Eight years on from GDPR coming in to force, most WordPress site owners have got cookie consent covered. You’ve got a consent banner, a cookie policy, and probably a CMP like Cookie Yes or Civic Cookie Control in place. But cookie consent is only part of the picture.
If you WordPress website collects enquiries, processes orders, or relies on third-party plugins (and virtually all of them do), there are several other GDPR obligations that are easy to overlook. This post covers the areas wee most commonly find are missing or out of date when we audit websites.
Important – This post is for general guidance only and does not constitute legal advice. For advice specific to your business and data processing activities, consult a qualified data protection solicitor or your Data Protection Officer.
Contact Forms & The Data They Collect
Contact Form 7, Gravity Forms, WPForms – whatever you use to collect enquiries, demo requests, or newsletter sign-ups, every submission is a data collection event under UK GDPR.
There are a few things to get right:
Lawful Basis
You need one for every type of data you collect, and it can differ between forms. For a quote or demo request, contract (taking steps at a person’s request before entering into a contract) is often the most natural fit, whilst legitimate interest can suit a general sales enquiry where follow up is a reasonable expectation. Consent is better kept for optional extras, particularly marketing. Newsletter sign-ups are electronic marketing, so PECR applies alongside UK GDPR. You need consent, or in limited cases the soft opt-in fir existing customers. The ICO’s guide to lawful basis for processing is the place to start if you’re unsure which applies.
Privacy Notice At Point Of Collection
You must inform users, at the time they submit their data, how it will be used. A small-print link to you Privacy Policy near the submit button satisfies this, but only if your Privacy Policy actually covers what you’re doing with that data. The ICO’s right to be informed guidance explains what must be communicated.
Data Retention
How long does your form plugin store submissions? By default, many store everything indefinitely in the WordPress database. You should have a retention period in place and either delete entries automatically after that period, or review and purge them manually on a schedule. This should be documented in your Privacy Policy.
Where Does The Data Go?
If your form integrations pass data to a CRM, email marketing platform, or spreadsheet, each of those services (including whoever hosts the spreadsheet, such as Google or Microsoft) is typically considered a data processor and needs to be covered in your policy, and ideally, a Data Processing Agreement (more on those below).
WooCommerce Customer Data & The Right To Erasure
WooCommerce stores a significant amount of personal data by default, like names, addresses, email addresses, order history, and payment references. This brings specific GDPR obligations.
Right To Erasure
Under UK GDPR, individuals have the right to request that their personal data be deleted, sometimes called the ‘right to be forgotten’. WooCommerce has built in tools for this, which allow you to export or erase personal data tied to an email address. The ICO is clear that you have one month to respond to such a request. See the right to erasure guidance for the full details.
There is important nuance here, as erasure isn’t always straightforward in WooCommerce. If an order record is subject to a legal retention obligation (HRMC requires transaction records for six years, for example) you cannot simply delete it because a customer asked. The right to erasure is not absolute, but you should document your reasoning whenever you decline a request.
Account Data vs. Guest Data
Registered customers can manage some of their own data from their account dashboard. Guest checkout orders require manual handling. Make sure you have a clear process in place for both scenarios.
Backups
Personal data also lives in your site backups. The ICO notes that erasure extends to backups, though it recognises the practical difficulty. The key obligation is that the data is put ‘beyond use’ even if it cannot be immediately purged from every backup archive.
Third-Party Plugins & Data Processing Agreements
Most WordPress sites use plugins to some degree. A meaningful number of them, such as live chat tools, CRMs, email marketing integrations, analytics platforms, form processors, payment gateways, and so on, process personal data on your behalf. Under UK GDPR, when you engage another organisation to process personal data for you, you are the data controller and they are a data processor.
This relationship must be formalised. The ICO is unambiguous, a written contract is legally required whenever a processor is involved. In practice, this means a Data Processing Agreement (DPA). The good news is that most reputable SaaS providers have pre-written DPAs available. You typically accept them during sign-up or via a link in their legal documentation. Where we act as a processor for our clients’ sites, we provide our own DPA to all new clients.
What you should do:
- Audit your plugins and integrations – Make a list of every tool that touches personal data (HubSpot, Mailchimp, Stripe, Zendesk, Google Analytics, and so on).
- Confirm a DPA is in place – For each one of them. Check the provider’s legal or privacy documentation if you’re not sure.
- Check where data is stored – If any processor stores data outside of the UK, additional transfer safeguards apply. Transfers from the UK to the EEA remain covered by the UK’s adequacy decisions, but transfers to other countries may require Standard Contractual Clauses or another valid transfer mechanism.
- Think about sub-processors – Your processors may themselves use sub-processors. For example, your email marketing platform may use a third-party cloud host. Reputable providers publish sub-processor lists, so it is worth checking.
This is an area where many businesses have gaps simply because nobody has mapped it out. A basic data flow document covering what personal data you collect, where it goes, and who processes it, is both good practice and a solid foundation for demonstrating accountability to the ICO if you were ever audited.
What Your Privacy Policy Actually Needs To Cover
A generic privacy policy copied from a template in 2018 is unlikely to fully meet your current obligations, especially if your tech stack, plugins, or marketing tools have changed since then.
Under UK GDPR, your privacy notice must cover, at minimum:
- Who you are and how to contact you (and your DPO, if you have one).
- What personal data you collect and how.
- Your lawful basis for each specific processing activity, not just a general list.
- How long you retain different categories of data for.
- Who you share data with (processors, third-parties).
- Whether you transfer data outside the UK and on what legal basis.
- How individuals can exercise their rights (access, erasure, rectification, objection).
- How to lodge a complaint with the ICO.
The ICO’s guidance on what privacy information you must provide sets out the full requirements. It’s also worth reading a 2023 ICO enforcement analysis by law firm Mayer Brown, which highlights common mistakes on privacy notices. For example simply listing data types, purposes, and lawful basis’ separately, (rather than linking them clearly to one another) was found to fallshort of UK GDPR requirements.
One other thing to be aware of is that the Data (Use and Access) Act, 2025, whose main data protection provisions came into force in February 2026, introduced updates to the UK’s data protection landscape, including amendments to PECR and the introduction of a new ‘recognised legitimate interests’ lawful basis. The ICO is in the process of reviewing and updating its guidance to reflect these changes. If you haven’t reviewed your privacy documentation since early 2026, now is a good time to do so.
AI Is A New Front To Consider For GDPR Risk
The emergence of Gen Ai has thrown up two new areas of risk that it’s important to consider when it comes to auditing your GDPR compliance.
1. Staff Using AI Tools With Client & Business Data
Generative AI tools like Claude, ChatGPT, and Copilot are now standard in many workplaces, often without any formal policy governing their use. The moment someone pastes a client email, a candidates CV or a list of enquiry contact details into a public AI tool, that personal data has left your control and gone to a third-party you likely have no Data Processing Agreement with.
Employees who use Gen AI at work, will paste company data into it (I’ve even heard of doctors doing this!), and most of this activity happens via personal accounts, rather than a company sanctioned tool with a company account.
Under UK GDPR, personal data entering any AI tool, even for an internal task, like summarising a support ticket, still needs a lawful basis, as it would with any other processor.
If you haven’t already, it is worth putting in place:
- An AI usage policy – A short, simple policy, naming what staff must never input into an AI tool (client data, employee data, financial records, etc.)
- An approved tool – A named enterprise tier account, with a signed DPA, rather than relying on free consumer tiers that usually train on submitted data.
- Staff training – Most exposure comes from busy people trying to save time, not malicious intent. Proper training lowers the risks.
The ICO is actively working on this. A statutory Code of Practice on AI and automated decision-making, covering both how AI is developed and how it is used to make decisions about people, is now required by law following regulations that came into force in May 2026, though it isn’t expected to take effect until 2027. In the meantime, the ICO’s guidance on automated decision-making and profiling is due to be finalised in winter 2026. If you use AI for anything touching hiring, customer and lead scoring, or other decisions about individuals, it’s worth keeping an eye on both.
2. Vulnerabilities Are Being Exploited Faster
The other side of this is that AI hasn’t just changed how businesses use data. It has changed how quickly that vulnerabilities can be exploited, and data can be accessed by bad actors. Data breaches caused by poor security can lead to big fines from the ICO.
Security researchers have reported that AI-powered scanning tools can now identify exploitable vulnerabilities in websites, themes and plugins, far faster than ever before. An AI assisted data breach was reported in Spain recently.
Patchstack’s State of WordPress Security in 2026 report recorded 11,334 new vulnerabilities across the WordPress ecosystem in 2025, a 42% increase on the year before. The pressure point is plugins rather than WordPress itself. 91% of those vulnerabilities were in plugins, and only six were in core, all low priority.
Attackers are also moving quickly. Around half of high-impact vulnerabilities were exploited within 24 hours of disclosure, and Patchstack expects attackers to be increasingly equipped with AI tools that can find and exploit weaknesses with little human input. Nearly half (46%) of vulnerabilities had no developer fix available at the point of public disclosure, which is why updates alone are not the whole answer.
WordPress Core itself announced a Core Security Initiative in September 2026, explicitly aimed at using AI defensively, to find and patch flaws before AI-equipped attackers do.
None of this changes what good practice looks like, but it does raise the stakes for those who skip it. An out-of-date plugin that might once have sat unpatched for weeks without incident is now a much faster target. The practical response is the same one WordPress site owners have always needed, just now it is with even less room for delay:
- Keep everything updated – WordPress core, plugins, and themes, with a defined process for applying security patches promptly.
- Remove what you don’t use – An unmaintained plugin left installed is an unmaintained attack surface.
- Add protection beyond updates – A firewall helps, but Patchstack’s own testing found that generic hosting-level defences blocked only 12% to 26% of WordPress-specific exploit attempts, so look at vulnerability-specific protection and monitoring as well.
- Enforce strong access controls – Strong Admin credentials and two-factor authentication.
Why This Matters For Your GDPR Compliance Specifically
An unpatched site that gets breached isn’t just a security incident, it is very likely a reportable personal data breach, and the ICO’s recent enforcement makes clear it treats poor basic site hygiene as an aggravating factor when calculating fines.
In 2026, the ICO fined South Staffordshire Water almost £1 million for a breach linked to unpatched critical systems, a lack of regular security scans, and inadequate vulnerability management.
In 2025, Advanced Computer Software was fined £3.07 million after a ransomware attack disrupted NHS services, with the ICO pointing to missing multifactor authentication and known, unpatched vulnerabilities as preventable failures.
Neither case involved a WordPress site, but the failings the ICO cited are exactly the ones that leave websites exposed.
A Quick Checklist To Pull It All Together
- All forms have a documented lawful basis and a privacy notice at point of submission.
- Form data is subject to a defined retention period, not stored indefinitely.
- A DPA is in place for every plugin or tool that processes personal data.
- A data flow document exists mapping what data is collected and where it goes.
- WooCommerce’s personal data tools are configured and a process exists for handling erasure requests.
- Your Privacy Policy is up to date and covers all current processing activities, with lawful basis’ linked to specific purposes.
- Cookie consent is handled separately via a CMP under PECR (see our post about cookie consent options for WordPress).
- Google Consent Mode is configured if you use Google Ads or Analytics (see our post on Consent Mode).
- Staff have clear guidance on what data is and isn’t ok to be entered into AI tools, and any AI tools used for business data have signed DPAs.
- WordPress Core, plugins, and themes are kept up-to-date, with a defined process for prompt patching of vulnerabilities, and vulnerability scanning.
Need Help With Your WordPress Website’s Compliance?
If you’re not confident that your WordPress site is fully compliant, or you’ve never done a formal review of your data flows, plugins, and documentation, we can help. We can work alongside your internal Data Protection Officer, to help you identify gaps and implement practical solutions for your WordPress or WooCommerce website, just get in touch to chat about your requirements.
For authoritative guidance on UK GDPR, visit the ICO’s UK GDPR guidance hub. For PECR and cookie specific rules, see the ICO’s Guide to PECR. For legal advice specific to your business, consult a qualified data protection solicitor.
If you’d like to learn more about our WordPress & WooCommerce Support & Maintenance plans, drop us an email or give James a call.
Our plans provide a holistic solution to your website’s performance, reliability and security, and are inclusive of premium tools and services.
