SSL Certificates

Did you know that Google is going to start forcing websites to have SSL certificates this summer? Google is trying to get every site safe for visitors to visit and fill out information forms, contact or otherwise (their immediate focus is on sites that have password and credit card fields). Without an SSL Certificate, your site may be flagged as unsafe for visitors to view. SSL stands for Secure Sockets Layer and is the standard for encrypting data sent through websites. It ensures that data passed between browser and server remains private. It also reassures the visitor that your site is safe.

SSLs not only encrypt sensitive information, but they provide protection from hackers. Hackers have recently release malicious codes specifically targeting data moving between browsers and servers.

There are several methods of adding SSL to your website.

• First, check with your hosting provider, they may have a free SSL you can install
• Let’s Encrypt, https://letsencrypt.org/, provides free SSL certificates, although, you will have to manually renew them every 90 days. Depending on your website framework and hosting provider, the instructions will be different.
• Comodo SSL, https://ssl.comodo.com/, has varying prices on their SSL certificates, depending on the features you want

GDPR

How does the new European GDPR affect your online presence? As of May 25^th all European companies have to be GDPR compliant, and all companies that interact with EU citizens are expected to be compliant. The penalty for not being compliant is a fine up to 4% of annual revenue. GDPR requires the “right to be forgotten”, 72 hours customer notification of data breaches, and stricter consumer consent.

Again, how does this affect you? According to Article 3 of the new regulations, if you collect any data from someone in an EU country, you are subject to the conditions of the new regulations. If you are collecting data from an EU citizen who is not in the EU, you are not subject to the regulations. Data also refers to any information gathered about a person, including contact forms, meaning, this does not only apply to those who run stores or take payments online.

Yet, if your marketing does not specifically target anyone in the EU, and someone from the EU uses Google to search in English and comes across your site, they are not subject to GDRP.

Convoluted huh? If you are wanting to be on the safe side, add a Privacy Policy, Terms and Conditions, SSL Certificate, and a means of people to request their data be expunged.

What does compliance mean?

1. Privacy Program
   1. Privacy Policy
      You can generate one online, https://termsfeed.com/privacy-policy/generator/
   2. Compliant Handling
      Make sure you have a form that makes it easy for visitors to get a hold of you
   3. Monitoring
      Security plugins are available for WordPress and other types of sites. They will monitor blacklisting, malware, and breaches
   4. Security
      Make sure your site has an SSL certificate attached, as well as Captcha. Never take passwords without an SSL
   5. Data Retention
      You need to come up with a policy of how long data is kept on your site, in your databases, and state it clearly
   6. Transparency
      What are you collecting, specifically, and how are you using it, specifically
   7. Data Breach Notification
      A means of contacting your entire client base in case of a hacker or other data breach
   8. Individual rights request
      A means of an individual contacting you and/or requesting their data be removed

What are the possible hindrances from achieving GDPR compliance?

1. Limited skilled help
2. Access to guidance
3. Lack of centralized data gathering and storing processes

Tools

1. WordPress plugins
   I am using a WordPress plugin called The GDPR Framework. What I like about this one is that it generates a Privacy Policy for you and gives the visitors a tool to export and delete their personal data from the website. They are in the process of creating a cookie solution. There are many more out there.
   Here is an example from Forbes, https://www.forbes.com/fdc/privacy.html
   Here is an example of a client site, http://blakeandpowell/privacy-policy/
   Security Audit Log plugin, https://wordpress.org/plugins/wp-security-audit-log/
   Wordfence plugin, https://wordpress.org/plugins/wordfence/
2. TrustArc
3. AWS has GDPR compliance features, https://aws.amazon.com/compliance/gdpr-center