Whenever a customer fills in a form, requests a quote or makes a purchase on a website, they may be sharing personal data such as their name, email address, phone number or address. The business responsible must take steps to ensure that this information is collected and used appropriately, in line with the General Data Protection Regulation (GDPR).
Data protection goes beyond publishing a privacy policy. It requires attention to the website’s technical security, access management, data retention and incident prevention procedures.
Secure connection (HTTPS)
The HTTPS protocol encrypts communication between the visitor’s browser and the website’s server, reducing the risk of the transmitted data being intercepted. It is especially important for contact forms, client areas and online shops.
HTTPS is an important security measure, but it does not mean the website is protected against every attack. Server configuration, application security and regular maintenance are still needed.
Collecting and processing personal data
The GDPR states that personal data must be adequate, relevant and limited to what is necessary for the purposes for which it is collected. In a quote request form, for example, it may be enough to ask for a name, a way of getting in touch and a description of the service required.
The business must also identify an appropriate legal basis for the processing and inform the data subject of the purpose of the collection, the retention period, who will receive the information and the rights they have.
Updates and backups
An outdated website may have vulnerabilities that make unauthorised access or the installation of malicious software easier. Updating the system, components and extensions, where applicable, helps reduce these risks.
Backups make it possible to recover content and information after a technical failure, an attack or accidental deletion. To be effective, they should be made regularly, stored securely and tested periodically to confirm the information can be restored.
Access control and passwords
A website’s security also depends on who can access its admin area and the data stored on it. Each user should have only the permissions they need for their role, avoiding shared accounts and unnecessary access.
Using strong passwords, multi-factor authentication where available and removing accounts that are no longer used helps reduce the risk of unauthorised access. These measures are particularly relevant when several people or service providers are involved in managing the website.
Privacy and cookie policy
The privacy policy should clearly explain what data is collected, for what purposes it is processed, how long it is kept and how data subjects can exercise their rights. These rights include, under the conditions laid down by law, access, rectification, erasure and objection to the processing of their data.
Cookies should also be assessed according to their purpose. Those that are not strictly necessary generally require prior consent, and visitors should have clear information and an effective way to accept or refuse them. A link to the privacy policy is no substitute for a proper consent mechanism.
What to do after a security breach
Even with preventive measures, incidents may occur that compromise the confidentiality, integrity or availability of personal data. In such a situation, the business should assess the incident, take steps to contain it and document the decisions taken.
Where a personal data breach is involved, the GDPR requires notification to the competent supervisory authority without undue delay and, where feasible, within 72 hours of the controller becoming aware of the breach, unless it is unlikely to result in a risk to people’s rights and freedoms. Where the risk is high, it may also be necessary to inform the data subjects.