Whenever a customer fills in a form, asks for a quote or buys something on a website, they may be handing over personal data, such as their name, email address, phone number or home address. The business responsible must make sure that this information is collected and used properly, in line with the General Data Protection Regulation (GDPR).
Protecting data does not depend only on the privacy policy. It also involves the website’s technical security, access management, how information is kept and the procedures in place to prevent incidents.
A secure connection (HTTPS)
HTTPS encrypts the communication between the visitor’s browser and the website’s server, reducing the risk of the data being intercepted. It is especially important on contact forms, client areas and online shops.
HTTPS is an essential security measure, but on its own it does not protect a website against every attack. Server configuration, application security and regular maintenance are still needed. Google recommends HTTPS to protect both users and websites.
Collecting and processing personal data
The GDPR states that personal data must be adequate, relevant and limited to what is necessary for the purpose for which it is collected. On a quote request form, for example, a name, one way to get in touch and a description of the service may be enough.
The business must also identify a lawful basis for processing the data and tell the person about the purpose of the collection, how long the data is kept, who receives it and what rights they have.
Updates and backups
An outdated website may have vulnerabilities that make unauthorised access or malware easier. Updating the system, components and plugins, where applicable, is an important way to reduce these risks.
Backups let you recover content and information after a technical failure, an attack or an accidental deletion. To be effective, they should be made regularly, stored securely and tested from time to time to confirm that the data can be restored.
Access control and passwords
A website’s security also depends on who can reach its admin area and the data it stores. Each user should have only the permissions their role needs, avoiding shared accounts and unnecessary access.
Strong passwords, multi-factor authentication where available and removing accounts that are no longer used all reduce the risk of improper access. These measures matter most when several people or service providers help run the website.
Privacy policy and cookies
The privacy policy should explain clearly what data is collected, for what purposes it is processed, how long it is kept and how people can exercise their rights. Under the applicable law, these rights include access, rectification, erasure and objection to processing.
Cookies should also be assessed according to their purpose. Those that are not strictly necessary generally require prior consent, and visitors should have clear information and an effective way to accept or refuse them. A link to the privacy policy alone does not meet the obligations that apply to cookie consent.
What to do after a security breach
Even with preventive measures, incidents can happen that compromise the confidentiality, integrity or availability of personal data. In that situation, the business should assess the incident, take steps to contain it and document the decisions taken.
Where there is a personal data breach, the GDPR requires notifying the competent supervisory authority without undue delay and, where possible, within 72 hours of becoming aware of it, unless it is unlikely to result in a risk to people’s rights and freedoms. Where the risk is high, the people affected may also have to be informed.
Want to check whether your website covers these points? We can go through it in a free consultation.