Chances are if you have a website and want to communicate with visitors online, you are collecting some sort of personal data, such as contact names, phone numbers, or email addresses. In order to protect the privacy of visitor information, the European Union implemented the GDPR in May of 2018. Failure to comply with these standards could result in heavy penalties and fines, so you may want to consider a site audit to ensure your website meets the necessary requirements.
What is GDPR?
GDPR stands for General Data Protection Regulation. The idea of GDPR started in April 2016 to establish updated data privacy regulations and standards that would prepare Europe for a digital future. As of May 2018, these standards are now mandatory for any company (or IP address) that monitors personal data or else the business could face a fine for failure to comply with these regulations.
Assessing Your Website for GDPR Compliance
You want to make sure you regularly monitor your website data stay on top of GDPR compliance, so have someone onstaff or use third party assistance to perform routine maintenance of all website data. They need to double check that all personal data is up to date (such as removing any personal data of unsubscribers) and held in a safe place. They also need to ensure the appropriate level of security measures are put in place to protect the data that they have.
Documenting all procedures done with personal data is a recommended precautionary measure in case any data theft was to occur. According to GDPR standards, any data breach must be reported within 72 hours of occurrence, so having documentation of your data handling will be helpful in avoiding any fines or penalties.
How does this affect my website if my business is not in Europe?
GDPR standards are applicable to your business website if any of your site traffic is derived from the European Union. So if your website allows international access, you’ll most likely want to comply with these standards as the fines for violation are quite high.
What are the fines for noncompliance with GDPR standards?
The penalty for violating GDPR standards ranges from 2% to a maximum penalty of 4% of annual global revenue. The penalty system is tiered based on the violation. The European Union defines personal data as anything used to directly identify a person, such as name, SSN, email, phone number, medical data, address, location, image, or social media profile. For example, if there is a threat or theft to any of the personal data on your website and appropriate action is not taken, you may be potentially violating GDPR standards.
Fines are based on a number of different criteria including the following:
- intention,
- preventative measures,
- past history of violations,
- cooperation with authority to fix violation, and
- type of data infringement.
How do I update my website to comply with GDPR standards?
Inclusion of a Description on Signup Forms
When including a visitor contact or signup form on your website, you will need to add a description above or below the form explaining what the contact information will be used for. For example, if your website asks for a visitor’s email or phone number for marketing promotion, you must state in the description that they will receive emails with ongoing website promotions and how they can remove themselves from this list if they no longer wish to receive this communication.
Ability to Opt In/Opt Out
In addition to providing a detailed description of what various promotional methods will be used for, you will also want to provide your visitors the ability to opt in or out of certain areas of communication at any point in time. For example, if a business sends promotional text messages, emails, and direct mail to subscribers, you need to give visitors the option to choose the communication methods they want to receive.
Ability to Unsubscribe
Finally, in order to comply with GDPR standards for privacy regulation, you must allow any visitor that has given personal data the option to unsubscribe from communication with you at any point in time. For example, if someone signs up for text message alerts through your website, you must inform the subscriber of the method of opting out of this type of communication if they wish to do so. An inability to remove personal data is considered a major violation of GDPR compliance standards, and your business could face a large penalty if not corrected.
Inclusion of a Privacy Policy
A privacy policy states what your website’s data collection will be used for, such as email marketing or other promotional methods. A privacy policy that is clear and easy to find must be included on your website in order to comply with GDPR standards. Many websites will place a privacy policy at the bottom of their site under contact information links.
Data Tracking Notifications
Many websites today use analytic data to track the activity of their website visitors. GDPR standards require that any website that allows traffic from European visitors provide information that visitor tracking or website cookies are currently in use.
Does Your Website Meet GDPR Compliance Standards?
Maintaining a website that meets GDPR compliance standards will ensure your business maintains a safe and secure space for visitors as well as avoid hefty penalties or fees for violation. Alliance provides managed support on an ongoing basis to maintain the proper security credentials required for compliance with these standards. We provide our clients with frequent auditing, scanning and cleaning, software updates and emergency support to help avoid and protect your business from threats to data protection. Learn more about our website support options and security protection here.
Our website support assistance will provide your website with the following updates for GDPR compliance:
- perform a website audit to check for any necessary security and maintenance updates
- provides a password protected space for all personal data, run routine checks to make sure list remains up to date
- create an onsite privacy policy stating what requested contact information will be used for
- provides training to staff members on data protection and security software
- report any personal data breaches to local authority within 72 hours
- integrate features to opt in or out of personal data collection
- continuously review data regulations and changes and ensure your website complies with all necessary standards
The information provided on this website does not, and is not intended to, constitute legal advice; instead, all information, content, and materials available on this site are for general informational purposes only. Information on this website may not constitute the most up-to-date legal or other information.