It’s rare these days to find a publisher steering confidently toward the European Union’s new General Data Protection Regulation, a set of rules that curtails their ability to collect data on EU audiences and threatens heavy fines for infractions.

But Craig Newsome, head of ad ops and client services at Autotrader.co.uk is just such a rare make, a publisher executive who can comfortably say, “We feel pretty comfortable [about GDPR].”

“It’s been a good opportunity for us to review our data policies and our data partnerships. I think we’re quite far along the road,” Newsome said. So naturally, we asked him the steps he and his team have taken to make Autotrader UK comfortably compliant with the new rules.

First Gear: Assess your existing privacy policy

GDPR radically expands privacy regulations—and the EU’s ability to fine scofflaws—but it’s not coming out of left field. The new regulation makes major changes to the definition of personal data, extending it to include any information about online behavior. Most publishers already have guidelines for how they handle personal data, but according to Newsome,  it’s important for publishers to review those guidelines in light of this expanded definition of personal data.

“Publishers need to carefully review their privacy policy, consider how they’re going to operate their opt in and opt out mechanisms, and thoroughly understand how their data is currently stored and acquired,” said Newsome. “Look at that through the lens of GDPR.”

For publisher teams that aren’t steeped in policy, Newsome recommends joining working groups that have been formed by industry advocates, major platforms, or fellow publishers. Forums hosted by Google and the Association for Online Publishing helped the Autotrader team parse the legislation. Major consultancies have also staffed up around the issue and can be retained to provide guidance.

Second Gear: Vet your vendors, like yesterday

 The new rules dictate that publishers are responsible for the vendors that support their sites. Publishers whose partners harbor errant widgets and improper data storage are likely to be on the receiving end of an unpalatable fine. That means they need to police their partners, and soon.

“Since the start of 2017, we’ve been speaking to our partners, and many of them have invited us in to meet and discuss what they’re doing in relation to GDPR,” said Newsome. “These discussions are informing our road map. “

Those frequent check-ins have allowed Autotrader to assess its liabilities. But while partners like Google and The Media Trust were thinking ahead, others needed prodding to understand the legislation and its impact to digital operations.

“There’s going to be a crunch time towards the end of the year, which doesn’t leave publishers a great deal of time to get things organized.”

Third Gear: Rethink your approach to data

Data sits at the heart of most digital publishers’ offerings. For Autotrader, the new rules are the natural next step in the site’s relationship with users.

“This will be an evolution for us. We have a strong relationship and, hopefully, a good value exchange with our users, so we’ll be in a good position,” said Newsome. “Our ambitions around the data strategy remain the same: to provide real, meaningful insights to the customers and the most relevant experience for our users.”

Newsome is confident that Autotrader users will find the prospect of volunteering their data a small price to pay for the experience the site offers. Other publishers, he said, would be wise to consider if their product can say the same.

First Gear: Assess your existing privacy policy

GDPR radically expands privacy regulations—and the EU’s ability to fine scofflaws—but it’s not coming out of left field. The new regulation makes major changes to the definition of personal data, extending it to include any information about online behavior. Most publishers already have guidelines for how they handle personal data, but according to Newsome,  it’s important for publishers to review those guidelines in light of this expanded definition of personal data.

“Publishers need to carefully review their privacy policy, consider how they’re going to operate their opt in and opt out mechanisms, and thoroughly understand how their data is currently stored and acquired,” said Newsome. “Look at that through the lens of GDPR.”

For publisher teams that aren’t steeped in policy, Newsome recommends joining working groups that have been formed by industry advocates, major platforms, or fellow publishers. Forums hosted by Google and the Association for Online Publishing helped the Autotrader team parse the legislation. Major consultancies have also staffed up around the issue and can be retained to provide guidance.

Second Gear: Vet your vendors, like yesterday

 The new rules dictate that publishers are responsible for the vendors that support their sites. Publishers whose partners harbor errant widgets and improper data storage are likely to be on the receiving end of an unpalatable fine. That means they need to police their partners, and soon.

“Since the start of 2017, we’ve been speaking to our partners, and many of them have invited us in to meet and discuss what they’re doing in relation to GDPR,” said Newsome. “These discussions are informing our road map. “

Those frequent check-ins have allowed Autotrader to assess its liabilities. But while partners like Google and The Media Trust were thinking ahead, others needed prodding to understand the legislation and its impact to digital operations.

“There’s going to be a crunch time towards the end of the year, which doesn’t leave publishers a great deal of time to get things organized.”

Third Gear: Rethink your approach to data

Data sits at the heart of most digital publishers’ offerings. For Autotrader, the new rules are the natural next step in the site’s relationship with users.

“This will be an evolution for us. We have a strong relationship and, hopefully, a good value exchange with our users, so we’ll be in a good position,” said Newsome. “Our ambitions around the data strategy remain the same: to provide real, meaningful insights to the customers and the most relevant experience for our users.”

Newsome is confident that Autotrader users will find the prospect of volunteering their data a small price to pay for the experience the site offers. Other publishers, he said, would be wise to consider if their product can say the same.