Practical guides on websites, online stores, and getting found on Google — written for business owners, not developers.
Tell us about your business today — get a free quote within 24 hours. No pressure, no confusing tech talk.
Tell us about your business today — get a free quote within 24 hours. No pressure, no confusing tech talk.
WordPress GDPR compliance goes beyond cookie banners. Learn the 7 requirements, the security rules, and the 72-hour breach clock most guides skip.
When we opened the user list on a client's hacked WordPress site, we found five administrator accounts nobody had created. The oldest dated back to March 2025. They had been sitting there for over a year.
Every form entry, every user record and every order on that site was reachable from those accounts the whole time.
The site had a cookie banner. It had a privacy policy. By the standard most GDPR guides set, it looked compliant.
That is the gap this guide covers. GDPR on WordPress is about what data your site holds and who can get to it. The cookie banner is the smallest part of the job.
Below are the requirements that actually matter, including the security and breach rules most guides skip. This is practical guidance from a team that cleans up hacked sites, not legal advice.
GDPR follows your visitors, not your server. If people in the EU can fill in a form on your site, leave a comment, buy something or get tracked by analytics, the regulation applies. It does not matter whether your business sits in Dhaka, Singapore or Texas.
On a self-hosted WordPress site, you are the data controller. You decide what gets collected and why. Your host, your plugins and every outside service they connect to act as processors on your behalf.
The UK runs its own version, called UK GDPR. For a site owner the requirements are close to identical, so everything below covers both.
Most site owners underestimate this list. WordPress collects some of it on its own. Plugins add the rest.
Source | What it collects |
|---|---|
Comments | Name, email, IP address, browser user agent |
User accounts | Email, username, profile details |
Gravatar | A hashed copy of the commenter's email, sent to Gravatar |
Embeds (YouTube, Maps) | Visitor IP, sent to the embed provider |
Contact forms | Every field, plus IP and user agent in many plugins |
Analytics | Cookies and IP address |
Google Fonts loaded from Google | Visitor IP on every page view |
WooCommerce | Names, addresses, phone numbers, order history |
Security plugins | Visitor IPs in firewall and login logs |
An IP address counts as personal data under GDPR. That one fact pulls almost every plugin on your site into scope.
Your plugin list is your real data map. Every plugin that touches visitor data is a processor you answer for. Our guide to WordPress plugin security shows how to audit that list.
GDPR needs a reason for every piece of data you hold. Consent covers marketing emails and tracking. Contract covers the details a customer gives you to complete an order. Legitimate interest covers security logging. Pick one basis per purpose and write it down.
WordPress ships a privacy policy template under Settings > Privacy. Treat it as a first draft. It knows about core features and nothing about your plugins. Your policy needs to name every plugin and outside service that handles visitor data. That includes your security plugin, which most templates miss.
A banner that appears after analytics has already fired does nothing. Non-essential scripts must wait until the visitor says yes. Rejecting has to be as easy as accepting. Keep a log of each choice.
Cookies your site needs to function, such as login, cart and security cookies, do not need consent.
While you are here, host Google Fonts locally. In 2022 a Munich court ordered a site owner to pay damages for loading them from Google's servers.
<!-- AFFILIATE SLOT: consent plugin, only if natural -->
Every field is data you now have to protect. Remove fields you do not use. Leave marketing opt-in checkboxes unticked by default. Set a retention period for stored entries, or stop saving entries to the database if the email notification is enough.
Visitors can ask for a copy of their data or ask you to delete it. WordPress handles both under Tools > Export Personal Data and Tools > Erase Personal Data. You have one month to respond. Run a test export on your own account now, so the first real request is not also your first attempt.
Your host, email service, form service, analytics tool and backup provider all process data for you. Each one needs a data processing agreement (DPA). Check where each stores its data. Transfers outside the EU need a legal mechanism, and a good DPA names it.
<!-- AFFILIATE SLOT: host with EU data centre and a published DPA -->
Keep a short record of what you collect, why, where it lives and how long you keep it. Then actually delete. Old form entries, abandoned user accounts and stale logs add risk and nothing else. Our guide to WordPress user roles and permissions includes a 20-minute audit that clears out accounts nobody uses.
Most WordPress GDPR guides reduce this part to one line. Article 32 requires "appropriate technical and organisational measures" to protect personal data.
On WordPress, that means updated core, plugins and themes. It means two-factor authentication on every admin account. It means least-privilege roles, a firewall and a record of who changed what.
Security tools raise their own GDPR question. A firewall logs the IP of every visitor it checks, and login protection does the same. GDPR allows this. Recital 49 treats network and information security as a legitimate interest, so you do not need consent. You do need two things. Disclose the logging in your privacy policy, and set a retention period.
That second part is harder than it sounds. When we ran MalCare on a live client site, its firewall log recorded the IP, country, path and user agent of every request. Nowhere in the interface did it say how long those logs are kept. Ask your vendor, then write the answer into your policy.
Start with brute force protection and a WordPress activity log. Both close gaps attackers use. Both give you evidence if something goes wrong. For everything we found running MalCare, see our MalCare review.
A hack that exposes, changes or deletes personal data is a personal data breach under GDPR. That makes it a legal event, not just a technical one.
Article 33 gives you 72 hours from becoming aware of the breach to notify your data protection authority. The only exception is a breach unlikely to put anyone at risk. If the risk to people is high, Article 34 also requires you to tell them directly.
The clock starts at awareness, not after a full investigation. You can file what you know and add details later. If you decide not to notify, document that decision and your reasoning.
Go back to those five admin accounts. On a site like that, the first question after cleanup is not which files to delete. It is what those accounts could see, and for how long. You cannot answer that without evidence, so preserve your logs before you clean anything. Our hacked site investigation guide walks through the order. Our recovery case study shows it on a real site.
If you are inside that 72-hour window right now, our WordPress malware removal service starts with evidence preservation.
In November 2025, the European Commission proposed moving cookie rules into GDPR itself. The package also adds browser-level consent signals and simplifies breach reporting.
It is not law yet. As of September 2026, the GDPR part is still in negotiation. The Council's June 2026 text dropped several of the cookie provisions, and final adoption is not expected before late 2026 at the earliest.
Some guides already describe these rules as in force. They are not. Comply with today's rules and choose a consent tool that can adapt later.
Requirement | Where to check |
|---|---|
Privacy policy names every plugin and service | Settings > Privacy |
Non-essential scripts wait for consent | Consent plugin settings |
Google Fonts hosted locally | Theme or font plugin |
Marketing opt-ins unticked | Each form |
Form entry retention set | Form plugin settings |
Data export and erase tested | Tools > Export / Erase Personal Data |
DPAs on file for host and services | Your records |
Security log retention disclosed | Privacy policy |
2FA on every admin account | Security plugin |
Unused accounts removed | Users |
Breach plan with the 72-hour rule | Your records |
That client site had a cookie banner and a privacy policy. What it lacked was control over who could reach its data. Most GDPR checklists would have passed it anyway.
Fix the paperwork, then fix the access. If you want a second pair of eyes on the security side, our WordPress security audit checks exactly the Article 32 gaps covered here.
No. WordPress core gives you the tools, including a privacy policy template, data export and erasure, and a comment cookie checkbox. Compliance depends on your plugins, your settings and how you handle data.
No plugin makes a site compliant on its own. A consent plugin handles cookies. It does not write your policy, sign your DPAs or protect your data.
Yes. Security counts as a legitimate interest under Recital 49. You still need to disclose the logging and set a retention period.
Yes, if you offer goods or services to people in the EU or track their behaviour on your site.
Written by AppDeel Editorial Team
The AppDeel Editorial Team draws on designers, developers, SEO, security, growth marketing, social media and AI automation specialists who have worked with businesses for over ten years. Every article is researched thoroughly before publishing and reviewed by whichever specialist actually does that work. The team is led by Azizul Hakim, founder of AppDeel.
Read more posts by AppDeel Editorial Team →A WordPress activity log only works if it records the right events, keeps them long enough, and survives an attacker.
Add HTTP security headers and a Content Security Policy to WordPress without breaking your site. Apache, Nginx, Cloudflare and plugin methods.
What each WordPress user role can do, who should get which one, where Editor and Contributor carry hidden risk, and a 20-minute user audit.
Does changing the wp_ database prefix stop SQL injection? See what the evidence says, what can break, and when it's still worth doing.
Tell us about your business today — get a free quote within 24 hours. No pressure, no confusing tech talk.
