I have a plugin hosted on wordpress.org. The plugin consists of an inquiry form to be submitted by the visitors on the front-end. I have followed the 4.9.6 update regarding GDPR. I have also added exporter and eraser in my plugin.
Is there something I need to add more in my plugin? Is there something I have to added in my inquiry form to make it GDPR compatible?
Well, this has little to do with WordPress development as such, even if there is now a special privacy function, but since I´ve been writing about online privacy for over 25 years now I´ll gladly answer. Let´s take a look at the principles:
Lawful basis. Since you are collecting data with a form, it is clear what data is collected and what for. You could add two optional notes to be filled in in the backend 'what will we use your data for' and 'what data do we store', so your users are more aware of their obligations towards the visitors of their website. These notes could also be shown in the frontend.
Responsibility, data protection and pseudonymisation. These are mainly security issues that your plugin can do little about, except maybe applying cryptography when storing the information. But that would mean the data can only be accessed through your plugin.
Right of access. This too is something that could be added to the form as a note: tell the visitor what he can do to access/erase his information after he has filled in the form.
Right to erasure. See above. Also: does your plugin provide only manual erasure options or scheduled erasure as well? The plugin could help reduce load on the users if data older than, say, one year is automatically removed.
Records of processing activities. Does your plugin allow users to modify data collected? In that case, does it store old values? This may be a little bit overkill for a simple form, but if you are collecting sensitive data (such as medical records) keeping track of modifications might be wise. Processing also involves other stuff that users do with the collected data, but that is not your responsibility as a plugin developer.
Data protection officer and breaches. Not your responsibility.
So, you are mostly done. The most important addition might be to include a note on your options page explaining GDPR to users of your plugin and allowing them to pass information on their rights to their website's visitors. At this point you have built the necessary technical tools into your plugin, but you should also support transparency.
Update: Sample texts
The GDPR applies to ‘personal data’ meaning any information relating to an identifiable person who can be directly or indirectly identified in particular by reference to an identifier. This definition provides for a wide range of personal identifiers to constitute personal data, including name, identification number, location data or online identifier, reflecting changes in technology and the way organisations collect information about people.
Ask you self what you data will you store and is it really necessary. If you must store personal data add functions to read this data to send it to a customer (identifiable person) and also a function to remove a data for a customer. If yous tore personal data think also about encoding of the data.
Trade consciously with the data of the customers, the visitors and think about read, remove and encoding. I mean this should think in the right direction to get a solid plugin in the topic of GDPR.
According to GDPR rules you need to receive explicit, positive consent from users to collect, process and use their personal data (name, phone number, email address, payment data, etc).
So, for web forms you need:
These steps help your plugin to be GDPR compliant. Also, here is a GDPR compliance checklist created by the company I work for which you can use in other projects.
GDPR rules in brief:
and the most important one..
Hope this helps.
