Chances are, you’ve started hearing about the May 25th, 2018, “GDPR” deadline over the past month on social media, news websites, podcasts, and maybe even TV or radio. Whether you’ve been paying attention to these conversations or not, now is the time to listen up. This ruling is something that will affect many business owners who have a website. So this probably means it will affect you.
“But I’m just a one-person business. Isn’t that a rule that just applies to big corporations? Do I need to worry about that?” you might ask.
The answer is, yes, you do.
What is the GDPR?
The “GDPR” is coming from the European Union (EU) and it stands for “General Data Protection Regulation.” This is what they say on the EU Data Protection page:
The regulation is an essential step to strengthen citizens’ fundamental rights in the digital age and facilitate business by simplifying rules for companies in the digital single market. A single law will also do away with the current fragmentation and costly administrative burdens.
The regulation came into force on 24 May 2016 and will apply from 25 May 2018.
The regulation applies not only to organizations within the European Union but also to businesses located outside of the EU collecting and holding the personal data from people residing in the EU.
Why Are They Enforcing This?
More than ever, online privacy is becoming a big concern. We all know Cambridge Analytica’s recent privacy breach case involving a massive number of Facebook users, which made us realize how vulnerable our online data could be and how the data can be used against our will. Pretty scary.
The GDPR attempts to give people in the EU more control over their personal data and how others are allowed to use it.
Still confused? Watch this Short Video on the GDPR:
Here is a great, easy-to-understand, quick video that explains what the GDPR is and how you are involved.
How Does the GDPR Affect Me?
A simple example. Do you have a contact form on your site for people to get in touch with you? Most likely, you have fields for them to fill in information such as their email address and name. As simple as this sounds, you are actually collecting their personal data! Or, do you have Google Analytics installed on your website? Unless you have updated the settings in your Google Analytics account, you might be unknowingly collecting the visitors’ IP addresses, which are considered personal data under the GDPR.
And if you have a free opt-in on your website for list building, you are obviously collecting email addresses.
Does your website use cookies? Most websites these days use cookies for one reason or another, so your website might be using cookies even though you are not aware of it. Depending on how the cookies are set up, you might be collecting what is considered personal data. (Not familiar with cookies? Read this article I wrote: “What is a Cookie?”)
See where I’m going? Even if you don’t have anybody from the EU on your list right now, you’ll never know when somebody will join. Or you just might already have some EU contacts in your database without knowing it, and you might need to contact them to go through a new process to be GDPR compliant.
And you can be subject to fines, if they find you not in compliance with their regulation.
Are you a “Controller” or a “Processor”?
There is some terminology that you need to know to understand what you need to do to comply with the GDPR. There are two roles that are involved in data handling: the “Controller” and the “Processor.”
- Controller: determines the purposes and means of the processing of personal data.
- Processor: processes personal data on behalf of the controller.
Simply put, if you are the one collecting any personal data, you are a “controller.” And the party / application that stores that data on your behalf is considered a “processor.”
So for example: Christina Hills and the Website Creation Workshop is a controller. We collect email addresses when people opt in for my free reports and webinars, and we collect phone numbers and addresses when people enroll in our courses. Aweber and Marketers Choice (1Shoppingcart) are the processors who process and hold the data.
Under the GDPR, both controllers and processors have responsibilities to ensure the collected personal data will be handled safely. So it’s important to know whether you are a controller or a processor under the GDPR, and learn what you are required to do. Most likely you would be considered a “controller.”
What Do I Need To Do?
First you need to ask yourself: Do you have clients or email subscribers who are in the European Union. If you are a local yoga studio, and you don’t have an opt in box on your website, then you probably don’t need to do anything. And if you don’t yet have a website, then you are probably not collecting any data, so this would not apply to you.
Since this is a brand new regulation, I have not found clear step-by-step instructions on what needs to be done. In fact, there have been many discussions going on around this topic, and new so-called GDPR experts seem to be popping up every day. While many online business “controllers” are scrambling to update their opt-in forms and their privacy policies by May 25th, various online service “processors” are also working hard to be GDPR compliant on their end and to also offer their users some tools they can use to handle the GDPR. Some email marketing companies are now offering a GDPR-friendly field in their sign-up forms or a way to easily find your existing contacts located in the EU.
What WordPress Is Doing for the GDPR-Compliance
WordPress recently came up with the latest release WordPress 4.9.6, providing new privacy features that will help you as you make your site GDPR-compliant.
Privacy Page
Located within the “Settings” area, the “Privacy” feature allows you to specify your privacy policy page if you already have one, or it helps you to create one if you need to a privacy policy page by providing a template and a guide for you.
Export/Erase Personal Data
Under the GDPR, people in EU have “right to be forgotten” and “right to access and data portability.” What these means is:
- If a person requests you that his/her personal information is completely erased, you need to comply
- If a person requests his/her information that you store, you need to provide that in an easily downloadable format, allowing him/her to use the data or transfer the data to another service/place
If you go to the Tools menu after updating to WordPress 4.9.6, you’ll see two new items to make it easy to delete or export personal data of any users. Included in these tools is an automated email sent to the requestor to obtain necessary request confirmation.
“Save My Information” Consent Box for Comments
With WordPress 4.9.6, you now see that there is a checkbox under a blog post comment box, allowing commentators to choose whether or not they want their information to be saved in a cookie on their browser.
Read more about WordPress 4.9.6 here.
Here are Some Optional GDPR WordPress Plugins
WordPress is in the process of adding some GDPR features to the core software, that should come out with the WordPress 4.6.9 release. However here are some plugins that may help you comply with the GDPR. Please do your own research, as I cannot give legal advice.
Termly | GDPR/CCPA Cookie Consent Banner
The Termly plugin, formerly called “Cookie Consent”, adds a little pop-up at the top of your browser and creates a Cookie policy page on your site. It’s pretty cool! (and if you had “Cookie Consent” before, now when you look in your site you will see Termly) You can find out more about the Termly plugin here: https://wordpress.org/plugins/uk-cookie-consent/
Cookie Notice & Compliance for GDPR / CCPA
With the Cookie Notice & Compliance plugin, you can display a simple cookie consent banner with a custom message on your website. Your website visitors provide their consent by clicking, scrolling, or closing the banner. (this is the plugin we are currently using) Click here to learn more about this plugin: https://wordpress.org/plugins/cookie-notice/
CookieYes | GDPR Cookie Consent & Compliance Notice (CCPA Ready)
Cookie Yes is another popular and highly rated cookie plugin. This plugin adds a cookie banner to your WordPress website either in the header or footer. You can customize this cookie notice so that it matches the look of your website. Learn more about CookieYes here: https://wordpress.org/plugins/cookie-law-info/
You can also do a general search in the WordPress.org plugins to find one you like:
https://wordpress.org/plugins/search/cookie+consent/
Surbma – GDPR Proof Google Analytics
This plugin asks every website visitor to accept or decline Google Analytics tracking, allowing them to choose to be tracked or not, before they visit any page of the website.
Conclusion
- The GDPR (European General Data Protection Regulation) will take effect on May 25, 2018.
- The GDPR applies to all businesses collecting and holding personal data from people residing in the EU, regardless of the business location.
- It’s important to know your responsibility under the GDPR (ex. are you a controller according to their definition?) and take the necessary steps to be compliant.
- Take advantage of tools and plugins that can help you to become GDPR compliant.
- Seek advice from a legal expert.
Disclaimer:
After all, this is a legal matter. Before getting too overwhelmed by all these details, I strongly recommend checking with a legal expert on this before taking any actions. I am just giving you the information I know. We’re not giving legal counsel here and can’t guarantee that if you follow these steps, you’ll be compliant. You’ll need a lawyer to determine that.
Additional GDPR Resources
- https://www.elegantthemes.com/blog/tips-tricks/how-to-make-your-websites-gdpr-compliant
- https://blog.aweber.com/email-marketing/6-myths-gdpr-email-marketing-debunked.htm
- https://www.leadpages.net/blog/leadpages-gdpr/
- https://www.hubspot.com/data-privacy/gdpr-checklist
- https://kinsta.com/blog/gdpr-compliance
- https://exactmetrics.com/google-analytics-gdpr-and-user-data-privacy-compliance/
- https://www.blog.google/topics/google-europe/gdpr-europe-data-protection-rules/
- https://sarahdrees.co.uk/gdpr-therapists-questions-answered/
- https://managewp.com/blog/managewp-gdpr
- https://www.jeffalytics.com/data-retention-controls-google-analytics/
This is the most helpful information that I have seen about the GDPR. Now I can actually make the necessary changes to my website. Thanks, Christina!
Mary,
yes the GDPR can take a little bit of time to understand at first. Glad to be helpful!
Christina Thanks so much for this information here..this site is always helpful…there was also some helpful info. here about using other peoples’ video on your site , but I do not remember the final answer.
So glad you are getting value from the free content on my blog! The info about YouTube videos on your site is here: https://websitecreationworkshop.com/?s=youtube (I have a few articles)