If your business offers goods or services to people in the EU, check five things today: the privacy policy, consent on forms, analytics and ad tags, the services that process data for you, and how you will answer requests.

The day before

The European Union's General Data Protection Regulation, usually shortened to GDPR, applies from tomorrow.

Inboxes are full of revised privacy policies and requests to opt in again, and some Canadian owners are wondering what they have missed.

The regulation reaches a Canadian business that offers goods or services to people in the EU, or monitors their behaviour. Whether yours is one should already be settled.

If it is, here is a last pass over the five places it usually touches a small business website. It is general information, not legal advice.

Five places to look

The fourth is the one most small businesses have not considered, because the host, the newsletter service and the booking system feel like tools rather than parties to an agreement.

A privacy policy that matches the site

A copied template is the usual problem. It lists things the business does not do and leaves out the tools it does use.

Under GDPR, the policy has to name the business and give a way to contact it, then say what you collect, why, and on what legal basis.

It also has to say who receives the information, how long you keep it, what rights people have, and that they can complain to a data protection authority in Europe.

Write it in plain words, date it, and link to it from every form.

Consent on forms

Consent under GDPR has to be a clear, active choice. A box that arrives already ticked does not count, and neither does silence.

Each purpose needs its own choice, so a booking form that also signs people up for the newsletter needs a separate, unticked box for the newsletter.

Not every form needs a consent box. Somebody who sends a question expects an answer, but the form should still say how their details will be used.

Where consent is the basis, keep a record of it: when it was given, through which form, and the wording at the time.

Analytics and advertising tags

Analytics records visitors whether or not they fill anything in, so it belongs on the list.

Check three things: the option in the tracking code that masks part of each visitor's IP address, the data retention period that takes effect tomorrow, and the data processing terms offered in the account settings.

Check too that no email addresses appear in page addresses. Some forms put them in the link to the thank-you page, and Analytics records the whole link.

Remarketing tags and social media pixels follow visitors for advertising, and for people in Europe they generally need consent first.

If the site carries ads, decide whether European visitors are asked for consent or shown only non-personalised ads.

A worked example

A fishing lodge on the north coast takes most of its bookings from Canada and the United States, and a steady trickle from Germany and the Netherlands.

A German-language page and quotes in euros make it plain that the lodge offers its services to people in the EU.

A pass through the five places last week found three problems.

The enquiry form had the newsletter box ticked in advance, and the form plugin had kept every enquiry since 2012, including guests who never booked.

The privacy policy, copied years ago from a hotel site, described a loyalty program the lodge has never had.

The fixes took two days: an unticked box, old entries deleted, a policy describing the lodge's own tools, and a list of every service holding guest details.

Processors

A processor is any outside service that handles personal information for you: the host, the newsletter service, a booking system, a form tool, a customer database.

GDPR requires a written contract with each one covering how the data is used and protected. Most large providers have published terms for this in recent weeks.

They are often accepted in the account settings or already part of the terms of service. Find them, save a copy, and ask any small supplier who has none.

Answering requests

People can ask what you hold about them, ask for it to be corrected or deleted, ask for a copy, or object to how it is used.

The regulation expects an answer within a month, which is not long if nobody knows where the data lives.

Usually it lives in more places than expected: an inbox, stored form entries, the newsletter list, a spreadsheet, the booking system.

Give requests one address that somebody reads, and decide how you will confirm that the person asking is the person concerned.

On a WordPress site, last week's update added tools to export or erase one person's data. They do not reach the inbox or the newsletter list.

Canadian law still applies

None of this replaces Canadian privacy law. Depending on where and how your business handles personal information, that means PIPEDA or, in some provinces, a private-sector privacy law of the province's own.

Much of the work overlaps. A plain policy, clear consent and knowing where data lives serve both, and they keep mattering after tomorrow, whenever the site gains a new form or tool.

The counter-case

For a business whose customers are all in Canada, most of this is good practice rather than a European obligation.

An electrician serving the Fraser Valley, with the occasional visitor from abroad, is not offering services to people in the EU, and tomorrow does not change that.

A business with significant European sales, sensitive information or staff in Europe needs a lawyer's review rather than a checklist, and may need to appoint a representative in the EU.

For everyone in between, the five places are where the regulation meets the website, and an afternoon on them today is well spent.

Today

  1. Read the privacy policy against what the site does.
  2. Untick every pre-ticked box on every form.
  3. Give the newsletter its own consent box.
  4. Check Analytics for email addresses in page links.
  5. List every processor and save their terms.
  6. Set up one address for privacy requests.
  7. Write down where personal data lives.

Step seven is the one that makes the others possible, since a policy cannot be accurate and a request cannot be answered until somebody knows where the information is.

Whether the regulation reaches your business at all is covered in does GDPR apply to a Canadian business.

Frequently asked questions

When does GDPR start to apply?

Tomorrow, May 25. It reaches a Canadian business that sells to or serves people in the EU, or monitors their behaviour, not one with occasional European visitors.

What should the privacy policy say?

The business's name and contact details, what you collect and why, the legal basis, who receives it, how long it is kept, and what rights people have.

Does every form need a consent box?

No. Somebody sending a question expects a reply. A newsletter needs its own unticked box, and consent should be recorded with the date and the wording used.

What is a processor?

Any outside service handling personal data for you, such as the host, newsletter service, booking system or form tool. GDPR requires a written contract with each one.

How quickly must requests be answered?

Within a month, which is manageable only if you know where personal data lives: inboxes, stored form entries, the newsletter list, spreadsheets and the booking system.

Is this legal advice?

No. It is general information about where the regulation usually touches a small business website. A lawyer who knows your business should confirm what applies to it.

West Coast Media Solutions Inc. provides web design, web development, hosting, digital marketing, and business consulting to organisations across Canada, drawing on more than twenty-five years in the field.

European customers and an old enquiry form?

Send us your site address. We will go through the five places with you and show what needs changing first.

Start a Conversation