On 25 May 2018, the EU's General Data Protection Regulation (GDPR) comes into force. It applies to all organisations that process personal data about EU citizens, and it applies in Norway through the EEA agreement.

Six months to go. That sounds like plenty of time. It is not.

What is GDPR?

GDPR is the EU's new framework for handling personal data. It replaces the old Data Protection Directive from 1995 and is considerably more specific and strict.

The core principle: people have the right to know what data you collect about them, why, and what you do with it. They also have the right to request that their data is deleted.

Violations can result in fines of up to 4% of global annual revenue or €20 million: whichever is higher.

What does it mean for a typical SMB website?

You do not need a legal team to understand what is required. For most small business websites, it comes down to a handful of concrete areas:

Contact forms and email If you collect names and email addresses through a contact form, you are processing personal data. You need a legal basis for this (usually consent) and you must store the information responsibly.

Google Analytics Analytics collects anonymised data about your visitors. You should have an updated privacy policy that describes this, and you should enable IP anonymisation in your Analytics configuration.

Newsletters and email lists If you have an email list, every subscription must be based on an active and documented consent. Pre-ticked boxes and vague opt-in language will no longer be acceptable.

Cookies If your website uses cookies for tracking or marketing purposes, you must inform visitors and obtain consent, not just include a sentence in the footer.

Privacy policy You need a clear, readable privacy policy that explains what you collect, why, and how visitors can exercise their rights. Not just a legal document nobody reads.

What should you do now?

You do not need to fix everything at once, but you should start the audit:

  1. Go through your website and identify every place where personal data is collected.
  2. Check whether you have a valid legal basis for each type of collection.
  3. Review whether your privacy policy is up to date and written in plain language.
  4. Check the consent mechanism for your newsletter and email lists.
  5. Make a plan to close any gaps before May.

An advantage for those who move early

GDPR is not just a compliance exercise. Businesses that communicate clearly about privacy and respect their users' data build trust, and trust is a competitive advantage.

Most small businesses will wait until they are forced to act. Those who move early avoid the last-minute pressure and can use it as a positive signal to customers and partners.

Not sure what GDPR means specifically for your website? Get in touch: we will help you with a straightforward review of what needs to be in place before May 2018.