If you run a business, you likely have a presence on the web, a website, in other words.
For some, that site might be an online store where visitors can purchase your products directly. For service providers, it may be a site promoting those services and informing potential customers about your quality and the benefits your services bring.
A well-crafted, engaging website is all about credibility; it is an opportunity to make that critical first impression. We tend to focus on those things when creating our sites or working with those who can do it on our behalf.
Many, though, tend to forget the importance of GDPR compliance, or at least put it on the back burner; the result, of course, is that an alarming number of websites aren’t as compliant as they should be…
Here are some of the most overlooked areas of website compliance:
Cookies & Consent
Cookies are classified as a type of identifier, one which can often (in the case of authentication cookies) contain personal data used to log in to accounts. They might also collect information such as unique IDs and site preferences to better tailor content to a user’s tastes.
The regulations around cookies relating to GDPR and PECR (Privacy and Electronic Communications Regulations) are complex and wide-ranging depending on your business and the purpose of your site. They might not always be classed as personal data, which confuses many site owners.
The Information Commissioner’s Office has a helpful resource to determine where consent applies for you and your site’s use of cookies; it only takes around two minutes to complete and can save serious issues further down the line.
Website Security
SSL: Secure communication between a site’s server and the device your users browse on is essential. You might notice some sites display a padlock icon in the address bar, and that icon means the connection is encrypted using HTTPS (not the older, less secure HTTP) protocol.
Securing your website is crucial to guarding your data as well as sensitive information from your customers. Taking preventative measures to protect your site can save time and money and protect your brand reputation. It does not matter if you collect payments or personal data; it should still be secure.
Passwords: One other way to secure your website is by logging in. Ensure that you use a strong password AND multi-factor authentication. Ensure anyone with access to the website has a unique and strong password.
Back up your website or automate the backing up of the site. Your hosting provider can provide this.
Updates: Ensure you update your website regularly or automate the updates. Updates are released to improve your site’s security and the plug-ins you use.
Privacy Policies
Disclosing how you gather, store, use and manage your visitors’ data is an essential aspect of good GDPR practice, making your privacy policy a vital working document.
It should contain
- your contact details,
- the types of personal information you collect,
- how it is obtained, and why you have it.
The policy should also state how the data is stored along with the rights of the individual and how to make a complaint if they feel it necessary to do so.
It also needs to be easily accessible for all to see.
Opting-In & Opting-Out
Online marketing can be challenging to understand the regulations (PECR). As a rule of thumb, do not rely on legitimate interests to send emails.
When adding a sign-up form, it is crucial to give them a choice to opt into specific types of communication. Remember that opting in is always preferable, and being specific is essential.
You might send different types of emails, such as newsletters, marketing, product updates or essential emails. Subscribing and unsubscribing from some or all of these should be as easy as possible for your users.
Are you doing enough to ensure your website is compliant? If you need advice and support, I’d be delighted to help make your website GDPR-compliant. Get in touch today to schedule a chat.
Have a conversation with your website designer/tech, who will be able to ensure the site is secure. If you would like support, advice or guidance on policies, then why not book a free discovery call with us?