Everyone is afraid of having their personal information stolen, which is why the General Data Protection Regulation was adopted. The GDPR sets regulations for the collection and processing of personal information of EU citizens, which is great, right? We all want more protection. However, that does mean our websites need to follow some rules to comply with GDPR so as not to get fined.

The first step is to access where your data is being stored. The GDPR rules require you to know where all of the personal data is being kept. Next is to identify what information you have and don’t have, and organise it accordingly. Once you have an inventory, you need to set up the correct level of protection. GDPR allows three techniques: pseudonymization, encryption, and anonymization.

The last step is to audit. You’ll need to show regulators that you know what personal data you have and where it’s regulated, prove how the data is used and why, and have an appropriate process to manage things like data breach notifications or the right to be forgotten.