8 (easy) steps to be GDPR ready if you own a website

• Name
• Address
• E-mail
• Phone numbers
• Localisation
• Online identifier
• Health information
• Income
• Cultural profile
• and more

Basically, if you have any analytics tool, a list of e-mails to send newsletters and everything helping you gather data, you have to comply with the GDPR and make everything as transparent as possible.

Here is what you can start with:

1. Sign a DPA (Data Processor Agreement) with all your third-party apps (Visitor Analytics or any other analytics tool, E-mail client service, etc). To sign a DPA you just have to check your notices from all your third-party apps (in case you already received it) or ask them to send you one.
2. Make a clear Terms&Conditions section where you will specify the data that you will gather and its purpose
3. Mention all the used cookies and details about them (name, lifespan, the need for it)
4. Provide the right to access: as in, if anyone in your lists/database wants to obtain from you the confirmation as to whether or not personal data concerning them are being processed, where and for what purpose, you have to respond and shall provide a copy of the personal data, free of charge, in an electronic format.
5. Offer the right to be forgotten aka Data Erasure. One can ask at any moment to erase her/his personal data. So, be careful with this one because the conditions for erasure, as outlined in article 17, include the data no longer being relevant to original purposes for processing, or a data subjects withdrawing consent.
6. Create a set of measures to avoid any data breach and, in case of a security breach, you should notify everyone involved within 72h of first having become aware of the breach.
7. Offer the Data Portability right. This means that someone can ask for the personal data concerning them, which they have previously provided in a ‘commonly use and machine-readable format’ and have the right to transmit that data to another controller. Shortly, everyone can export their data from a controller and send it to another one.
8. Be more organised with the data! There is a Privacy by Design key change in the legislation as well. To make it more easy to understand, Article 23 calls for controllers to hold and process only the data absolutely necessary for the completion of its duties (data minimisation), as well as limiting the access to personal data to those needing to act out the processing.

There is a lot more info on this topic, but here is the GDPR structure and chapters, so you can easily understand what is this major shift in data protection about:

• Chapter 1: General Provisions (GDPR goals and definitions)
• Chapter 2: Principles (everything related to personal data processing and conditions for consent)
• Chapter 3: Rights of the Data Subject (this chapter is focused on transparency, access to data, erasure, decision making and restrictions)
• Chapter 4: Controller and Processor (general obligation of both controllers and processors, security of personal data, Data Protection Officers and codes of conduct information)
• Chapter 5: Transfer of personal data to third countries or international organizations (well, no need to explain this one)
• Chapter 6: Independent Supervisory Authorities (general conditions when it comes to independent status, competence, tasks and powers within an organisation)
• Chapter 7: Co-operation and Consistency (this one is quite complex and it explains lots of co-operation concerns, consistency mechanisms, procedures, confidentiality and lots or European Data Protection Board things)
• Chapter 8: Remedies, Liability, and Sanctions (an important chapter, if you want to know what are penalties and how to make sure that you will not get them)
• Chapter 9: Provisions relating to specific data processing situations
• Chapter 10: Delegated Acts and Implementing Acts
• Chapter 11: Final provisions

We, at Visitor Analytics, are working hard to make sure that we will keep providing all the features for our customers while being GDPR compliant!

In the next article, we will tell you how we will adapt our services in order to respect all the GDPR expectations and how can we help you, as a website owner using our app, to be compliant with no effort! We know that all these compliance steps might sound complicated, but if you are just starting your journey for a 100% GDPR compliant website, here is the most comprehensive GDPR checklist to get started.

PS: If you managed to reach the end of the article, here is a nice infographic about GDPR created by the amazing EU team: http://ec.europa.eu/justice/smedataprotect/index_en.htm