Under GDPR, you need to make sure that:

#1 Your website users can request access to their personal data (name, email address, comments or any other data submitted to your website).

#2 Your website users can download and view their personal data (as per Article 15 of GDPR).

#3 Your website users can request for their personal data to be removed (as per Article 18 of GDPR).

WordPress released a maintenance and privacy update in its version 4.9.6 esp. to comply with these GDPR guidelines. This update include two new features through which you can export and/or delete personal data of your website users.

You can find these features under the ‘Tools’ menu in your WordPress admin panel:

Here is how these features work.

#1 Sending personal data to your WordPress website user on demand

Navigate to the ‘Tools’ menu in your WordPress admin panel and then click on the ‘Export Personal Data’ link.

Add the email address of the user in the text box, who requested access to his personal data and then click on the ‘send request’ button:

The user then gets an email, in his inbox:

Following is the content of this email:

The user clicks on the confirm link, to confirm the export of personal data.

You as a DPO (data protection officer) for your company, get an email notification which confirms that the user has agreed to the exporting of his personal data, by you:

You click on the link under the text ‘You can view and manage these data privacy requests here:’.

You are then redirected to the ‘Export Personal Data‘ page where you can either download the user’s personal data or email the personal data to the user, who requested the access:

When you click on the ‘Email Data‘ button, the user gets a notification email, which contains a link to download the personal data:

The user get the personal data in the form of a zip file and it could look like the one below:

#2 Deleting personal data of your WordPress website user on demand

Navigate to the ‘Tools’ menu in your WordPress admin panel and then click on the ‘Erase Personal Data’ link.

Add the email address of the user in the text box, who requested the deletion of his personal data and then click on the ‘send request’ button:

The user then gets an email, in his inbox:

Following is the content of this email:

When the user clicks on the link to confirm, he sees the following screen:

You as a DPO (data protection officer) for your company, get an email notification which confirms that the user has agreed to the deletion of his personal data, by you:

You click on the link under the text ‘You can view and manage these data privacy requests here:’.

You are then redirected to the ‘Erase Personal Data’ page where you click on the ‘Erase Personal Data‘ button:

When you erase the personal data, your user gets following email notification which confirms that his personal data has been deleted:

WordPress Privacy Setting

WordPress version 4.9.6 has got a new feature called ‘Privacy’ under the ‘Settings’ menu:

Click on the ‘Privacy’ link and then select the existing page from the drop-down menu, which outlines your privacy policy:

Click on the ‘create new page’ button, if you already do not have a page which outlines your privacy policy.

You can also directly edit/view your existing privacy policy, by clicking on the ‘edit’ or ‘view’ link, as shown below:

Related Articles:

• Beginners guide to GDPR for marketers and web analysts
• Checklist to become GDPR Compliant with Google Analytics
• Ask these Eight Questions to make your Server Logs GDPR Compliant
• Two Plugins that will make your WordPress website GDPR Compliant pretty fast
• How to find and remove PII from Google Analytics