The GDPR is due to come into force on 25 May. Any business found not sticking to the rules could be charged fines of up to €20 million or 4% of the company’s global annual turnover, though the toughest fines will be reserved for the worst data breaches or data abuse. If you’re currently running a blog or an online business- keep on reading.

Disclaimer: this post is not legal advice, for all the information on General Data Protection Regulations, see the GDPR site or seek professional advice. This is just my interpretation of the upcoming changes & what I’m personally planning on doing in order to meet the requirements.

What Is GDPR?

The EU General Data Protection Regulation (GDPR) replaces the Data Protection Directive 95/46/EC and was designed to harmonize data privacy laws across Europe, to protect and empower all EU citizens data privacy and to reshape the way organizations across the region approach data privacy. The key articles of the GDPR, as well as information on its business impact, can be found throughout this site.

GDPR changes how personal data can be used. Individuals, organizations, and companies that are either ‘controllers’ or ‘processors’ of personal data will be covered by the GDPR. A data controller states how and why personal data is processed, while a processor is a party doing the actual processing of the data. Basically, the controller could be any organization, from a profit-seeking company to a charity or government, while a processor could be an IT firm doing the actual data processing.

In short, GDPR applies to anyone collecting data from UK and EU citizens. Thus, if you own a blog or website, have a mailing list, collect e-mails to send newsletters, run an online business/shop or gather any kind of information for services, then you need to comply.

GDPR Requirements

The most important thing you need to do is make sure you’re notifying your readers/clients about any data collection on your website. You can also no longer use the information collected for anything other than it’s intended purpose and you need to be very transparent about the way you’re using and storing personal data.

Here’s what you should start thinking about:

• Breach Notification – It’s your responsibility to inform your data protection authority of any data breach that risks people’s rights and freedoms within 72 hours of your organization becoming aware of it.
• Right to Data Access – Users have every right to access the information you have about them, in a commonly readable format.
• Right to Portability – Users are able to request that you forward their data to other controllers or services.
• Right To Be Forgotten– Users have the right to be deleted, meaning they can request the deletion of their accounts and personal information. They are entitled to be erased if their data is no longer necessary.
• Privacy by Design – This section requires companies to design their websites with the proper security protocols in place from the start.
• Data Protection Officers – If you handle a huge amount of user information or sensitive data (such as patient information or criminal records), you need to work with a Data Protection Officer (DPO). The DPO is the key officer taking care of managing procedures and maintaining records and are in charge of all activity processing data. Luckily, at this stage, a blogger or person providing software as a service wouldn’t necessarily need to appoint a DPO.

As for bloggers & small online business owners, it basically all comes down to being transparent to your readers, clients and making sure their data is safe and is not misused.

Now you might need to make some amendments to how you’re currently collecting the data, shall we get to work?

E-mail Lists

If you’re currently collecting e-mails for your newsletter, here’s how you can comply with the new regulations:

• You have to make sure to your subscribers officially agreed to be added to the list. You can include a checkbox into the form or use the double opt-in feature where subscribers are sent an e-mail upon subscription which asks them to confirm their entry. You should be able to find these options in the form of your mailing list provider.
• If you’ve previously collected e-mails and your subscribers weren’t notified you should now give them an opportunity to re-confirm their subscription. Sending out a message to all of your email subscribers asking them to re-confirm their subscription would be a good idea in this case. It would also give you a chance to clean up your mailing list from inactive users.
• You can not collect any information that is not relevant to the subscription. Name & e-mail should be more than enough for you for sending regular newsletters.
• Subscribers should have an opportunity to easily opt out of your form at any point.

All in all, just be respectful of your subscribers’ needs and only collect the data that is necessary.

Blogs/Websites

If you’re currently running a blog or a website, you should make sure:

• Read this post about complete GDPR for WordPress users.
• Install Delete Me plugin which allows users to delete their accounts from your shop.
• Specify how and where you process the personal information. (accounting, marketing, UX research, sales reporting etc.)
• Collect ONLY information you require to run your business/complete orders etc.
• Set up a WP GDPR plugin which allows you to add checkboxes into all of your contact/Woo-Commerce forms.
• Create a Privacy Policy page and add a link to it into your footer for users to easily access it at all times. All websites should have a privacy policy.
• If your website transmits PII in any form then you would need to use HTTPS to ensure it’s encrypted in transit. If your website is a bog standard information page with no information on any individuals/credentials then it won’t really matter. However, if you’re accepting payments & building a profitable business online- SSL certificate & secure HTTPS connection is a must. Luckily, Bluehost can help you with that!
• Your site should display a cookie notice that lets users know that by using your website, they agree to the use of cookies. If you use Google Analytics or collect any data for statistics etc, your website is most probably using cookies. To set this up, simply install “Cookie Notice” or “Cookie Consent” plugin on your WP.

The above covers some of the main edits that will help you comply with new GDPR changes. If you think I’ve forgotten to include anything, it would be awesome if you could let me know in the comments, so I can expand this list!

Consent!

Whatever you do, just make sure to remember the words CONSENT. Whenever you collect any type of data from people, you have to make sure they agreed and are aware of what’s going to be done with this information and you have to keep your word on this. As long as you follow this main rule, everything else should come into place.