What is GDPR and how do you comply with it on your WordPress site?

Have you ever received emails from Google or YouTube related to legal matters related to the General Data Protection Law for citizens of European Union countries and its new privacy policy, and you did not know what these laws and policies mean and why you are receiving them on your site? In today's article, we review for you in a simple and easy way the concept of the GDPR law, which is an abbreviation for the phrase General Data Protection Regulation, and we explain its importance to websites and what geographical areas are affected by this regulation. Is it important for Arab websites or can you ignore it? In conclusion, we explain how to make your WordPress site compliant with GDPR in simple and easy ways, and we show you a group of WordPress plugins specialized in this matter, which make your site safe from any penalties that may be imposed on it in the event of failure to comply with this law appropriately.

What is the GDPR data protection law? GDPR is a law issued by the European Union on May 25, 2018. It is an abbreviation of four words: General Data Protection Regulation, which means the General Data Protection Regulation. It is composed of a long regulation that specifies the provisions of the law in detail. The provisions of this 10-chapter regulation aim primarily to protect the data of European Union citizens, give them full control over their personal data, and not allow companies to obtain any data from these users without their prior and explicit consent.

The issuance of this law caused confusion and a change in the concept of data privacy for organizations. Its impact was not limited to European Union countries only, but also included business owners all over the world. Companies that violate the provisions of this law now face threats to pay large financial fines that may reach up to 20 million euros or 4% of the company’s annual revenues, whichever is greater. This punishment may seem worrying to you, but it is not that bad. The General Data Protection Law (GDPR) does not impose this punishment directly on its hackers, but rather imposes penalties gradually. It begins by warning you if you violate the law, then reprimands you with a strongly worded letter, after which it suspends your data temporarily or permanently. If you continue to ignore all of these disciplinary penalties, huge financial fines will then be imposed on you to strictly deter you. The European Union did not impose this law for the purpose of controlling and blackmailing companies, of course, but its primary goal in enacting this law is to protect our rights as consumers or ordinary people and prevent companies from exploiting our personal identifying information (PII). The law protects all of our personal data that we enter on the sites of these companies from exploitation, whether that is sensitive and important data such as (passport information, social security number, driver’s license, financial information, medical records, and credit card information. income, race, etc.) or non-sensitive data such as (full name, address, emails, physical address...) The law also ensures that this data is not violated by giant companies and ensures that matters related to the collection, storage, and use of this data by these companies are not out of control.

Does GDPR apply to websites outside the European Union? You may think that your WordPress site is exempt from complying with the provisions of this regulation, especially if you conduct your business activity within the borders of Arab countries, but this is not the case. In fact, this law applies to all businesses around the world (not just in the European Union). If your website receives visitors from European Union countries, this law applies to you, regardless of your geographical location or the location of your business.

Read more: Learn about the concept of data protection (GDPR) and whether it is necessary for Arab websites. The most important provisions of the GDPR law. The following are the most important provisions included in the General Data Protection Regulation: User consent: If you are collecting personal data from a resident of the European Union, you must obtain explicit consent from this person before obtaining this data. You are not permitted to send e-mail messages to any people who have provided you with their e-mail address through your website if they have not subscribed to your newsletter and have explicitly asked you to send them these messages, and you must agree to their request to unsubscribe from e-mail lists if they ask you to do so. Allow users to obtain or delete their data: You must give users the right to download their personal data saved by you, and you must allow them to delete their data from it themselves or by providing a request to delete their profiles.

Reporting a data breach if it occurs: Organizations must report any breaches that may occur in their data within 72 hours if the breach is harmless and does not pose any risk to users’ data. However, if the breach poses a high risk, the affected users must be notified immediately. Appointing data protection officials: If you are a public company or process large amounts of personal information on your website, you are obligated under this law to appoint an employee specialized in protecting this data and maintaining its security. However, if you are a small company and manage a limited commercial activity, in this case you are not obligated to appoint a specialized employee for that.

Is WordPress GDPR compliant?

Let us agree at the beginning that it is difficult for any software system to guarantee 100% compliance with the Data Protection Law (GDPR) because this process varies from one site to another, and it also depends on the nature of the data that you store on your site, the plugins that you use, and the method of processing the data that you collect from your site users. There are many WordPress add-ons that collect and process users’ personal data, such as shopping and digital store add-ons, subscription and membership add-ons, contact form add-ons, visitor data analysis add-ons, email marketing add-ons, and others. The method of compliance with the GDPR law on a WordPress site depends on the type of each add-on and the data it collects. Each of these plugins collects various data from visitors and users, so you need to take appropriate measures to ensure that your website is GDPR compliant as best as possible.

The good news is that the WordPress core system is compatible in its design and internal structure with the General Data Protection Law, and it saves you many procedures that you have to do to make your site compatible with the General Data Protection Law. Since version WordPress 4.9.6, the WordPress core development team has added three important features that ensure the compatibility of the WordPress system with the GDPR regulation, which are: Feature 1: User consent to save his data in comments The consent feature to save comment form data included in WordPress, as the comments form in WordPress includes a check box to obtain The user agrees to save the comment data he writes so that WordPress stores the name of the commenter, his email, and his website in a cookie on his browser to facilitate the process of writing comments in the future, as these fields are filled in automatically. However, if the user leaves the option unchecked, his data will not be saved and he will have to enter his name, email, and location every time he wants to write a comment on an article on the site. Feature 2: Providing a tool to create a privacy policy page. The privacy policy page feature included in WordPress. In order to comply with the GDPR regulation on your WordPress site, you must create a privacy policy page if this site collects any type of personal data from visitors or users of the site, such as their names, mail addresses, phones, credit card numbers, etc..

To make the task easier for you, WordPress has included a built-in privacy policy generator and provided a ready-made template for the privacy policy page, along with a set of instructions about the things you should add to this page in order to be more credible with users and explain to them what data you store about them and how you deal with this data. Of course, you must modify this form according to the nature of your site and the data you collect from your visitors. Read more: In order for your site to be legal...here is how to create a privacy policy page on your site. Customize the (Privacy Policy) page within your site in a legal way. Feature 3: The ability to request data export and erasure of personal data. The feature of exporting and erasing personal data included in WordPress. WordPress also provides site owners with the feature of responding to the user’s request to export his personal data or erase personal data from the site easily by going to the site’s control panel and choosing Tools.