Is your online store ready for the GDPR?
You’ve probably heard by now: on May 25, 2018, the General Data Protection Regulation (GDPR), known in Dutch as the Algemene Verordening Gegevensbescherming (AVG), replaces current privacy legislation. Organizations have had since May 2016 to adapt their processes to the new rules. Starting May 25, 2018, there’s no more grace period, and every organization must meet the GDPR’s requirements. Are you ready?
Here are a few practical steps you can take care of quickly:
Privacy policy
Your privacy policy explains exactly what data you collect and store, why you collect it (and with what consent), and how you handle it. This covers all personal data, not just cookie data. Make sure your privacy policy is up to date, written in plain language, and easy to find on your site. Check out some examples or generate your own privacy policy.
Anonymize Google Analytics
If you don’t use cookies for advertising features, don’t collect IP addresses, and don’t share data with third parties, you can place the Google Analytics tracking cookie without asking visitors for explicit consent. The key is configuring Google Analytics in a privacy-friendly way.
Have you set up Google Analytics with privacy in mind yet? The Dutch Data Protection Authority (Autoriteit Persoonsgegevens) has published a step-by-step guide for exactly that. Work through it yourself, or ask us to review all your settings and make any changes that are needed.
Google Analytics data retention
To support GDPR compliance, Google Analytics now lets you delete data. In fact, the default setting deletes data after 26 months. If you want to keep your data (or set a different retention period), be sure to change this setting. And remember to state the retention period in your privacy policy.
Don’t want your statistics deleted automatically after 26 months? Update the setting in your Google Analytics account now. You’ll find the steps to follow here (or, of course, just ask us).
Also remember to sign a data processing agreement with Google Analytics and mention it in your privacy policy.
Take stock of your other features
Next, check whether you use any other modules or features besides Google Analytics that place cookies or process your customers’ data. Examples include Hotjar for tracking user behavior, a chat tool like Crisp for talking with website visitors, and remarketing modules such as AdWords and Facebook. Sign a data processing agreement with each of these providers, anonymize data where necessary (and possible), and list these modules in your privacy policy. If any of these features rely on cookies to work, it’s also wise to update your cookie notice accordingly.
Cookie notice
The GDPR gives consumers full control over the personal data organizations collect, store, and use. As a result, you can no longer collect cookie data without restriction. There are several types of cookies:
1. Functional cookies, which your online store needs in order to work (such as cookies for logging in or keeping track of a shopping cart).
2. Analytical cookies, which give you insight into how your site is used.
3. Tracking cookies, which record visitors’ browsing behavior for purposes such as remarketing campaigns.
Starting May 25, users must give explicit consent for tracking cookies and for analytical cookies used for personalized content, remarketing, building profiles, and sharing data with Google and other third parties. A traditional cookie wall or implied consent is no longer enough. Make sure your cookie notice clearly separates functional, analytical, and tracking cookies.
Magento and the GDPR
Your Magento installation doesn’t need any changes to comply with the GDPR, according to Magento. Even so, it’s important to map out exactly which personal data Magento processes. You’re actually required to keep a register of the personal data you process. The GDPR also gives users the right to access, correct, and delete their data, so you need to be able to respond properly and act on those requests. Knowing which data is stored where in Magento is essential.
Make security a priority
Take security seriously, and check whether your Magento installation is running the latest version. Keep in mind that any data breach must always be reported to the affected consumers or end users and to the Dutch Data Protection Authority.
Other data processors
Make a list of every company that processes data on your behalf for your online store. This includes your payment service provider and your shipping partner(s), but be sure to double-check your Magento extensions as well. Sign a data processing agreement with each of them and mention these agreements in your privacy policy.
Have more questions, need our help, or haven’t received our data processing agreement yet? Don’t hesitate to get in touch.
