Your website and GDPR

The General Data Protection Regulation (GDPR) is a European privacy law that took effect on 25 May 2018.

GDPR does not apply only to European companies. It applies to every company that could process the data of EU nationals, which means any company in the world can be subject to it. Wherever your company stores or processes personal data, it must follow GDPR guidelines.

GDPR gives people more control over their personal data. It gives them the right to access, correct, delete, and restrict the processing of their data, and it sets strict rules for user consent.

If you collect or store any information that can be linked to an individual, that counts as personal data, and you need to be familiar with the GDPR. You can read the full text of the GDPR (opens in a new tab) to learn more.

Some businesses need more preparation than others. This guide gives a general overview of GDPR compliance and outlines the most common requirements.

How to prepare for GDPR

Your website collects and processes personal data in a compliant manner. Even so, it is your responsibility to meet GDPR requirements when you collect and process personal data from your EU customers.

What personal data means

Personal data is any information that can be used to directly or indirectly identify a person. This includes a name, a photo, an email address, an IP address, bank details, posts on social networking websites, medical information, and even random codes assigned to users to gather analytics, run A/B tests, and more.

GDPR broadens the definition of personal data to include any information that can be connected with a known person, such as browser history and social media activity. It also makes special provisions for information related to a person’s physical and mental health, such as genetic and biometric data.

Why user consent is important

Consent is the cornerstone of the GDPR. You needed consent before GDPR, but it was much simpler to obtain. Under the new rules, obtaining consent is no longer a sure thing. Unless a legitimate interest is involved, getting people to say yes must be done in an explicit way, using plain language, and making clear the reasons the consent is requested. The user needs to know exactly what their personal data will be used for and by whom.

Applying the strictest interpretation, using the personal data of an EU citizen requires that consent be freely given, specific, informed, and unambiguous. It requires a positive indication of agreement, so it cannot be inferred from silence, pre-ticked boxes, or inactivity.

Having a legitimate interest is not the same as having consent, because the data gained cannot be used for purposes other than those implied.

Once consent is obtained, you need to record and safeguard it, and be ready to hand it over when requested.

The Website Builder and GDPR

The Website Builder helps you collect user consent by providing a consent request form, adding clear consent request boxes on forms, reminding you about the consequences of pre-ticked boxes, and encouraging you to update your terms and conditions.

You must obtain consent to process your customers’ personal data. Prepare a clear privacy policy that explains why you collect personal data, what data is retained, and how someone can withdraw their consent.

With the Website Builder, you have two ways to ask for your visitors’ consent to cookies on your site:

• By setting up a CookieBot consent banner.
• By enabling a Website Builder cookie consent banner.

Both options are free for all users.

Give customers the right to access their data

You must provide your customers with a copy of their personal data in an easily readable and portable format. You can access your customers’ personal data in your control panel. Also take into account any third-party services you use that may have access to your customers’ personal data.

Give customers the right to delete, edit, and restrict certain data uses

Basic requests (for example, a customer asks you to delete their order) can be managed quickly inside your control panel. Again, remember any third-party services that may have access to this data.

We recommend storing data digitally. Encrypted data protected by a password of at least the recommended strength, or protected with a password generator, is a more secure option than printed invoices.

Data breach notifications

Your online store acts as a data processor, while you, the merchant, act as the data controller. If your website experiences a data breach of any kind, you may be required to notify affected customers.

Changes to your team

Under the legislation, you need to appoint a Data Protection Officer (DPO) if you intend to process personal data on a regular basis. The DPO is the central person advising the company on GDPR compliance and acts as the primary contact for supervisory authorities.

Next, train your team. Giving everyone with access to data adequate training on the context and implications of GDPR helps avoid a potential breach, so do not skip this. Data protection can be a dry topic, but a small amount of time spent making sure employees are informed is time well spent.

Some highlights to remember:

• Sites need SSL certificates.
• Your website needs a privacy policy.
• There needs to be a way for subscribers or clients to have their data removed.
• Subscribers must also be able to request their data.
• Clear consent must be given if someone signs up for a free download and also consents to be added to your general mailing list.
• Review your current email list for subscribers from EU countries and ask them whether they would like to remain on your list. This is also a good time to resend your privacy policy.