Here’s the first steps to compliance on your marketing sites.
DESIGN
Opted-Out By Design: everything has to be opt-in by design, and no “opt in” boxes should be checked automatically.
Affirmative Cookies: Currently the standard text phrase that is included in Cookie notices is “by using this site, your accept cookies.” Under GDPR this is no longer going to be compliant, as it only suggests implied consent. You will now need granular levels of control with separate consents for tracking and analytics cookies, as well as mechanisms to also signal customer consent. They need to make an affirmative action.
Data Transparency: You must clearly state how the data you’re collecting will be used. We recommend a prominent, clear link on forms that link to your Privacy Policy.
Data Limitations: You should limit data to what actually needs to be collected and should be tied to one of the lawful bases for processing:
Consent: Has the individual given you clear consent for you to process their personal data for a specific purposes
Contract: The processing is necessary for a contract you have with the individual, or because they have asked you to take specific steps before entering into a contract.
Legal Obligation: The processing is necessary for you to comply with the law (not including contractual obligations).
Vital Interests: the processing is necessary to protect someone’s life.
Public Task: the processing is necessary for you to perform a task in the public interest or for your official functions, and the task or function has a clear basis in law.
Legitimate Interests: the processing is necessary for your legitimate interests or the legitimate interests of a third party unless there is a good reason to protect the individual’s personal data which overrides those legitimate interests. (This cannot apply if you are a public authority processing data to perform your official tasks.)
Regular Purging: This data must also be purged periodically and can’t be kept indefinitely.
Due Diligence: For platforms, like Wordpress that use plugins (especially ones for forms, giveaways or other sign-ups), due diligence must be performed to understand compliance with GDPR and potentially changing or abandoning tools that are in use today.