The much commented RGPD is already here and with it all the changes and adaptations that we have to carry out by those of us who have web pages and collect personal data of the users who browse through them.
Is your website adapted to the new regulation? Do you want to avoid the million dollar sanctions that implies being outlawed?
What is the RGPD?
RGPD is the acronym corresponding to the General Data Protection Regulation medical doctor email list, the new regulations with regard to data protection that came into force on May 25, 2016, approved by the European Union.
The objective behind this new regulation is to regulate, take care and protect, even more if possible, the use made of personal data by users, companies and institutions so that their owners have more control over them.
In this way, anyone who collects and stores personal data will have to meet a series of very specific new requirements.
Anyone who collects and stores personal data will have to comply with the new RGPD
Two years after its entry into force, that is to say, on May 25, 2018, compliance with this new regulation is strictly obligatory and will replace the current legislation on data protection.
The new RPGD is common to the entire European Union so, if you or your business is in this territory or you manage data of European citizens, you must adapt to the new law, without exceptions. Otherwise, the penalties you could face are millions.
Copywriting Exclamations Why and how does the new RGPD affect you?
Do you have a blog and use a form to attract subscribers? Do you sell your products and services through an ecommerce? Do you allow users to visit your site leave a comment or contact you? Watch out!
Any form that appears on your website, whatever it may be, in which you collect personal information from your users, will have to be adapted in such a way that it complies with the new General Data Protection Regulation.
In the case of non-commercial websites or blogs that do not generate income, the most common ways of collecting personal data and that you must adapt are:
Contact forms
The ticket comments boxes
The subscription forms to a newsletter
In the case of commercial websites or that generate direct or indirect income, things get a little more complicated since it will be necessary to comply with the LSSI-CE. In addition, in these cases, we can find more complex forms or payment mechanisms to acquire or contract products or services that require additional contracting conditions and a legal notice.
In any case, remember that whenever you collect personal information on your website / blog, whether you generate income or not, you must comply with the RGPD. Therefore, below I summarize the requirements that you must meet and the steps to follow to legitimize your website for the new Data Protection Regulation. Take note!
▷ Exclusive access of students CM Classroom to the RGPD Manual with tutorials, templates and downloadable to adapt your website to 100%.
How to adapt your website to the RGPD
In short, for your website or blog to comply with this new regulation, you must:
Clearly and explicitly provide all information regarding the collection and use of personal data that will be collected.
Enable a mandatory check box for users to give their explicit consent for that treatment and their acceptance of your new privacy policies3
Collect and store that explicit consent.
But, in addition, the information that proportions must be presented in 2 layers in the following way:
- First layer: In which there is a summary of the most important points related to the treatment of the information provided by the user.
- Second layer: In which the information presented in the first layer is completed and extended.
Now, where the crux of the matter really is and where all the modifications that we will have to focus on are centered around what information to capture in each layer and where to include each one of them. Then I summarize it in 3 simple points:
First layer: Summary of Privacy, Legal Notice and Cookies
What should be included in the first layer?
In this first layer we must include a summary of the information on who will be responsible for the data collected and for what purpose will use them (newsletter, news, commercial use …).
In the event that these data are transferred to third parties, it will be necessary to indicate this and, in case of having a DPO (Data Protection Officer) in charge of managing them, your information and contact should also appear.
In addition, we will have to inform the user about the rights he has to access, modify or delete the data he has provided and add a link to a second one.Second layer: Detailed legal documentation
What should be in the second layer?
When we talk about information in “second layer”, basically we mean that it must be presented in a separate url and in a detailed way.
In this second layer, the complete information regarding the Privacy Policy, the Cookies Policy and the Legal Notice must therefore be included (provided that the website has commercial activity).
- Privacy Policy
This section should detail how the owner uses the information collected, the purpose, the period of conservation of that data, the assignment to third parties (if any), etc.
- Notice and Cookies Policy
In the section corresponding to the cookies you must include all the detailed information regarding the use of own or third party cookies and their purpose.
However, this information must be detailed from the moment the user accesses the website through a warning of the existence of these cookies (image) and a button for the user to give their consent with a link to this detailed information.
- Legal Notice
This section must contain the minimum information necessary for the user to know who is behind the web page. That is, who is the owner of the website and a telephone and / or contact email address.
The Legal Notice will only be necessary if there is a commercial activity on your website. That is, on those web pages that provide, advertise or offer a specific product or service. Only blogs or websites that do not perform any type of commercial activity will be excluded from this obligation.
Where should I include this second layer?
The second layer should be hosted on your website, in a separate URL, or in different tabs or in a single one with each of the sections well explained and detailed.
Obtain explicit consent
In addition to the previous modifications and adaptations, in order to comply with the new RGPD we will have to obtain an explicit consent of the use of the data on our part as well as the acceptance of the new privacy policies.
For this, apart from including a “tagline” with the information related to the use of the data, we will have to include a mandatory checkbox through which users can give their explicit consent to the processing of their data for the purposes we have explained.
