Checklist: Is Your WordPress Website GDPR Compliant?
By May 25, 2018, every European organization has to comply with a new privacy law to be allowed to process and handle personal data. This applies to the personal data you gather via your WordPress website as well. We already posted an article on the impact the General Data Protection Regulation (GDPR) has on your WordPress website. In this article, we provide you with a clear-cut checklist to help you determine whether your WordPress website meets the GDPR requirements.
This is no juridical article and no rights can be derived from its content.
1. Inventory and document
To start off, describe the target group(s) that visit your website. Then make up a spreadsheet in which you document the kind of personal data your WordPress website collects for each group (inform yourself here on what the GDPR marks as personal data). As you specify per target group, you’ll reduce the risk of missing something. Complete this inventory by checking the following list:
a. Hosting & Administration
External service providers have access to your website as well. Check how they handle your data and if you have made the right agreements with them.
- Hosting Party
- Theoretically, your hosting party has access to all data on your website. For this reason, you will have to make a processing agreement with your WordPress hosting party.
- Managed hosting, external developers and administrators
- Which administrators have access to your WordPress website? Should you contract certain bureaus (or freelancers) to work on your WordPress website, then you will have to set up processing agreements with them as well.
- Backup Locations
- Where and how does your hosting party make backups?
Log in as administrator on your WordPress website and answer the following questions to complete the list above. In WordPress, go to ‘Plugins’, then locate what data is being collected by each plugin and determine whether this data is being stored or not:
- Contact forms (e.g. Gravity Forms)
- What information do you require from your users? And where is it being stored?
- Usernet plugins (e.g. Ultimate Member, BuddyPress, etc.)
- What profile information is stored for each user? And, what else can possibly be deduced about your users through membership? Think in terms of political activity, religious preference, financial status, or sexual orientation.
- E-commerce (bijv. WooCommerce)
- E-commerce will contain basic personal data, such as names, addresses , and banking details. However, it also reveals the kind of products people order. Do you, for instance, sell magazines with a political affiliation?
- Email marketing widgets (e.g. sign up via MailChimp or CreateSend)
- Which information do you require? What will you do once you obtain it from your users, and to which service do you forward it?
- Links with external services, like accounting packages
- g. a link between WooCommerce and Exact Online
- WordPress reaction plugins
- g. Akismet, which filters spam based on data gathered from your users’ reactions, email addresses and IP-addresses. Or, Disqus, which stores such information as well.
- Safety plugins, like Wordfence, process IP-addresses and user locations for instance.
- Backup plugins
- Complete copies of your site are privacy sensitive should they end up in the wrong hands. Where are backups stored and how are they secured?
- Like Google Analytics or Google Tag Manager: are you aware of which parts of your users’ data is being stored.
- For instance, activity monitors that register user activity.
c. Services outside the EU
Check whether you make use of services outside the EU. For instance, American service providers, for instance, that may process data from your website. Verify if they are GDPR compliant.
Check how long personal data is stored and ascertain yourself that this is done no longer than necessary. The following step will help you consider whether this time span is justifiable.
Which users have access to your website, and are their pass words up to par? Are you using marketing automation or A/B-testing? If so, have the subjects been informed?
You have to be able to justify reasons for all personal data you are storing on your WordPress website. Make sure your data gathering stays within the boundaries of the law. If you intend to store data on your WordPress website, then this is only allowed when meeting one of the following criteria:
- Because it is by consent, backed up by an agreement
Like paid subscriptions on your WordPess website for which you need users’ banking details.
- Because you are obliged to record this by law
Like customer data in your WooCommerce shop that you also need for your administration according as the Tax Administration demands.
- Because you have been given explicit consent to do so
- By virtue of a cookie announcement on your WordPress website or a registration form by which one subscribes to your newsletter. Make sure that,\
- consent is freely given (users are not to be misled or forced)
- consent is explicit (that means no tick box checked by default!)
- consent needs to be given per component (e.g. someone registers for an event, and also subscribes for a newsletter)
- users have to be able to withdraw their permission.
- Because the gathering of this data is justifiable
Like tracing the location of a logged in user as an additional safety check to determine if the user is logging in from a likely location on the planet. Of course, determining what is justifiable data gathering is somewhat of a grey area. All the more reason to explain in detail why you consider it justifiable. And, when in doubt, you may want to consult a lawyer.
Go through the inventory list (step 1) and check each item for its justification.
Remove personal data that you cannot legitimately gather and store in your WordPress website.
Deactivate plugins that can’t do so either, or search for alternative plugins that do comply.
4. Draw up Procedures
Record different protocols for situations that may occur in the future. Make sure it is crystal clear which information is to be found where, so you won’t have to figure that out later on. In any case, record the following procedures:
- Personal requests
Individuals may demand access to their personal data stored by your WordPress website, but may also want to edit or delete their data.
Record how you will guarantee data to remain confidential, now and in the future. Think about a consistent update policy for your WordPress website, plugins and theme, but also a safe back up storage and a complex password policy for every new user that is added.
- Data breaches
In case of data breaches, you are required by law to inform the Personal Data Protection Authority within 72 hours. Therefore, make sure you have a phased plan ready, as speed is crucial in such cases.
5. Inform and ask for permission
Inform visitors of your WordPress website in a clear and transparent manner. This can be realized by clearly referring to a privacy statement, for instance in the footer of your website and in the cookie statement. Also, ask visitors of your WordPress website explicitly for permission of data handling activities as documented in your privacy statement. Make sure that you get their permission as described in step 2c.