How does GDPR affect your website?
The 3 main GDPR issues facing website owners and how we help you solve them.
Is my website affected by GDPR?
The new European data protection regulations were adopted as law in the United Kingdom on 25th May 2018. These new regulations are built on the exiting data protection regulations, but have been extended in the light of the online world in which much of this data resides and the huge risks that data breaches represent. Read more.
Top three things you MUST do to make sure your website complies with the GDPR regulations:
1. Add an opt-in consent box to all your forms.
2. Add a new privacy policy with links from your consent box.
3. Clean your existing mailng lists.
1. Add an opt-in consent box to all your forms.
All the email and data collection forms on your website must now contain a consent checkbox that asks your customers if you can store and re-use their data. This checkbox must be initially un-ticked and only if the checkbox is ticked by your customer will you be able to use this personal data and only in accordance with your privacy policy.
View a step-by-step guide to configuring a consent box on all your forms
2. Add a new privacy policy with links from your consent box.
You must add a new privacy policy, in line with new GDPR guidance that is written in plain English that covers everything that is required by the new law. It will explain what data is gathered, what it will be used for, how long it will be held, who will be responsible for looking after the data and how your customers can get access to it if they want to. A link to this privacy policy should be added at the bottom of each form on your website so that visitors understand their rights and how their data will be used.
3. Clean your existing mailing lists.
If you are already holding any private data, that you have not been given explicit permission to use or that you don't have a legitimate interest in keeping, then you must re-contact the client and ask for their consent to continue using it. Only if they reply with this permission, will you be able to continue using this data. Data belonging to any clients that do not give you this explicit permission, must be permanently removed.
GDPR provides more protection for individuals and more responsibility for companies.
Impact on individuals
The new regulations are designed to provide much more protection for individuals. It gives us all greater access to our data and the right to be forgotten.
If you buy something online, the seller can no longer automatically assume that they can continue to email you with unrelated offers and sell on your data. Only under certain conditions, or if you have given your explicit consent can they do this. A company must set out your personal rights, how you can get access to your own information, and specifically who to contact and how long the data will be held.
Extra responsibilities for companies
These regulations place a lot more responsibility on the recipients and custodians of this data. Companies who receive private data must now take greater steps to protect this data and be very clear about how long they will keep this data and exactly what it will be used for and who it will be shared with. A greater emphasis has been placed on making sure privacy policies are written in plain English with unambiguous wording.
Much larger fines will be levied on organisations who do not follow these rules.
Companies who already have your data
If a company (based in UK or EU) can not prove that they have the right or that you have given them full consent to use your data, then they must re-contact you. Only if you then say 'yes', can they continue to keep your data and send you bulk mail.