What is the GDPR? Definition for website owners

The GDPR is the EU's data protection law. It sets rules for collecting and using personal data about people in the EU, including data gathered on websites.

How it works

The General Data Protection Regulation, Regulation (EU) 2016/679, has applied since May 25, 2018 (EUR-Lex). A few of its articles do most of the work for a website:

• Scope (Article 3). It covers organizations in the EU, and also those outside it that offer goods or services to people in the EU or monitor their behavior there.
• Personal data (Article 4). Any information about an identifiable person, including names, email addresses and online identifiers.
• Principles (Article 5). Collect data for a clear purpose, keep only what you need, keep it accurate and secure, and do not keep it longer than necessary.
• Lawful basis (Article 6). Every use needs one of six bases: consent, a contract, a legal obligation, vital interests, a public task or legitimate interests.
• Transparency (Article 13). When you collect data, tell people who you are, why you collect it, the lawful basis, who receives it and how long you keep it.
• Rights (Articles 15 to 22). People can access, correct and erase their data, object to some uses, and more.
• Processors (Article 28). Vendors that handle data for you need a contract, often called a data processing agreement.
• Fines (Article 83). The highest tier is up to 20 million euros or 4% of worldwide annual turnover, whichever is higher.

Cookies and similar browser storage fall under a separate law, the ePrivacy Directive. Its Article 5(3) requires consent to store or read information on a visitor's device unless that is strictly necessary for a service the visitor asked for (EUR-Lex).

Why it matters for your website

Contact forms, chat widgets, booking tools, analytics and newsletter sign-ups all collect personal data. For each one, you should be able to say what it collects, why, on which lawful basis, which vendor processes it, and when it is deleted. Answering a question someone asked is a different purpose from adding them to a marketing list, and the two usually need different bases.

This is a summary, not legal advice. National regulators publish guidance, and a privacy professional can help with your specific setup. Our article on what to tell visitors about AI chat covers chat in more depth.

Example

A visitor in Germany asks a site's chat assistant about pricing and leaves an email for a follow-up. The site:

• shows a one-line notice before the email field, linking to the privacy policy;
• uses the email to answer that question, citing legitimate interests or steps taken at the visitor's request;
• offers newsletter sign-up as a separate, unticked option;
• has a data processing agreement with the chat vendor;
• deletes chat transcripts after a set period stated in its policy.

Related terms

• EU AI Act: the EU's separate law on AI systems.
• Website widget: third-party tools that collect data on your pages.
• CRM: where personal data from your site usually ends up.
• Human handoff: passing a conversation, and its data, to a person.