Elementary GDPR for WordPress Site Owners

The GDPR (General Data Protection Regulation) went into effect on May 25, 2018. Even if you are not selling or marketing to EU customers directly, this is still very important for website owners. And it is very much a moving target – you’ll see conflicting information, very little in the way of direction, and this is unlikely to change until the new rules are actually tested in court. It’s frustrating, but I’ll try to share the basics of what I’ve learned here.

Note: I am not an attorney and this is not legal advice; it’s recommended that you contact your attorney to review your privacy policy, terms of service, opt-in forms and other aspects of use that involve personal data.

What’s it all about?

It’s about privacy, an overriding concern these days. It’s all about personal data – we have to all be good stewards of our customers’ personal information.

Some sites don’t store personal data, but if they do they have to comply with requests from EU users to remove that data and to share information about why the data is collected, how it’s used, and and how it’s stored.

I’m not in Europe – does this matter to me?

If you’re not selling anything, or focusing on EU users in your marketing, does it still affect you? Most likely. If you have a comment or contact form on your site that asks for name and email address, that’s personal data. If someone from the EU fills out your form, then GDPR applies. From Red Kite’s point of view, compliance is a good target for all website owners.

You may be collecting personal data through:

• User registrations
• Payments
• Comments
• Contact form requests
• Chats
• Plugins
• Analytics and traffic logs
• Security tools and plugins

This are serious penalties involved here too – fines can go up to 20 million Euros or 4% of total company annual earnings.

GDPR for WordPress Site Owners – How WordPress is Helping You

You’ll probably be relieved to hear that WordPress is taking this seriously, and as of release 4.9.6 has put some new tools in place right in the admin dashboard to assist you with compliance. These are:

• Under Tools, new features to make it easy for you to export or erase the data for a user by their username or email address.
• Under Settings, a new Privacy feature that lets you specify an existing privacy page or have WordPress create a default one (which you must edit) for you.

For more information, check out this helpful post by BlogAid on using the new WordPress GDPR tools.

Keep in mind…

Some key aspects about GDPR to consider (remember: I am not an attorney!).

• Breach notifications – if you have a security issue with your site, notify users with personal data storage within 72 hours. This means you need to be monitoring security with a plugin and/or a service like Sucuri. Security is going to become even more important!
• Data collection, processing and storage – a terms of service or privacy page should detail what data is collected, how it’s used, why it’s stored, and how it will be stored. You’ll also need to provide a copy of the data stored if a user requests it, and remove the data if requested (which will mean removing an account in most cases).
• How plugins on your site store data collected from users – this is a big issue, and a lot of plugin developers are working to make it easy to access/remove user data.

What should you do to make your WordPress site compliant?

Chat with your attorney about this, but these are steps to take that are likely common to most small business sites.

1. Look at all the different ways you’re collecting user data on your site.
2. Put mechanisms in place so users can control their data (make sure you’re asking for consent for forms, for example).
3. Avoid collecting user data when it’s not completely necessary.
4. Make sure your site’s plugins are also compliant. Site owners are ultimately responsible for the data collection and storage of plugins, so review your plugins carefully.
5. Make sure all newsletters, downloads, etc. are asking for consent/are opt-in instead of opt-out. Already-checked consent boxes are a breach of GDPR.
6. Consider a Cyber Liability insurance policy that protects against data breaches and other losses of personal data.

There is an excellent checklist in this post on these other considerations for compliance.

Is it likely that your small business site will ever be involved in a GDPR dispute? Hard to say, but it seems much more likely that the targets of such disputes will most likely be very large companies, at least in the beginning.

There will be more to come on this topic… GDPR is still in its early stages and evolving.

Some other references on GDPR:

GDPR: How it Affects WordPress Site Owners and Developers
GDPR Compliance Tools in WordPress
5 Actionable Steps to GDPR Compliance with Google Analytics
The Complete WordPress GDPR Guide
Worried About WordPress and the GDPR? Start Here
Ask Yoast: Preparing for the GDPR

Did you find this useful? Please share with your friends and colleagues!