How To Make Your WordPress Website GDPR Compliant?

25th May 2018 – An earthquake came into the internet industry and the reason behind that was GDPR. This was the date when GDPR was implemented by the EU (European Union) and it has given plenty of sleepless nights to the business owners around the globe.

Now, as you all know that, WordPress powers 31% of the website in the world and therefore, many WordPress Development Company have been affected by these strict rules & regulations.

Today, we’re going to provide you with an in-depth guide on what GDPR is, and how you can make your WordPress website GDPR compliant.

So, let’s get the things moving.

[Image Source: http://700billionreasons.com/wp-content/uploads/moving-things-miami-science-museum_160318.jpg ]

What Is GDPR?

GDPR is an acronym for General Data Protection Regulation. It’s a law of the EU (European Union) and its main aim is to protect the personal data (name, emails, physical address, IP address, health information, income, etc.) of common people and change data privacy approach of various organizations around the globe.

Basically, businesses that are not in compliance with GDPR’s requirements can face a fine up to 4% of the company’s annual revenue or €20 million, whichever is larger and that’s why everyone is worried about this situation.

There are mainly 8 rights that a user gets under GDPR and businesses need to know that if they want to make their websites GDPR compliant.

[A.] Right to Be Informed: A user has right to be informed about the collection & use of their data.

[B.] Right of Access: Users have right to obtain the access of their data from the organization (Data Controller) which is holding their data.

[C.] Right to Rectification: Users have right to rectify any incomplete or inaccurate personal data.

[D.] Right to Erasure: Users have the right to completely erase their personal data and also restrict the further collection in the future.

[E.] Right to Restrict: Under certain circumstances, the user can make a request for restricting or suppressing the processing of their personal data.

[F.] Right to Portability: A user has the right to obtain the personal data from a particular company & use it for their own purpose. They can also transmit that data to a different controller.

[G.] Right to Object: A user has the right to object on the usage of their personal data for any legal reason, direct marketing, and scientific or historical research purpose.

[H.] Right Not Be Subject To Automated Decision Making: Users have the right not to be subjected to automated decision-making when it produces adverse legal impact.

How Will GDPR Rules Impact Your Website?

• Personal & Sensitive Data Needs To Be Handled With Care

 

 

 Any standard WordPress website collect user’s data from user registration, comments, contact form entries or the analytics data. Now, under GDPR rules whenever you collect and hold any personal & sensitive data, clear & explicit consent from users is required. Without their permission, you should not collect or use any of their personal data.

 

• Pre-Tick Opt-In Boxes Are Not Allowed

 

[Image Source: https://www.kooomo.com/themes/267/new_kooomo_26JUL17/images/custom/GDPR-Subscribe.gif ]

 

Till now, many websites who were utilizing WordPress Development Services used pre-tick opt-in boxes to gather user’s data, but with GDPR in play, this tactic will not work anymore. The reason behind that is, it forces you to take permission for data that you collect and with a pre-tick opt-in box, this rule is violated. So, if you’re looking to use pre-tick opt-in boxes on your website, then make sure that user agrees to the use of their private data for a specific & clear purpose.

• Respond To User’s Request Related To Personal Data Is Mandatory

As a website owner, if you’ve collected the data from your user, then under GDPR, you should also be ready to respond to a user’s request related to personal data such as erasure or withdrawal of data. You will have 30 days time-period for giving the response and therefore, it becomes necessary to have an effective withdrawal mechanism in place for the WordPress website.

• Be Careful With Installing The Plugins

Any plugin or for that matter, the third-party software used by you on the website should be GDPR compliant. So, you should always be careful about this point while choosing a plugin or software. If you’re not sure about the GDPR compliance of the plugin or software, it’s better to not use in on the site. The reason we’re saying is that under GDPR rules any data collected by the plugin or third-party software comes under your responsibility.

• Need To Take Immediate Action For Any Data Breach

If your WordPress website is facing any kind of data breach, then you need to send a notification to your users within 72 hours after becoming aware of the situation. In this kind of scenario, not only the data collector (website owner) but also the data processor (any third-party tool) required to inform the users who are impacted by the data breach.

How To Make Your WordPress Website GDPR Complaint?

• Identifying The Personal Data That You’ve Gathered

The very first step to make your WordPress website GDPR complaint is to identify the personal data that you’ve gathered till now. In this process, you should find out the answers to the questions listed below:

• What kind of data is being processed by you? (i.e., name, email id, mobile number, date of birth, etc.) & Which category the data falls into?
• In which format you’re storing the data? (i.e., hard copy, digital database, etc.)
• How do you collect the data? (i.e., contact form, social media, telephone, etc.) & How do you share the data? (i.e., email, cloud, etc.)
• What are the locations involved in your data flow? (i.e., office, cloud, third-party, etc.)
• Who is accountable for the data?
• Who has access to all the data?

Answering all the above questions will make you aware of your data usage which makes it easy for you to make your site GDPR complaint.

• Remove All The Unnecessary Data

Effectively managing the personal data is your biggest challenge under GDPR rule and therefore, keeping less amount of personal data on the site will make your job easier. Always collect the personal data when you’ve got a purpose associated with it. Analyze the existing data and remove all the personal data which serves no meaning for your business. Last but not least is to keep all the personal information secure & only use it for a specific purpose.

• Always Keep The User Data Organized & Accessible

As a site owner, you should be prepared to respond to user’s requests of accessing or removing a particular data. For this purpose, you should keep your data in a structured manner, so it can be accessed in a short time-span. In addition to that, you should provide your user with the copy of their personal information within 30 days of the request.

• Inform Your Users About Their Data Usage

You should always notify your users about how their data are being used by you and for what purpose. For this purpose, you could send them the email regarding updated privacy policy. Make sure that the users are accepting the privacy rules, only after that you should use their personal data. Answer the following questions which will make everything clear about the data usage for you as well as your users:

• What data is being collected?
• Who is collecting the data?
• What is the purpose of collecting the data?
• How will you use the data?
• Who can access this data?
• What right will the user do have regarding the data?
• How can a user raise a query?

 

• Prepare A Plan For Data Breaches

You should devise a plan for how you’re going to handle any case of a data breach. This plan should include the processes to detect the data breach, ways to stop the data breach and how to prevent the further breaches. In addition to all these, you should also think about how you will inform the affected users within the 72 hours of a data breach.

• Build A Data Privacy Culture Within The Organization

GDPR is not an individual game; it’s a team game. Therefore, to make your site GDPR complaint, you should make all of your employees aware of all the rules & regulations. It’s essential that you work on building a privacy culture within the organization where each employee considers personal data as a valuable asset & integrate data transparency into their daily routine.

• Consider Appointing A DPO

 

[Image Source: https://cdn-images-1.medium.com/max/1440/1*5gdrSeZXYNoVWNJjRYDBmQ.jpeg ]

 

Finally, if your WordPress website is collecting and managing tons & tons of personal data, then you should seriously consider hiring a full-time DPO (Data Protection Officer). A DPO is someone who monitors all the privacy and data protection related activities and ensures that your site is GDPR compliant.

Wrapping Up Things…

The word ‘GDPR’ has become a synonym for fear, stress, and anxiety in the recent time for the business owners across the globe. There is so much uncertainty regarding this subject and that’s why it’s causing a lot of chaos among the common people.

To solve this confusion, we have tried to provide you with the various ways through which you can make your WordPress website GDPR complaint. We hope this solution works for you & your organization.

If you have any questions or suggestions regarding this subject, feel free to ask them in our comment section. Thank you.!