When GDPR may apply to your website

Definition

The General Data Protection Regulation governs the processing of personal data about people in the EU. It applies to organizations established in the EU, and to organizations outside it that offer goods or services to people in the EU or monitor their behavior.

Does it apply to you

• You are established in the EU, in which case it applies to your processing generally.
• You offer goods or services to people in the EU. Merely being reachable from Europe does not meet this test. What does is evidence of intent to serve that market, such as pricing in euros, translated pages, or EU shipping.
• You monitor the behavior of people in the EU, such as tracking them online to build a profile, whether or not you sell anything. Whether a particular analytics or measurement setup counts as monitoring depends on how it is used, so ask an adviser about your setup.

Why it matters

GDPR can require changes to data practices, documentation and response procedures. Enforcement and individual rights depend on the processing and circumstances. Review applicability and responsibilities before selecting website controls.

Requirements

• A lawful basis for each processing purpose, identified before processing starts.
• Transparent information about what is collected, why, for how long, and who else receives it.
• Consent that is freely given, specific, informed and unambiguous where consent is the basis, with withdrawal as easy as giving it.
• Honoring access, rectification, erasure, restriction, portability and objection rights without undue delay and within one month of receiving the request. The controller can extend that by two further months for complex or numerous requests if it tells the person within the first month and gives reasons.
• Appropriate security, and notification of a personal data breach to the supervisory authority within 72 hours of becoming aware of it, unless the breach is unlikely to result in a risk to people's rights and freedoms.

Steadwatch's role

• We implement the approved consent configuration, record website requests and track their response targets.
• Retention and deletion behavior for platform-held data are documented in the service scope.
• Your business and advisers determine the lawful basis, applicable exceptions and responsibilities outside the website.

Records you receive

• A consent log recording what was presented and what was chosen, by region.
• Results of configured pre-consent tracking tests, with scope and date.
• Data processing terms in the agreement, naming sub-processors and the retention schedule. A separately signed data processing agreement is available on written request on the Business plan.

Your responsibilities

• Deciding whether you target the EU market, and appointing a representative if that obligation applies to you.
• Your lawful basis for processing that happens away from the website, and any records of processing activities the regulation requires you to keep.