How to Make a WordPress Site GDPR Compliant
Table of Contents
One of the most complex aspects of creating a new website is GDPR compliance. What do you really need to comply with the European Regulation? Is a privacy policy enough, or do you need more?
This article will explain how to make a simple WordPress site compliant with the General Data Protection Regulation. Let’s begin!
Key Principles
- Lawfulness, Fairness, and Transparency – Data must be processed lawfully, fairly, and in a transparent manner.
- Purpose Limitation – Data should be collected for specified, explicit, and legitimate purposes and not further processed in a manner incompatible with those purposes.
- Data Minimization – Only the data necessary for the specified purpose should be collected.
- Accuracy – Personal data must be accurate and kept up to date.
- Storage Limitation – Data should be kept in a form that permits the identification of data subjects for no longer than necessary.
- Integrity and Confidentiality – Data must be processed in a manner that ensures appropriate security.
- Accountability – The data controllers (entities that determine the purpose and means of processing personal data) must ensure that the other key principles are followed and must be able to demonstrate compliance with them. That means that apart from enforcing the GDPR ruleset, controllers must keep logs and records that verify the GDPR compliance.
Rights of Individuals
- Right to Access – Individuals have the right to access their personal data and understand how it is being processed.
- Right to Rectification – Individuals can request corrections to inaccurate or incomplete data.
- Right to Erasure (Right to be Forgotten) – Individuals can request the deletion of their personal data under certain conditions.
- Right to Restrict Processing – Individuals can request the restriction of processing of their personal data.
- Right to Data Portability – Individuals can request to receive their personal data in a structured, commonly used, and machine-readable format.
- Right to Object – Individuals can object to the processing of their personal data for specific purposes, including direct marketing.
Features of a GDPR compliant website
In order to be GDPR compliant, a website should contain several mandatory features that ensure its users’ data protection.
Privacy policy
The first element to add is a privacy policy, also known as a privacy notice. This document explains to your users what data you collect and process, how you protect it, and what rights users have regarding their data.
Almost all privacy laws require a privacy policy because it allows compliance with the principle of transparency. According to this principle, anyone visiting your site must know if their data is being processed and how.
What should a privacy policy contain?
Since it’s a legal document in all respects, writing a privacy policy on your own is only advisable if you have legal expertise. This is because each notice must be specific to the activity of the site it refers to. However, there are some elements common to all privacy policies:
- Who owns the website?
- What data is processed and how?
- What is the legal basis for the processing according to GDPR (for example, consent or legitimate interest)?
- What is the purpose of data processing?
- Which third parties can access the information collected through your site (for example, if you use social media widgets, social platforms might collect your users’ data through your site)?
- How is data transferred abroad (if applicable)?
- What are users’ rights under GDPR?
- How will users be notified of any changes to the privacy policy?
- The effective date.
Remember that once created, your privacy policy must be accessible from all WordPress site pages. A good practice is adding it to the footer so your users can consult it at any time.
Cookie banner
The second element to add to your WordPress site is a cookie banner. As you may already know, the cookie banner is the notice shown on a site the first time you visit and is used to request consent for cookie installation.
To comply with European regulations, the cookie banner must meet specific requirements. It must:
- Have a button to accept and one to reject cookies.
- Block cookie installation before consent or if consent is refused.
- Present a link to your cookie policy, which is the document that explains in detail which cookies are used and why (it can also be a specific section of the privacy policy).
- Store users’ consent preferences in a dedicated register.
Consent Database
GDPR places great importance on consent, and many of a website’s marketing activities are based precisely on user consent. For example, if you send a newsletter, you can only do so after your users have decided to subscribe.
Since this is an essential requirement, keeping a consent database demonstrating that your marketing activities have been carried out in line with the regulations becomes crucial. According to GDPR, the data controller also has the task of proving the legitimacy of processing, if required.
To be complete, the consent database must contain, for each user:
- The identity of who gave consent.
- What did they consented to?
- When was consent acquired?
- What information was provided to the user when they gave consent?
- How was consent obtained (such as through the newsletter subscription form)?
Bonus: Terms and Conditions
Terms and Conditions don’t refer to GDPR, but they can be useful documents if your site involves complex operations, such as an online store or user account creation. Preparing terms and conditions is not always mandatory, but it’s often a good idea.
This document protects you from potential legal issues by allowing you to establish the terms of use of your website or the conditions of sales of your products or services.
How to make a WordPress site GDPR compliant?
When it comes to WordPress, GDPR compliance doesn’t have to be complicated or expensive. There is a wide range of plugins that bring along the necessary functionality and features to make your website compliant with all GDPR regulations. Such plugins are Cookie Notice for GDPR, iubenda, CookieYes, and many more. Most of these plugins offer free and premium plans depending on your website size and needs.
Below are the steps for installing such a plugin on your WordPress website.
- Log into your dashboard.
- Go to Plugins > Add New Plugin.
- Search for one of the GDPR compliance plugins.
- Press Install Now for the chosen plugin.
Conclusion
As we’ve seen, several elements are necessary to make a site GDPR compliant. Obviously, it’s not just about adding legal documents to your website; you must also take all appropriate security measures to protect the data you collect.
Also, keep in mind that this list may not be exhaustive. In fact, GDPR requirements may vary depending on your website’s activity and require something more – such as appointing a Data Protection Officer (DPO) or keeping a record of any processing activities carried out within your organization. If you’re not 100% sure of what you need, you can consult a legal expert.