GDPR and website security

What does the GDPR say?

Article 32 of the GDPR requires you to protect personal data with appropriate technical and organisational measures. What is appropriate depends on how sensitive the data is and what it would cost the people affected if it got out.

The article also mentions a process for regularly testing, assessing and evaluating whether the security works. A security test is a concrete way to do that and to document it.

Where is the personal data on a typical website?

• Contact and quote forms with name, email and phone
• Customer accounts, orders and addresses in a webshop
• Sign-ups for newsletters and events
• Backups and exports stored on the server

If something goes wrong

If a security breach affects personal data, it must as a rule be reported to the data protection authority within 72 hours. If the risk to the people affected is high, they must be told too. Avoiding the breach is far easier than handling it afterwards.

Note

This guide is a practical introduction, not legal advice. If you are unsure about your obligations, the guidance from the Danish Data Protection Agency at datatilsynet.dk can help.