GDPR and your website
A new data protection law, called the GDPR comes into effect on 25 May 2018. This has big implications for any organisation that collects personal information.
The way we can legally collect and store people’s personal data is changing with potentially large fines for organisations that do not abide by the new regulations.
The GDPR (General Data Protection Regulation) is far reaching and complex and effects many aspects of your organisation. The GDPR is a European Union law that will still apply even when the UK leaves the EU and The Information Commissioners’s Office (ICO) is the body responsible for advising and policing the regulation in the UK.
Your website is an important part of GDPR compliance and we’re listing some things you need to consider and some actions you need to take.
What is ‘personal data’?
Personal data can be something obvious like a name or an email address but it applies to anything that can be traced back to a living individual. This could be an IP address, a car registration number or even a photo. There are special rules if you collect ‘sensitive’ personal information such as details about a person’s health.
GDPR aims to protect all EU citizens from privacy and data breaches by allowing citizens (or data subjects) to know and control the information that is held about them. GDPR applies to data controllers who decide on what information will be collected and what happens with it, and data processors who collect, store or use that information on behalf of the controller.
With regards your website, you are the data controller and Bananadesign are the data processor. We both have responsibilities for managing the data in line with the data protection principles.
Transparency and documentation
The key principle is transparency, so that data subjects know what data you will use and for what purpose, and if it is shared with any third parties. It is best to be as clear as possible about what data you will collect, how you will use it, where you will store it and for how long. If data is shared with a third party (such as MailChimp, a hosting company or a website backup service), this must be stated as well including where the data is kept and for how long too.
You must also be able to show documentation for decisions that were made and consent that was obtained…
There are six lawful bases for collecting and processing personal data. The main ones that are likely to affect you are:
- Consent (because the data subject has given clear and explicit consent for you to use and store their data)
- Contract (because it is necessary to perform a contract with the data subject. Website account logins or e-commerce purchases are covered by this for example)
- Legitimate interests (because it is reasonable and necessary to carry out a task such as replying to a contact form submission)
- Legal (because it is required under law)
Under all lawful bases you may only use the data for the specific purpose of the basis. For example you cannot send marketing emails to someone because they submitted a contact form on your website.
GDPR also gives data subjects individual rights. The main ones that are likely to affect your website are the right to be informed about what data you hold, to have information updated, deleted or moved (to provide it in a format that the data subject can use for instance if they want to move an account to a different provider). So you will need to have processes in place to deal with these.
If there is a data breach (this could be a website hack or a file being emailed to the wrong person) you must inform the ICO within 72 hours. If the data subjects are likely to experience ‘high risk to their rights and freedoms’ from a breach then you must notify them as well.
Data must be processed and stored securely using ‘appropriate technical and organisational measures’. GDPR doesn’t specify what these are so it is important to follow best practices including:
- Firewalls and other security systems to prevent unauthorised access
- Ensure activity logging is in place so you can spot an intrusion or malicious activity
- Ensure your server, your content management system (such as WordPress) and plugins are patched and up-to-date
- Only give access to staff that need it and ensure that their level of administration privileges is as low as possible to their needs
- Only keep what data you need online
- Do not transmit personal data via email
- Use an SSL security certificate on your site to encrypt all website traffic
- Use a two-factor authentication (2FA) app such as on a mobile phone to login to your website
- Pseudonymise personal data if possible
- Encrypt databases if possible (or encrypt specific sensitive data)
- Ensure only relevant staff have access to personal data
- Secure all computers with a username and password login
- Encrypt hard drives
- Ensure you have malware and anti-virus software in place and that it is up-to-date
- Have security and password policies in place
- Use a password manager (such as 1Password or LastPass) to ensure unique strong passwords for each website you use
- Do not share login details via email
- Encrypt your office backups
Update: the ICO has issued new guidance about cookies and you can read our blog post about it here.
Contact forms and other notification emails
When a contact form is submitted it is emailed to the website owner and often stored in the website database (this is a belt-and-braces approach to ensure no form submissions are lost over email). Usually the email contains the data submitted in the form and as email is insecure this is no longer acceptable. So we need to update all contact forms to:
- inform the user how their data will be used
- strip the form data from the email sent to the website owner (and the person who submitted the form). The email will just contain a notification that an email has been submitted and for you to login to view the data.
Data Processing Agreements
You must use GDPR compliant suppliers who process data on your behalf, and you must have a Data Processing Agreement in place for each data processor. Bananadesign will provide a Data Processing Agreement to each client.
Store purchases or donation payments are covered under the contract and/or legitimate interest lawful bases. We never store credit card data on any of our servers as this is always managed by the payment processor (such as Paypal).
Additional services and functionality may have been added to your website (for example to add donation payments or event bookings). Each one of these services will need to be assessed individually for GDPR compliance.
If you use third party services such as Dropbox, Google Drive, MailChimp or a CRM system to store or process personal data then you need to ensure they are GDPR compliant and have a Data Processing Agreement in place with them.
Review your lists of website users both administrators and others (such as members) and delete any that are no longer relevant.
- Read about how GDPR impacts on your organisation and practices
- Do a data audit of the information you currently hold
- Consider whether you have a suitable lawful basis for holding that data and delete, or reconsent it if you do not
- Consider if you are storing sensitive personal information (such as a person’s health details) and if so review the extra security measures that GDPR requires
- Do a Data Protection Impact Assessment (what effects would a data breach have… this includes thinking about what harm might potentially come to a person if their data was breached)
- Ensure your internal systems have appropriate security measures in place
- Update your website to a more modern system if it is out-of-date
- Use a SSL security certificate if you aren’t already
- Consider whether your current hosting arrangements are suitable for the type of data you are collecting and storing
- Check to see if you need to register with the ICO
- Identify if you need to appoint a Data Protection Officer
- Ensure you have Data Processing Agreements in place with any company that processes data on your behalf
- Check that you have suitable insurance to cover data breaches or cyber attacks
We are currently auditing websites we manage and our own internal processes. In the meantime if you want to discuss any aspect of your website as always, please do get in touch…
This information is offered in good faith but we are not data protection or legal experts and can take no responsibility for actions or inaction you decide on. Please ensure you obtain suitable legal advice from a qualified solicitor.