GDPR states that if a website collects, stores or uses any data, personal or otherwise (data that can be used to identify a person) related to an EU citizen, then you as an online business must comply with the following:

• Tell the user: who you are, why you collect the data, for how long and who receives it.
• Get clear consent from users before collecting any data
• Let users access their data and take it with them
• Let users delete their data
• Let users know if data breaches occur

Personal data can only be kept for as long as it is required for the initial purpose and must be protected in accordance with the new rules. Both the controller and the processor are required to “implement appropriate technical and organisational measures to ensure a level of security appropriate to the risk”, including data encryption or pseudo-anonymisation (“the processing of personal data in such a way that the data can no longer be attributed to a specific data subject without the use of additional information”).

The European Commission have provided this helpful info graphic, illustrating exactly how to stay on the right side of data Protection Law.

Not following these guidelines will eventually result in a fine. Up to 20 million € or 4% of your annual turnover – so quite a bit of money.