General
WordPress GDPR compliance: complete checklist
8 March 2024 · 5 min read
The General Data Protection Regulation (GDPR) applies to every website that processes personal data of EU citizens. That is virtually every WordPress website. In this article we give a practical checklist for GDPR compliance.
At WP Maintainer we help clients with GDPR compliance of their WordPress websites.
1. Privacy statement
Every website must have a privacy statement that describes: - Which data you collect - Why you collect it - How long you keep it - With whom you share it - Which rights visitors have
Use a tool such as iubenda or ask for legal advice.
2. Cookie consent
Show a cookie banner that: - Explains which cookies you place - Asks consent for non-essential cookies - Records consent - Offers an opt-out
3. Contact forms
- Explicitly ask consent for processing data - Link to your privacy statement - Do not keep form submissions longer than needed - Secure forms against data leaks
4. Analytics
- Anonymise IP addresses in Google Analytics - Use a cookieless analytics tool (Plausible, Fathom) - Or ask consent for analytics cookies
5. Email marketing
- Use double opt-in - Keep proof of consent - Offer easy unsubscribe option - Delete data on request
6. Data breach protocol
Have a plan in case of a data breach: - Detection procedure - Duty to report to the Data Protection Authority (within 72 hours) - Communication to those affected - Investigation and prevention
7. Rights of data subjects
Ensure you can comply with requests for: - Access (which data do you have of me?) - Correction (change my data) - Deletion (delete all my data) - Data portability (give my data to me)
WP GDPR service
We help WordPress websites become GDPR compliant: cookie banners, privacy statements, form configuration and data breach protocols. We ensure your website complies with legislation.