Personal data provokes two extremes among site owners. The first: “we are a small site, this does not apply to us”. The second: panic-installing a cookie banner plugin and feeling the matter is closed. Both are wrong.<\/p>\n
A caveat up front: the specific requirements depend on where you operate and whose data you process. This article covers general principles and typical violations; it does not replace legal advice. Check your own position with a professional.<\/p>\n
Considerably more than people assume. It is not only passports and addresses. Personal data is any information by which a person can be identified, directly or indirectly:<\/p>\n
It is the second and third points that pull ordinary website analytics into scope, even though you collect no names.<\/p>\n
| Principle<\/th>\n | What it means<\/th>\n | Typical violation<\/th>\n<\/tr>\n<\/thead>\n |
|---|---|---|
| Lawful basis<\/td>\n | There must be a reason to process the data<\/td>\n | Collecting because “it might come in handy”<\/td>\n<\/tr>\n |
| Purpose limitation<\/td>\n | Use it only for what was stated<\/td>\n | An enquiry email added to a mailing list<\/td>\n<\/tr>\n |
| Minimisation<\/td>\n | Collect only what is needed<\/td>\n | A date of birth field on a contact form<\/td>\n<\/tr>\n |
| Storage limitation<\/td>\n | Delete once the purpose is served<\/td>\n | Eight years of enquiry records<\/td>\n<\/tr>\n |
| Security<\/td>\n | Protect against leaks<\/td>\n | Enquiries in a shared spreadsheet open by link<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n Minimisation is the cheapest way to reduce risk. Every field you do not collect cannot leak and needs no justification. It is that rare case where legal caution coincides with better form conversion.<\/p>\n Grounds for processing<\/h2>\nConsent is not the only basis and often not the best one. The main options:<\/p>\n |