If you collect data or personal information from website visitors, then you will want to make sure your website is in compliance with various regulations. These often include having a "Privacy Policy" page on your website or a Cookie disclosure. Note: Marketing 360® is not responsible for your website's compliance with these regulations; website owners must take the necessary steps to make sure their website is in compliance.
There are two primary regulations that you may need to prepare for:
The General Data Protection Regulation, or GDPR, went into effect May 25, 2018. This new regulation creates consistent data protection rules across the European Union. But because there are no borders on the internet, it also applies to all organizations and companies that process personal data from individuals in the EU, regardless of where the organization company is based.
Much of this regulation actually builds on existing EU data protection rules, the Data Protection Directive. However, GDPR has more well-defined standards and substantial fines.
Failure to comply with the this new regulation can now result in fines: up to 4% of global annual revenue for certain violations.
This law is designed to accomplish two main things:
The GDPR applies to any business that does one or both of the following:
This means that a U.S.-based business that process data from EU citizens will be required to comply with the GDPR.
To get a step-by-step overview of full GDPR compliance, view the slideshow below provided by TermsFeed.
Processing is somewhat vaguely defined. It refers to anything related to users' personal data.
Under the GDPR, there are a number of approved reasons (legal bases) a company can lawfully process a person's data. A few of the most common are described below.
In short, only completely necessary should be collected on the website and the user MUST be given a clear explanation of how their data is used.
Businesses that want to be fully compliant are subject to a different set of guidelines on how user data can be stored, what kind of consent is needed to collect new leads, and what kind of consent is needed to contact users already in their contact lists, to name a few.
For example, how, why, and for how long their data is stored? This includes form entries, CRM accounts, etc. If they're using a form to collect leads and a CRM to manage active clients, they may need to adopt new practices of removing form entries on a regular basis to remove user info for dead leads, etc that did not get entered to the CRM.
Here are a few links that provide some good info about GDPR-compliance.
Each GDPR-compliant site should include:
According to Article 12, you must tell users how you process personal data in a way that is:
Your Privacy Policy needs to let your users know:
Aside form the information above, a GDPR-compliant privacy policy must include specific information in regards to data collection, data processing, contact information for data requests, cookies as well. Again, seek legal advice to be sure your policy is in order, or look into the links below to learn more about generating a GDPR-compliant privacy policy, or even using an online generator to create one.
Each form will include easy-to-find links to the policy mentioned above. This allows users to see what data is collected, and why. We'll also add a clear opt-in option any time additional data processing happens, like sending a form entry to an email marketing platform or a CRM.
When users land on the site, they'll see a notice message stating that cookies are used, and how.
At this point, some businesses are still simply showing users a notice and allow them to accept, or suggest leaving the site and/or clearing browser data to avoid cookie-based tracking.
The fully-compliant option is to pause all data tracking until the user opts-in, and allow them to opt-out at any time. This makes all tracking / marketing like Tag Manager work on an opt-in basis.
Again, these decisions are up to the client. They should base their decision on how much of a presence in the EU they plan to have, how much tracking they plan to do using cookies, and how much user data they collect and store.
The GDPR gives users the right to erasure, sometimes also referred to as the 'right to be forgotten.' This means that users who have submitted personal data to your site have the right to make a request to review it and / or have it deleted in a timely manor.
Here are a few of the applicable scenarios where a user can make a request:
A GDPR-compliant website should give users clear information on how they can contact the business or organization to make these requests. This can be via email, phone, or a dedicated form on the site. It's the responsibility of the site owner to fulfill them in a timely manor.
As long as one of the above conditions is met, the data must be permanently remove the data from the site, and any third-party the data was shared with: CRMs, email marketing platforms, etc.
The California Online Privacy Protection Act is a law requiring websites that collect personal information about California residents on a website to post a Privacy Policy page on the site, and to comply with the policy.
The Privacy Policy must identify the categories of personally identifiable information that is collected, and list the categories of third parties with whom the operator may share the information.
Note: Marketing 360® cannot craft the verbiage of a Privacy Policy page for website, as it is considered legal language. Please consult a legal advisor for assistance with crafting a Privacy Policy that suits your organization.