and upholding these data subject rights, small businesses can demonstrate their commitment to individual privacy and build trust with their customers. Compliance with the GDPR is not optional, and small businesses must prioritise this to avoid potential fines and reputational damage.
GDPR Compliance for Small Businesses
The General Data Protection Regulation (GDPR) is a crucial set of data privacy and security requirements that all businesses in the United Kingdom, including small enterprises, must adhere to. Achieving GDPR compliance is essential for safeguarding personal information and maintaining the trust of your customers, clients, and employees.
As a small business owner, you must take proactive steps to ensure your organisation complies with GDPR standards. This includes auditing the personal data you collect and process, ensuring you have a lawful basis for data usage, and being transparent about how you handle individuals’ information.
- Conduct a thorough audit of the personal data your business collects and processes, including staff, customer, and client information.
- Identify the lawful basis for collecting and using each type of personal data, such as consent, contract, legal obligation, or legitimate interests.
- Review and update your data entry forms to ensure they are GDPR-compliant, providing clear information about data usage and obtaining explicit consent.
- Implement appropriate security measures to protect personal data, such as encryption, access controls, and regular backups.
- Establish processes to handle data subject rights requests, such as the right to access, rectify, erase, or export their personal information.
By taking these proactive steps, you can demonstrate your commitment to GDPR compliance, safeguard your business from potential fines and reputational damage, and build trust with your stakeholders.
“GDPR compliance is not just a legal requirement, but a strategic opportunity to enhance your small business’s data protection practices and strengthen customer relationships.”
Remember, even small businesses that handle a relatively small volume of personal data must still adhere to the same GDPR requirements as larger organisations. Investing in the right expertise and training can help you navigate the complexities of data protection best practices and ensure your business remains compliant with UK GDPR regulations.
Auditing Personal Data and Ensuring Lawful Basis
As a small business, it is crucial to conduct a thorough GDPR data audit to understand the personal data you collect and process. This process involves examining the types of data, the purposes for which it is used, and ensuring you have a lawful basis for each data processing activity.
Types of Lawful Basis for Data Processing
The UK GDPR defines six lawful bases for processing personal data:
- Consent: The individual has given clear consent for you to process their personal data for a specific purpose.
- Contract: The processing is necessary for a contract you have with the individual, or because they have asked you to take specific steps before entering into a contract.
- Legal Obligation: The processing is necessary for you to comply with the law (not including contractual obligations).
- Vital Interests: The processing is necessary to protect someone’s life.
- Public Task: The processing is necessary for you to perform a task in the public interest or for your official functions, and the task or function has a clear basis in law.
- Legitimate Interests: The processing is necessary for your legitimate interests or the legitimate interests of a third party, unless there is a good reason to protect the individual’s personal data which overrides those legitimate interests.
As a small business, it is essential to determine which lawful basis applies to your specific GDPR compliance activities and be able to demonstrate compliance.
Ensuring Transparency and Consent in Data Collection
In the era of the General Data Protection Regulation (GDPR), small businesses must prioritise transparency and clear consent when collecting personal data from individuals. This is a crucial aspect of GDPR compliance, as it empowers customers and upholds their fundamental rights over their own information.
Structuring GDPR-Compliant Data Entry Forms
One of the key ways to ensure transparency and consent is through the design of GDPR-compliant data entry forms. These forms should be structured in a way that makes the purpose of data collection explicit and obtains unambiguous consent from the user. Some best practices include:
- Using clear, concise language to explain how the data will be used and stored
- Providing opt-in checkboxes or signatures rather than pre-ticked consent boxes
- Allowing users to easily withdraw their consent at any time
- Maintaining an audit trail to demonstrate when and how consent was given
Adhering to these principles not only upholds GDPR consent requirements, but also builds trust and transparency with customers – a key factor in successful data collection transparency. By investing in GDPR-compliant forms, small businesses can safeguard their operations and avoid potentially crippling fines for non-compliance.
“Transparency is key to building trust with customers in the digital age. GDPR has placed the burden of proof on businesses to demonstrate how they are protecting personal data.”
Upholding Individual Rights Over Personal Data
As a small business, it is crucial to ensure you have the necessary procedures in place to uphold the eight fundamental data subject rights under the UK General Data Protection Regulation (GDPR). This includes respecting individuals’ rights to access, rectify, erase, restrict, and port their personal data, as well as the right to object to the processing of their information.
Compliance with these data subject rights is essential, as the Information Commissioner’s Office (ICO) has the power to impose significant penalties of up to £17 million (20 million Euro) or 4% of global turnover on businesses that fail to meet these GDPR requirements. The ICO has also launched a self-assessment checklist to help sole traders and small businesses assess their level of data protection law compliance.
To uphold individual rights over personal data, small businesses must be able to respond to data subject requests in a timely and compliant manner. This includes having robust processes in place to verify the identity of individuals making requests, as well as the ability to locate, retrieve, and, where necessary, modify or delete the relevant personal data.
| GDPR Individual Rights | Description |
|---|---|
| Right of Access | Individuals have the right to obtain confirmation that their personal data is being processed, as well as access to the data and other information, such as the purpose of the processing, the categories of personal data concerned, and the recipients of the data. |
| Right to Rectification | Individuals have the right to have inaccurate personal data rectified or completed if it is incomplete. |
| Right to Erasure | Individuals have the right to have their personal data erased in certain circumstances, such as when the data is no longer necessary for the purpose it was collected for. |
| Right to Restrict Processing | Individuals have the right to restrict the processing of their personal data in certain circumstances, such as when they contest the accuracy of the data. |
| Right to Data Portability | Individuals have the right to receive their personal data in a structured, commonly used, and machine-readable format, and to have it transmitted to another data controller. |
| Right to Object | Individuals have the right to object to the processing of their personal data in certain circumstances, such as for direct marketing purposes. |
| Rights in Relation to Automated Decision-Making and Profiling | Individuals have the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning them or similarly significantly affects them. |
By implementing GDPR-compliant processes and procedures to uphold these individual rights, small businesses can demonstrate their commitment to protecting the personal data of their customers, employees, and other stakeholders, while also reducing the risk of potential regulatory action and reputational damage.
GDPR Compliance Terminology for Small Businesses
As small businesses in the United Kingdom navigate the complexities of the General Data Protection Regulation (GDPR), it’s essential to familiarise themselves with the key terminology and concepts underpinning data protection. Understanding these GDPR-related terms can help small firms ensure their processes and practices align with the legislation’s requirements.
One crucial aspect is data protection by design and by default, which obliges businesses to implement appropriate technical and organisational measures to protect personal data throughout its lifecycle. This includes data mapping and maintaining a processing register to document all data processing activities.
Additionally, small businesses may need to conduct data protection impact assessments (DPIAs) for operations that pose a high risk to individuals’ rights and freedoms. Proper consent management is also paramount, ensuring that customers and clients have given their unambiguous, freely given, specific, informed and unambiguous permission for data processing.
| GDPR Terminology | Definition |
|---|---|
| Data protection by design and by default | The principle of implementing appropriate technical and organisational measures to protect personal data |
| Data mapping | The process of documenting and visualising an organisation’s data flows and data processing activities |
| Processing register | A detailed record of an organisation’s data processing activities |
| Data protection impact assessments (DPIAs) | An analysis of the risks posed by data processing operations and the measures to mitigate those risks |
| Consent management | The process of obtaining, recording, and managing individuals’ consent for data processing |
Small businesses must also be prepared to handle incident reporting and breach management in the event of a data security breach. Furthermore, organisations engaged in cross-border data transfers will need to ensure they comply with GDPR’s requirements for international data flows.
By familiarising themselves with these key GDPR terminology and concepts, small businesses in the UK can take proactive steps towards achieving and maintaining compliance with the data protection regulation.
Investing in GDPR Training and Expertise
Maintaining GDPR compliance is a crucial priority for small businesses in the United Kingdom. To ensure they stay compliant, it is vital for these organisations to invest in GDPR training and access data protection expertise. This can involve designating one or more staff members to oversee data-related obligations and ensuring they are properly trained on the different aspects of the UK GDPR.
Alternatively, small businesses may choose to seek external support, such as consulting with legal or data protection professionals, to help them navigate the complexities of GDPR compliance. This can be particularly beneficial for companies that lack in-house expertise or resources to dedicate to managing GDPR requirements on their own.
Investing in GDPR training and expertise can lead to a range of benefits for small businesses. It can help them gain insights into their existing data through creating a comprehensive data processing register, demonstrating transparency in data collection and processing, and enhancing the security of personal data in line with GDPR requirements.
- Most companies today struggle with maintaining a register of data processing, making it challenging to answer essential questions about their data, storage, and sharing practices.
- Investing in GDPR compliance can lead to benefits such as gaining insights into existing data through creating a data processing register.
- Demonstrating transparency in data collection and processing can result in increased customer trust and confidence in a company’s practices.
- Minimizing the amount of data collected can lead to more efficient business processes and reduced costs associated with data storage.
- Enhancing the security of personal data in line with GDPR requirements can help in reducing the number of data breaches, benefiting a business in terms of costs and reputation.
Ultimately, small businesses that prioritise GDPR training and expertise will be better equipped to navigate the complexities of the regulation and ensure they maintain compliance. This can help them avoid the significant penalties and reputational damage that can result from GDPR violations, such as the £27 million fine issued to TikTok by the Information Commissioner’s Office (ICO) for breaking GDPR laws between 2018 and 2020.
“GDPR applies to all businesses in the UK, regardless of size, and the regulation must be complied with for data protection.”
By investing in the necessary GDPR training and expertise, small businesses can demonstrate their commitment to data protection, build trust with their customers, and position themselves for long-term success in the digital landscape.
Conclusion
In conclusion, this article has provided a comprehensive guide to help small businesses in the UK achieve GDPR compliance. By understanding the impact of the UK GDPR, the key steps for compliance, and the rights of individuals under the regulation, small businesses can take the necessary actions to protect personal data and avoid the potential consequences of non-compliance.
The article emphasises the importance of regularly reviewing and updating GDPR practices, as the data protection landscape continues to evolve. Small businesses should also invest in GDPR training and seek expert guidance to ensure they remain compliant and can reap the benefits of increased customer trust, improved efficiency, and a competitive edge in the market.
Ultimately, GDPR compliance is not only a legal requirement for small businesses, but also a means to demonstrate their commitment to data protection and respect for individual privacy. By following the steps outlined in this guide, small businesses in the UK can safeguard their operations, build stronger customer relationships, and contribute to the overall culture of data protection in the country.