WordPress GDPR: Understanding How to Comply With the Data Protection Law

The European General Data Protection Regulation (GDPR), also known as a data privacy and protection law, has changed how website owners have to handle their users’ information. This includes websites powered by WordPress.

There are three key terms you need to know to understand the GDPR better, namely:

• Personal data – any information relating to an individual, including their name, identification number, location, and cultural and social identity.
• Controller – a legal person, public authority, agency, or other body that determines the purpose of data collecting and processing.
• Processor – any party that processes personal data on behalf of the controller.

Let’s take a look at how the GDPR will affect website owners and six important methods to make your WordPress site GDPR-compliant.

Who Needs to Comply With WordPress GDPR

The GDPR applies to all businesses and organizations within the EU countries, especially those who collect and process personal data from their customers. The law is also applicable to companies outside the EU that offer products and services to EU-based customers.

This means that almost all international-scale businesses and website owners need to comply with this regulation. Failing to comply with the GDPR may result in a huge fine.

For example, the Information Commissioner’s Office (ICO) can fine for smaller offenses up to €10 million or 2% of the company’s annual global revenue, whichever is greater.

From the monetary perspective alone, it is clear that GDPR compliance is an important aspect to consider when running a website.

Making your WordPress site GDPR compliant should also be a priority since customers now value their data privacy more than ever. Around 80% of site users said that they would stop interacting with a brand if their data was used without their knowledge.

If you are working outside the EU, note that you have to comply with other regulations similar to the GDPR, like the California Consumer Privacy Act (CCPA) and the Personal Data Protection Act (PDPA).

What Are WordPress GDPR Requirements

The GDPR compliance as a data privacy and protection regulation consists of six key principles, namely:

• Data minimization – the website should collect only the necessary personal information and use it only for specified, explicit, and legitimate purposes.
• Transparency – data collecting and processing should be communicated explicitly to the users. One of the most common ways to be transparent with data collecting is by including a data processing agreement such as a cookie notice.
• Integrity and confidentiality – website owners have to maintain the security of personal data stored, including minimizing the risk of hacking and accidental loss. They also need to send data breach notifications promptly in case of an accident.
• Storage limitation – collected personal data shouldn’t be kept longer than is necessary, but it can be stored for a longer period as far as it is for the public interest.
• Accuracy – processors must ensure personal data accuracy and keep it up to date. They also need to correct or erase personal data if it is deemed inaccurate.
• Purpose limitation – website owners should not collect personal data and use it for other than specified, explicit, and legitimate purposes.

Owners of GDPR-compliant WordPress websites need to practice these principles. Otherwise, they can be held accountable.

WordPress GDPR and Individual Rights

The GDPR also specifies the individual rights of site users protected by the regulation, specifically EU citizens. Chapter three of the GDPR lists, specifies, and divides these rights into six sections, including:

• Right of access by the data subject – users have the right to know why the website is collecting and processing their data, what exactly is being collected, and where it will be distributed. They also have the right to obtain a copy of the data undergoing processing.
• Right of rectification – visitors can request their data to be corrected if it is inaccurate. They also have the right to add more information depending on the purpose of the processing.
• Right to erasure – users can request to erase their personal data from the database.
• Right to restriction of processing – individuals have the right to deny the processing of their personal data.
• Right to data portability – people can receive a copy of their data from a controller in a commonly used and readable format. They can also distribute this copy without restrictions from the website.
• Right to object – users have the right to object profiling for certain purposes, such as direct marketing.

6 Ways to Comply With the WordPress GDPR

In this section, we will look at six ways to make your WordPress site GDPR-compliant. Keep in mind that this is not a step-by-step guide but rather a list of factors ensuring a WordPress website operates according to the GDPR.

1. Update Your WordPress Version

Updating the WordPress core software is arguably the simplest method to ensure your website is GDPR compliant. The newer versions of WordPress offer multiple features to help website owners follow the GDPR principles when collecting user data.

Make sure to update your WordPress to the latest version. This is because this version has some built-in data privacy features, such as:

• Comments cookie opt-in – enables users to choose whether the browser should save their information when submitting a comment on your website.

• Export and erase data – This version allows you to follow up on users’ requests to export or delete their personal information from your database.
• Privacy policy page generator – site owners can quickly generate a basic template for a dedicated privacy policy page. Having such a page is one of the requirements for a GDPR compliant website. However, we encourage you to create your own privacy page once you learn more about the structure and the general matter.

Aside from those useful features, updating WordPress core software regularly helps you improve data security. Older WordPress versions may have bugs and security issues that can put sensitive data within your site at risk.

Updating the WordPress website is also important to enhance its performance to keep up with newer technologies and industry standards.

2. Set a Privacy Policy Page

Legal documents, including a dedicated privacy policy page, are an integral part of creating a GDPR-compliant website.

This page should contain detailed information on how a website collects, stores, processes, and utilizes its visitors’ personal details.

Aside from being one of the GDPR requirements, some third-party services, such as Google Analytics, also require a privacy policy page. Websites without a valid privacy page may not be able to use these services since they violate the terms of service.

Every privacy page needs to specify the kind of information it collects, such as name, birth date, gender, as well as email and IP addresses.

Make sure to explain why you are collecting and processing personal data. In some cases, websites collect cookies to track users’ online behavior. Owners also need to clearly state if they share the users’ personal data with third parties.

Explicitly spell out how you will maintain data storage and its security system. This includes whether your website collects payment information like credit card or bank account details.

It is also important to include a procedure for opting out of data collection and processing.

Always include the effective date for your privacy policy to inform visitors whether it is up-to-date. If you are unsure what other aspects to include or any other details, don’t hesitate to reach out to a legal expert.

Last but not least, specify your contact details in case website visitors have some questions regarding the data-collecting process.

There are two most common ways to create a privacy policy page in WordPress. The first method is by using a dedicated feature in the admin dashboard. All you have to do is navigate through Settings > Privacy.

Click on the create button to write a new custom privacy policy page. Once you are done with the public policy, click on the publish button and consider including a link to the page on your website footer.

Another method to create a privacy policy page in WordPress is by using a plugin like WP AutoTerms. The process of using this plugin is relatively simple. A new option will appear on the WordPress admin dashboard.

The free version of WP AutoTerms allows you to create a simple privacy policy, terms and conditions, and a custom legal page. Meanwhile, the premium version, starting from $39, offers additional features such as creating a GDPR-compliant privacy policy and a cookie notice banner.

3. Enable HTTPS

Cybercrime cases have risen by 600% since the beginning of the pandemic due to the increase in online activities by the general public.

Some of these cybercrime cases are data breaches – a practice where hackers interrupt data transfer between an unsecured website and its users.

As a result, reducing the risk of cyberattacks should be a priority considering that data security is one of the GDPR key principles. To do so, one of the most common and important methods is enabling HTTPS protocol on your WordPress website.

HTTPS works together with a Secure Sockets Layer (SSL), which encrypts the data transfer between visitors’ browsers and your WordPress website. They also provide an extra authentication layer for users and protect data integrity during transmission.

SSL certificates are usually included in most hosting or domain name packages. Some services even offer SSL certificates for free.

Furthermore, some web browsers will notify users when they try to access a website without HTTPS protection.

Aside from being an important factor in making your WordPress site GDPR compliant, enabling HTTPS may also improve your WordPress search engine optimization (SEO) performance.

Search engines like Google consider various factors, including the WordPress site’s security when determining their ranking on the search engine results pages (SERPs).

4. Assess How You Collect User Data

You should understand how your WordPress website collects and processes the data of your visitors in order to be able to explain it to them. This includes various services that might collect users’ data and the type of information collected by your website.

The default privacy policy provided by WordPress already covers all data collection and processing of the core software. However, third-party services like Google Analytics, plugins, and themes usually require you to add parts to the privacy policy or create a separate one.

The data you collect may vary significantly depending on what type of WordPress website you are running and what additional services are installed. The three most common data usage policies are analytic tools, contact forms, and ad-related data.

Once you are sure how the data storing and processing works, write them down on your privacy policy page.

5. Review WordPress Plugins, Analytics, and APIs

Various elements and services within your WordPress website need to collect data from users to function properly. Understanding these elements is important in making your WordPress website GDPR compliant.

To help you pinpoint which service requires more attention regarding GDPR compliance, here are some GDPR plugins, tools, and services you might want to consider. We will also include some tips on how to use them correctly to maintain your sites’ GDPR compliance.

Contact Forms

Many websites utilize contact forms to collect information from site visitors deliberately. The main purpose of these contact form entries is to generate new leads for marketing.

To make your WordPress contact forms GDPR compliant, they must fulfill several criteria. The first element to include is the explicit consent options for data collection and other processing purposes like marketing emails and newsletters.

Make sure to use clear and straightforward language in your contact form entries. This is crucial when you want to get valid and explicit consent from users because they need to understand why your website collects their personal data.

Remember that under GDPR compliance, users need to have the option to opt out of certain data processing. As a result, a mechanism like a pre-checked box for a weekly newsletter is strictly prohibited.

Keeping accurate and up-to-date information is also crucial to comply with the GDPR. A compliant data controller needs to include comprehensive records about when, how, and whose data was captured and stored.

This includes the user IDs, timestamps, and what specific processing they consent to. While this might sound like a lot of work, creating a contact form on WordPress can be easier with tools like a contact form plugin.

Some of the best contact form plugins for GDPR include WPForms, Ninja Forms, and Contact Forms 7. As these WordPress plugins come with different features and pricing plans, make sure to do your research before choosing one for your website.

Comment Plugins

A comment section is a prominent part of most websites, especially blogs, as they collect data through the comment form. They typically store information like names, email addresses, and IP addresses in the browser cookie.

The default comment form in WordPress 4.9.6 and later versions already include a consent checkbox. Therefore, it is possible to disable user IP collection and other data processing practices when users want to leave a comment on your content.

This is also true for every WordPress theme that uses the default WordPress comment form. Alternatively, you can use an additional WordPress plugin if your theme doesn’t show a privacy checkbox for the comment section.

eCommerce Plugins and Payment Gateways

Most eCommerce sites have many elements that collect and process users’ personal information.

Aside from collecting and storing data like the name, phone number, and shipping address, they also track product search and transaction history to provide more targeted recommendations.

WooCommerce, one of the most popular eCommerce WordPress plugins, comes with various features to help make your online business GDPR compliant. Starting from WooCommerce 3.4, it has begun including features related to data handling.

These include adding relevant information to the default WordPress data exporter, enhancing the personal data eraser, and offering page display options to minimize stored data.

Another integral part of an online business site is the payment gateways. Popular services like PayPal already comply with the GDPR, protecting the data of European Union customers.

For example, PayPal has updated its privacy policy and internal procedures to comply with the regulation. As both a data controller and processor, PayPal also ensures that relevant authorities approve their data transfer protocols.

Choosing a GDPR-compliant eCommerce plugin and payment gateway should be a priority for every online business owner. Make sure the tools you use in your eCommerce site allow for easier GDPR compliance.

Email Marketing Plugins

The main purpose of most data collection is to enhance marketing efforts, including email marketing. Email marketing tools need to use visitors’ personal information, particularly their email addresses, to work appropriately.

Before business owners can send marketing emails to site users, they need to get their consent. It is also important to include an opt-out feature in each marketing email that allows users to stop receiving the emails if they want to.

Forum and Membership Plugin

From WordPress blogs to eCommerce sites, various websites use WordPress forum and membership plugins to add additional functionality.

If you want to put some of your content behind a paywall or a special user role, using a membership plugin is typically the best option. Some of these plugins also function as a forum management tool to help you with tasks such as comment moderation.

These plugins collect user data when they create an account on your website. Make sure that the tool of your choice includes a consent checkbox on any form that requires users to input their personal information.

Don’t forget to read their terms and conditions as well as the privacy policy before deciding on using one. This can help you understand how the plugin collects and stores visitors’ data and allows you to describe it accurately on your site’s privacy page.

If you are looking for a free plugin to manage your website’s forum, Asgaros Forum and bbPress can be great choices to consider.

Cookies and Consent

Cookies are a big part of ensuring a good user experience on your website. Ever since the establishment of GDPR cookie compliance and the EU cookie law, websites have had to display a cookie notice explicitly when users visit their pages.

Image source

This cookie notice includes a clear explanation of data collection and processing, as well as the options for users to disable cookies on the site. Just like with the GDPR, noncompliance with this EU cookie law may also result in getting a fine.

For this reason, it is important to ensure that your site displays the correct notice about data storing. There are two main ways to display a cookie notice on your WordPress site. The first option is to create a WordPress cookie notice using the theme editor.

The other method is to use a WordPress plugin that provides a cookie notice banner for your pages. Some examples of popular cookie notice plugins include Cookie Notice & Compliance for GDPR/CCPA and CookieYes.

Analytics

Having an analytic tool helps site owners understand their audiences better and adjust their websites to fit their visitors’ preferences.

Tools such as Google Analytics work by collecting data from visitors and presenting site owners with various information like traffic numbers and visitors’ demographics.

Even though this is beneficial from the owner’s perspective, analytics tools may cause data privacy issues and potentially violate GDPR compliance. Earlier this year, Google Analytics breached European Union privacy laws in Austria and France.

Because of that, Google Analytics has adopted additional data privacy features to further comply with the GDPR. These features include a new data deletion mechanism, data retention settings, and data processing terms.

Integrating Google Analytics into your website is relatively easy. You can install it manually by pasting the Google Analytics code to your function.php file or using a specific plugin that automatically connects your site to an analytics account.

MonsterInsights is arguably the most popular Google Analytics plugin in the market. This plugin allows you to access valuable insights about your website without any coding.

Third-Party API

Your WordPress site may use a number of third-party APIs depending on its size and purpose. Many of these third-party APIs collect data from users, requiring you to review each of them.

As mentioned before, many Google APIs, including Google Maps and Google Fonts, also collect personal data, and they may violate some EU privacy laws. Luckily, some workarounds allow you to use these services while still complying with the GDPR.

The rule of thumb is to thoroughly check each service and plugin privacy policy or contact the developer directly if necessary. Make sure that every third-party API is in line with GDPR compliance before deciding on using them on your website.

6. Use Data Handling

Data handling features from the newer WordPress version help you comply with the GDPR, providing users the right to access and erasure. These features offer ways to make personal data requests from data subjects.

Your WordPress dashboard has the option to export and erase users’ data from your database. Navigate to the Tools menu and choose Export Personal Data or Erase Personal Data.

These menus will display a list of users who request a copy of their personal data or choose to erase them from your database. You will have to send an automated confirmation email to the requester by clicking the Send Request button.

Once the request is confirmed, WordPress will capture the information and export it as a downloadable ZIP file. The same flow also applies to the data erasure process except for the final step, where you remove the data from your site’s database.

Some GDPR plugins like GDPR Data Request Form can also improve this process by providing intuitive request forms for users.

Hostinger and WordPress GDPR

As Hostinger operates in the European Union, we have to fully comply with the GDPR. There are several measures that Hostinger has taken to ensure customers have more power and control over data collecting, processing, and sharing.

We explicitly inform everyone who signs up for their service about how their data will be collected and used before completing the registration process. This includes marketing and profiling purposes or any data sharing with third parties.

Hostinger also allows customers to disable user cookies or reject certain types of data usage.

Furthermore, Hostinger ensures the visitor’s right to be forgotten. This means that our customers can get their stored information deleted if they want to.

Users can also benefit from Hostinger’s WordPress hosting plans offering enhanced security. They come with various features like daily auto backups, SSL certificates, and 24/7 support to help users protect their data security.

Hostinger is currently in the final stage of being fully compliant with the General Data Protection Regulation. Refer to our privacy policy page to learn about what information is collected when you use the platform and how Hostinger uses it.

Our newest update is directed toward Japan. This country has its own version of data protection law, called the Act on the Protection of Personal Information (APPI). To comply with it, we do not set cookies until the visitor clicks Accept. This applies not only to www.hostinger.jp, but to all visitors with Japanese IP addresses in all Hostinger locales where we show the cookie consent banner.

Conclusion

The European General Data Protection Regulation is a game-changer for website owners, specifically the ones handling their visitors’ data.

With this data protection law implemented, most online businesses and services need to prioritize data transparency and give control back to the users.

In this article, we have learned how the GDPR affects WordPress websites and the specific requirements of the regulation. We have also looked at six ways to comply with WordPress GDPR:

• Update WordPress to the latest version.
• Set a privacy policy page.
• Enable HTTPS.
• Assess how your site collects users’ information.
• Review WordPress plugins, analytics, and APIs.
• Utilize data handling features.

Understanding how to comply with the GDPR is important to ensure your business doesn’t get penalized by the EU government. The regulation also helps you give back the power and control to users and maintain their trust in your brand. Follow the tips presented in this article and start making your WordPress site GDPR-compliant.

Be sure to leave a comment below if you have any questions about this topic. For more useful tips for WordPress, check out our other WordPress tutorials.