Web Development

How To Make Your Website A GDPR Compliant One

Chithra.k | | 6 min read

It is high time to make your website GDPR compliant, as the regulation is going to be effective from May 25th, 2018. If you would like to revisit our article on what GDPR is and how it can affect a site owner or developer, you can read our previous article here.

What do you have to do to comply with GDPR?

Now that you know what GDPR is and what it is about, here are the steps to follow to be compliant with GDPR.

 

 

1. Update your ‘Privacy Policy’ and ‘Terms and Conditions’

These pages are one of the key items to being GDPR compliant. The page should inform the user:

  1. How you are using their personal data
  2. With whom are you sharing their data
  3. What cookies are used in your site and its purpose
  4. Consent to email about order notification

2. Consents

  1. Simply visiting a site is no longer considered as a consent. A user consent must be collected by means of an opt-in checkbox or choosing settings.
  2. It is equally important that the users must be able to withdraw the consent easily. If the consents are asked via opt-in boxes in settings menu, user should be able to return to that menu and update his preferences.
  3. Unless a user explicitly says that he would like to be included in the list, don’t add them. Silence is not considered as a consent.
  4. Suppose a user gives his consent to process his personal data, it doesn’t mean that you can process data for a long period. The consent should be collected or renewed every 12 months from the time of the user’s first visit to the site.
  5. A cron job can be set up for automatically sending emails to the users and to collect consent.

For more information on 'Consents', click here.

Cookies

  1. Cookies are considered as ‘personal information’ therefore you have to disclose all of the cookies which are set by your site, why they are set and option to opt-out before they are set.
  2. However, there are different types of cookies which can be exempted from the consent requirement. For example: Cookies used in a merchant website, Session ID cookies for the duration of session, authentication cookies etc. These are mentioned in the ‘Guidance on Cookie Consent and Expiration ‘ by French Data Protection Authority1.

Be it a third party or a custom cookie, which ever cookies you are using, you should make the information visible to the user in simple words. For eg: Say you are using Google Analytics , a sample privacy statement can be :

This website uses Google Analytics to help analyse how visitors use this site. No personally identifiable information is collected about you unless you explicitly submit that information on this website. The information collected is used to create reports of activities on this site. We use this to provide relevant content to our visitors.

For more information on 'Cookies', click here.

Cookie Banner

  1. Instead of using the old disclaimer ‘By browsing the site you accept cookies’, you have to be more clear on the cookie policy. The disclaimer should specify the exact purpose of the cookies and the fact that by continuing to browse the website, the user accepts the use of cookies. You can add the types of cookie that are used in the site. For instance: Necessary, Marketing, Analytics etc with checkboxes.
  2. The cookie banner of 'The Marketing Eye'4 can be taken as a reference.
  3. Also there should be a link to the ‘More information’ page which should display information on how to opt-out or refuse cookies.

For more information on 'Cookie Banners', click here.

Unfilled Checkboxes

  1. You must make sure that no checkboxes added to collect personal information from the user is ticked by default.

For more information on 'Unfilled Checkboxes', click here.

3. Right of Access

  1. A user should be able to easily access his personal information collected by the website.
  2. In the context of a Drupal website, he should be able to access his user profile page which displays all of his information.

For more information on 'Right of Access', click here.

 

 

4. Right to Rectification

  1. A user should be able to update or correct his personal information. He must be able to edit his own profile data.
  2. Care should be taken to ensure that users are only permitted to access information as per their role.

For more information on 'Right to Rectification', click here.

5. Right to Erasure

  1. A user should be able to request for deletion of his personal information.
  2. He can either do this by sending out an email to site admin or via a button in the user profile page.
  3. For the latter, a call-to-action button can be added to his profile for the same.
  4. Once the request for erasure is received, data should be deleted within 1 month.
  5. Upon deletion, the user should be informed about the erasure.

For more information on 'Right to Erasure', click here.

Now, what happens to the Contents or Orders of your Site if you are to Delete the Entire User Data?

  1. The law does not further describe how data should be deleted. If you want to keep the data for audit purposes, you can either mention this in privacy policy or remove all the personal information of the user and the data of the fields can be replaced with pseudonyms.
  2. If you are sending the personal data of users to any third parties like Salesforce or Hubspot, you are obliged to inform all the third parties to delete the personal information of the user via an API call or similar.
  3. This again comes up with another issue - backups. You should separate the list of forgotten user IDs so that when a restore process occurs, you re-forget the forgotten users.

6. Right of Data Portability

  1. User should be given an option to export all of his personal information.
  2. The ‘Export Data’ button can be included in the user dashboard.
  3. The exported data can be in the form of a CSV or spreadsheet.
  4. If your website only stores the information like favourites, bookmarks etc then it is not mandatory to provide this feature, as this does not fall under personal information.

For more information on 'Right of Data Portability', click here.

7. Right to Object

  1. The user should be able to object to the processing of his personal information. This can be in the form of a button in the user settings page.
  2. Once the user objects to processing of personal information, you should make this profile hidden from public and other users.
  3. Such profiles can be marked as “restricted” and can be made visible only to the site admin.

For more information on 'Right to Object', click here.

8. Age Checks

  1. You should check your user's age and if the user is a child below 16, then the law states that the parental consent should be obtained. How to obtain this is not well defined, but an option will be to provide a field to accept email id of the parent and verification of the same.

For more information on 'Age Checks', click here.

9. Delete Data that are No Longer Needed

  1. You should explicitly mention the amount of time that the user’s personal data will be stored in your site and delete the same after the time period.
  2. If you are an e commerce site owner, then you should create a cron job to anonymise the order information, once the delivery is complete.

10. Technical and Security Measures

  1. Audit logs should be kept and you should be careful about potential data misuses such as employee logins, unprotected servers and insecure connections.
  2. You should ensure that the access permissions given to a user is correct and he is not authorized to access sensitive information.

As an additional note, we would like to highlight the part that you don’t have to include everything which is mentioned above unless you are processing personal data of EU citizens. To know more, get in touch with us

References

[1].‘French Data Protection Authority Issues Guidance On Cookie Consent And Expiration’, blog, published December 18, 2013, Hunton Andrews Kurth, accessed May 2018.

[2].Heather Burns, ‘How GDPR Will Change The Way You Develop’, blog, published February 27, 2018, Smashing Magazine, accessed May 2018.

[3].Bozho, ’GDPR- A practical Guide For Developers’, blog, published November 29, 2017, Bozho’s Tech Blog, accessed May 2018.

[4].Neal Dyer, ’GDPR: B2B vs B2C-Can you still email your database?‘, blog, published December 19th, Marketing Eye, accessed May 2018.

 

 

Related Topics