Is WordPress is ready for GDPR compliance?

Is there any patch or extension they need to apply for GDPR ready for all EU countries as this is the law for EU countries the come in effect on may 25, 2018.

  • 1
    GDPR applies to businesses, not software. You need to evaluate the GDPR based on what you are doing with your users' personal data, not necessarily WordPress. – Jacob Peattie Feb 4 '18 at 15:41
  • if you mean to ask if wordpress.com is ready than the proper thing to do is to ask their support – Mark Kaplun Feb 4 '18 at 15:42
  • But many time we using the WordPress as e-commerce website where we use the customer personal information for shopping . At that time we need GDPR compliance check – Purushotam Sharma Feb 4 '18 at 15:45
  • 1
    Which has very little to do with WordPress or eCommerce plugins as software. It's about how you use the data as a business. Look at this information page. Almost all the points are about communication with users about how data is used. Sending your customer's data to Mailchimp? You might have to tell them. Are you hosting their data outside the EU? You might have to tell them. Does a user want their account deleted? You might legally have to. That's all the stuff that matters, not the CMS. – Jacob Peattie Feb 4 '18 at 15:50
  • Worth following make.wordpress.org/core/2018/02/19/… – swissspidy Feb 19 '18 at 12:34

WordpPress "out of the box" is not GDPR complaint. Even putting aside the integration with non complaint services like akismet and gravatar, just storing comments will probably require to give users the ability to delete them, but there is no real way to identify which users created which comment as comment authors are never verified.

For 99% of wordpress sites this is going to be a non issue, and in general, unless you are already a subscriber to letters from the various EU regulatory bodies, it will take time until GDPR will become something for which the DOs and DON'Ts become clear.

DISCLAIMER The point of this answer is to highlight few areas which are likely to need some thinking in the GDPR context, but I am far from being an expert, and this is not an advice on what is it that you should do with your site. If GDPR compliance is important for you, you should consult an expert to understand what it means for your specific site.

  • Requirements like the user being able to delete or retrieve their data aren't WordPress' responsibility. You as a business are responsible. That could mean using software with a button in the UI for these actions, or it could just mean doing it manually based on a customer support request. You just have to comply with the request. The software isn't responsible, the business is. So software could make compliance easier or harder, but it doesn't make sense for software to be or not be compliant. – Jacob Peattie Feb 5 '18 at 6:32
  • @JacobPeattie, if there is no UI to find all the comments made by a user, it will be hard to let the user know what they are and to delete them if needed. You can build something to do that but wordpress out of the box is not GDPR friendly. And this is before even talking about the "on by default" akismet and gravatar integration for which the site owner has no control at all. – Mark Kaplun Feb 5 '18 at 6:51
  • played a little with comment admin right now, and you can use search functionality, but it is non precise textual search which may lead to false positives. Deleting comments out of threaded discussions are also going to be a challenge. which probably calls for replacing the comment with some text instead of actually deleting it. .... and since you can not let a commenters access to the admin, even if the search was perfect, you will still need some kind of export tool. – Mark Kaplun Feb 5 '18 at 6:57

Not the answer you're looking for? Browse other questions tagged or ask your own question.