Europe’s GDPR (General Data Protection Regulation) is a data privacy law that went into effect in 2018. It is one of the biggest changes in the regulation of data privacy passed in the last 20 years.
The goal of GDPR is data protection for EU citizens, but it doesn’t affect only the businesses based in the EU, it affects all businesses that offer services or products to EU citizens or that processes the personal data of EU citizens and other people currently located within the EU.
It’s an 88 pages long document, and I will break down the most important information for US-based webmasters, in this article. The goal of this article is to help you understand GDPR, but do keep in mind that I am not a lawyer, so please don’t consider this article as legal advice.
Who Is Affected?
GDPR protects the data of EU residents and citizens. It affects everyone who collects and processes the data of EU citizens, even if the one who is processing data isn’t based in the EU. This means that even if you are running a small restaurant in Wyoming or just want to start a personal blog, you might be affected by GDPR. No matter where your website is located, if you are processing data, there is a chance that an EU citizen might visit your website, and thus you could be affected by GDPR.
GDPR doesn’t only cover EU residents and citizens. It also protects anyone who is in an EU country. If a US customer is traveling to Europe and opens your website while in Europe, then they might fall under GDPR’s rules, according to art. 3 of GDPR.
In short, GDPR protects anyone and their data who is in an EU country.
What Is Considered Personal Data?
GDPR applies to the processing concerns personal data of a real person. However, GDPR’s definition of personal data is wide; according to art. 4 of GDPR personal data is any information which is related to an identified or identifiable natural person. Furthermore, it states that data subjects are identifiable even if they can be indirectly identified based on that data. If you are wondering how “any information” should be interpreted, your answer should be as broad as possible.
It should go without saying that personal information such as ID numbers and location data are considered personal data. Any information that details genetic, mental, commercial, cultural, or any other form of person identity may also be considered personal data and, therefore, the law applies.
Even subjective information, such as opinions, may be considered personal data if it can be used to identify a person, according to art. 4 of GDPR.
Here’s a handy personal data list to reference:
- Name, ID, phone number, credit card information, email address and physical address
- IP address, cookie history, and location
- Gender and sexual orientation
- Biometric data
- Racial, cultural, and ethnic data
- Political opinions
- Brand preferences
- Any other form of personal information or opinion you can think of
What Does It Mean to Be GDPR Compliant?
The last two sections make GDPR look like a big, scary document waiting to fine you. Yes, GDPR is a serious document, but it actually isn’t that scary. With GDPR in power you can still collect and process any personal data but you have to do it with the explicit consent and transparency from those whose data you are processing, according to articles 7 and 5 of GDPR.
“Transparency” means that you can’t process the data of EU citizens without telling them what data you are processing and for what purposes.
“Explicit consent” means that you can’t process EU citizens’ personal information if they refuse or you have pre-checked boxes on your consent form that they have checked.
As long as you have clearly explained what data you are collecting and processing, and visitors to your website explicitly consented to that data being collected, you should be fine. Don’t forget, though, that all of this has to happen before you have collected any personal information from them.
You should also be careful when using any third-party tools that process personal data. According to GDPR art. 4, you could still be held