Making sense of legal developments isn’t always fun. However, there are some laws that you just can’t ignore if you’re running any kind of website. The latest of these is the General Data Protection Regulation (GDPR).
The GDPR is an EU policy that protects internet users’ rights when it comes to their personal data. It also lays out a series of requirements your website must adhere to, or you risk facing a penalty. This regulation is important for everyone to understand and comply with – not just those living in the EU.
In this post, we’ll introduce the GDPR and discuss why it exists. We’ll then break down its major components, and explain what it all means for you and your website. Let’s take a look!
What Is the General Data Protection Regulation (GDPR)?
Online privacy has been a hot-button issue for some time. As websites collect more data from their users, people are understandably concerned about how that information is used. This has resulted in several pieces of legislation aimed at protecting consumers' privacy.
For instance, in 2011 the EU countries adopted a directive known as the ‘Cookie Law’. This gave users the right to refuse the use of cookies, reducing the amount of personal data that could be collected about them. While this was a solid first step, many people felt that this directive didn’t do enough to protect consumers. That’s where the General Data Protection Regulation (GDPR) comes into play.
This regulation has been in the works for four years, and is finally going into effect at the end of May 2018. In a nutshell, the GDPR gives website visitors more control over how their personal data is collected, stored, and used.
More specifically, the GDPR lays out a number of rules that websites need to follow when it comes to user data. Let’s take a look at how the GDPR works in more detail.
What Are the Basic Components of the GDPR?
As with any legal directive, the GDPR is fairly complex. We’re not lawyers, so we aren’t going to try and explain every minute detail. Instead, we’ll walk you through the most important components of this new regulation.
The main focus of the GDPR is to lay out the privacy rights of internet users. At the same time, it codifies the responsibilities of website owners when it comes to ensuring that privacy. These rights and responsibilities are broken down into six main elements:
-
Breach Notification. If a security breach puts personal user data at risk, website owners are required to notify all affected parties within 72 hours.
-
Right to Access. Users have the right to find out whether personal data is being collected about them, what that data is, and how it’s used. They can also request a free copy of their data at any time.
-
Right to be Forgotten. Whenever they want, users can request that all their personal data be erased. They can also refuse any further collection or sharing of their information.
-
Data Portability. Not only can users request a copy of their data from the website that collected it (in a common and readable format), they can transfer that information anywhere they like.
-
Privacy by Design. Systems are required to be designed with privacy as a central concern from the very start. This includes limiting the amount of data collected to only what is necessary, and carefully controlling who can access that information.
-
Data Protection Officers. This final component lists out a number of requirements that concern how data is collected. In brief, website owners must keep records on the data they collect. Furthermore, certain systems that work with very sensitive types of information (such as criminal records) will need to appoint one or more Data Protection Officers, who have their own list of responsibilities.
The GDPR is all about creating a culture of transparency around data collection, and giving people complete control over their own information. People have the right to decide whether their data is tracked and stored, to know exactly what that data is and how it’s used, and to transfer or delete it at any time.
What Does the GDPR Mean For You?
If you’re reading this, chances are that you’re both an internet user and a website owner. Therefore, the GDPR means two very different things for you personally. As a user, it’s great news. You’ll have fewer reasons to worry about the data websites are collecting about you while you’re browsing the web, doing business, making purchases, and so on.
However, for anyone who runs or creates websites, the GDPR is a very pressing concern. If your site is not GDPR-compliant, you can face some strict penalties. Non-compliant organizations can be fined up to 4% of their annual global turnover or €20 million – whichever is greater.
What if you don’t live in the EU? That doesn’t matter as it applies to all sites that collect data from anyone who lives inside the EU. Unless you’re running a small, local site without any international visitors, the GDPR will affect you.
However, there’s no reason to panic. For most sites, complying with the GDPR isn’t a difficult process, and there’s a lot of resources out there that can help. Here are two of the measures you might want to take initially:
-
You’ll need to be completely transparent about what data you’re collecting and how it’s used. For that reason, you should consider creating a privacy policy that includes all the pertinent details.
-
Since you must respond to potential security breaches quickly, consider getting a tool that will help track activity on your site. If you’re a WordPress user, you can do this easily with a plugin like WP Security Audit Log.
There are a lot of additional steps you can take to make sure your site is GDPR-compliant. However, what’s most important is to know exactly what data your website is collecting, communicate honestly with your users, and stay vigilant for any potential privacy breaches.
Conclusion
The GDPR may seem complex at first glance – even a little intimidating. However, understanding its basic components is a must for anyone running a website that collects user data. Ignoring it could result in financial loss, so you need to take notice.
Fortunately, the GDPR isn’t hard to grasp once you break it down. Complying with this regulation means knowing what user data your site collects, being fully transparent with visitors about that information, and protecting their right to access, transfer, or delete their data whenever they choose. Two solid first steps you can take are to establish a clear privacy policy and start tracking activity on your site.
Image credit: TheDigitalArtist.
