![\"GDPR](\"https:\/\/www.gravityforms.com\/wp-content\/uploads\/2018\/11\/Screen-Shot-2018-11-12-at-11.36.58-AM.png\")
<\/p>\n<\/p>\n
We\u2019ve been talking about the GDPR for years at this point.<\/p>\n
And while we\u2019re sure that your site is already updated according to the new procedure, you might want to circle back and make sure that your web forms meet the new criteria as well.<\/p>\n
From obtaining active consent to explaining why you need to collect personal data in the first place, there are a few things to consider when looking at your web forms.<\/p>\n
Below, we\u2019ll give you a quick refresher on the GDPR and why it matters, as well as some key elements you must include in all forms that collect personal data.<\/p>\n
<\/p>\n
[content_upgrade cu_id=\"13016\"]Worried about compliance? Download your GDPR checklist here for some extra help.[content_upgrade_button]Click Here[\/content_upgrade_button][\/content_upgrade]<\/p>\n
The General Data Protection Regulation<\/a>, or GDPR, is a set of data collection regulations in the European Union.<\/p>\n To put it simply, this is a massive undertaking that has overhauled the existing data protection legislation governing how EU companies handle consumer data\u2014this includes the collection process, consent, and what they do with the data once it\u2019s in their hands.<\/p>\n The new law, which rolled out in May 2018, brings a standardized approach to how companies collect, control, and process data across the EU.<\/p>\n The GDPR also seeks to give residents more agency over who owns their data and how it can be used. Companies must now obtain consent before collecting website visitors\u2019 data.<\/p>\n This rule replaces the existing EU data protection directive, an initiative created in 1995, before the internet era came into its own.<\/p>\n The law addresses a long list of concerns, from breach notifications to opt-in consent, and increases fines for those who violate privacy and protection practices, as determined in the law.<\/p>\n As a result, businesses will need to permanently change how they collect data from customers, store that information, and use it moving forward.<\/p>\n The main changes taking place here involve obtaining explicit consent from an individual. What\u2019s more, informing visitors isn\u2019t enough. Forms must also collect active approval from the user\u2014so there\u2019s proof of an informed decision.<\/p>\n Additionally, the GDPR gives web users the right to be forgotten. In other words, if someone requests their data be deleted, or there is no reason for an organization to keep data on file, then it must be removed.<\/p>\n Fail to comply with the GDPR and you\u2019re looking at a whole mess of trouble. Fines for noncompliance<\/a> can top 4% of an organization's total revenue or \u20ac20 million\u2014whichever of the two is worth more.<\/p>\n That said, that is the maximum fine. There is a tiered penalty structure in place, with fines matching the severity of the offense. For example, if a company\u2019s forms automatically fill in the consent checkbox, that fine likely won't get anywhere near that 20 mil. mark.<\/p>\n In addition to the financial burden of GDPR fines, other consequences spell disaster for companies that fail to comply.<\/p>\n For one, companies who do not comply may see a reduction in public perception. In light of recent data breaches and lack of transparency on the part of companies like Facebook, lack of compliance could open the floodgates for public scrutiny. Customers don\u2019t like knowing that their data is unprotected--and negative publicity can have a worse impact on the future success of your company than the fines.<\/p>\n With that in mind, there are a few things you should consider when looking at your forms.<\/p>\n One of the most significant changes associated with the new law is that it is now mandatory to get consumer consent on your forms.<\/p>\n Consent must be obtained before asking for an email, a name, or any other personal information. This rule also applies to collect any tracking information such as location or cookies.<\/p>\n We\u2019ve gone over this before, but the easiest way for visitors to give consent is by adding a checkbox to any forms that need to be compliant.<\/p>\n As we mentioned in a previous article on consent, the checkbox indicates agreement when checked. You\u2019ll also need to include a consent title and a consent description.<\/p>\n In the below example, you\u2019ll see the title, the checkbox label, and the description, which in this case, is a look at the terms and conditions.<\/p>\n Source<\/a><\/p><\/div>\n A quick note about new contacts versus existing contacts: because older customers may have signed up before the rule change, you might want to send an update to your contacts letting them know the about the policy change.<\/p>\n You probably received several emails from every company you\u2019ve made contact with since the inception of the internet.<\/p>\n The reason for this is, all companies\u2014at least those with EU-based customers--are required to collect consent from all of those contacts in their database. If you haven\u2019t already, you\u2019ll need to make sure you send an email to everyone on your list that includes a link to update their account.<\/p>\n New contacts are pretty straightforward. Once you\u2019ve updated your forms, new subscribers will be able to give explicit consent when they use your signup form.<\/p>\n Another aspect of GDPR compliance is making sure that consumers have access to their data at any time. This means customers can edit, delete, or view their account details.<\/p>\n We should mention that allowing users to view or edit submissions isn't a core Gravity Forms feature. But, it is possible with third-party add-ons like GravityView by Katz Web Services, or Gravity Forms Sticky List by 13pixar.<\/p>\n Another workaround can be found inside the Personal Data tab in your WordPress Form Settings. This allows you to integrate form entries with the WordPress Export Personal Data tool. And from there, you can export the details to your customer.<\/p>\n As you\u2019ll see in the image below, website owners can elect to retain, trash, or delete entries automatically.<\/p>\n Source<\/a><\/p><\/div>\n Under the GDPR rule, websites are only allowed to keep data around as long as reasonably needed. So, you can choose to delete an entry after a certain number of days\u2014as well as how long the entry stays in the trash after being removed.<\/p>\nPenalties of Violating GDPR<\/h2>\n
1. Are You Obtaining Active Consent?<\/h2>\n
![\"GDPR](\"https:\/\/www.gravityforms.com\/wp-content\/uploads\/2018\/11\/Gravity-Forms-Consent-Fields-1024x616.png\")
2. Are You Handling Data Requests Properly?<\/h2>\n
![\"GDPR](\"https:\/\/www.gravityforms.com\/wp-content\/uploads\/2018\/11\/Gravity-Forms-GDPR-Retention-1024x576.png\")
3. Have You Stated Why<\/em> You Need the Data?<\/h2>\n
![\"GDPR](\"https:\/\/www.gravityforms.com\/wp-content\/uploads\/2018\/11\/WP-Delete-a-Record-1024x394.png\")