Trew Knowledge

Fernando Claussen

Matthew Farlymn

This plugin is meant to assist a Controller, Data Processor, and Data Protection Officer (DPO) with efforts to meet the obligations and rights enacted under the GDPR.
<h3>Documentation</h3>
<a href="https://github.com/trewknowledge/GDPR/wiki" rel="nofollow ugc">https://github.com/trewknowledge/GDPR/wiki</a>
<h3>Collaboration</h3>
You can send your pull request at <a href="https://github.com/trewknowledge/gdpr" rel="nofollow ugc">https://github.com/trewknowledge/gdpr</a>
<h3>Shortcodes & helper functions</h3>
<a href="https://github.com/trewknowledge/GDPR/wiki/Functions-&-Shortcodes" rel="nofollow ugc">https://github.com/trewknowledge/GDPR/wiki/Functions-&-Shortcodes</a>
<h3>Features</h3>
<ul>
<li>Consent management</li>
<li>Privacy Preference management for Cookies with front-end preference UI & banner notifications</li>
<li>Privacy Policy page configurations with version control and re-consent management</li>
<li>Rights to erasure & deletion of website data with a double opt-in confirmation email</li>
<li>Re-assignment of user data on erasure requests & pseudonymization of user website data</li>
<li>Data Processor settings and publishing of contact information</li>
<li>Right to access data by admin dashboard with email look up and export</li>
<li>Right to access data by Data Subject with front-end requests button & double opt-in confirmation email</li>
<li>Right to portability & export of data by Admin or Data Subject in XML or JSON formats</li>
<li>Encrypted audit logs for the lifetime of Data Subject compliance activity</li>
<li>Data Subject Secret Token for two-factor decryption and recovery of data</li>
<li>Data breach notification logs and batch email notifications to Data Subjects</li>
<li>Telemetry Tracker for visualizing plugins and website data</li>
</ul>
<h3>Settings</h3>
General
From the Settings options in the dashboard, you can select the Privacy Policy page for tracking and logging consent.
On login, the user must consent to the Privacy Policy outlined on the site. If the user does not consent, the user will not be registered or logged in.
If the site owner updates the Privacy Policy page content, the change will be logged and flagged to the admin that they must notify users on next login to seek re-consent. Additionally, the warning message can be dismissed in the event of a minor correction or mistake.
Additionally, under General Settings the Admin can set the outgoing email limitation which would set the batch notification email limit per hour in the event of a Breach Notification.
Cookie Preference Management
Similar to consent management, users can opt in or out of cookies that are being used on the site. There are 3 formats of cookies that can be created which include:
<ul>
<li>Always Active: Cookies that are always active or are required for the site to function.</li>
<li>Toggled: Cookies that can be activated or blocked based on the user preference</li>
<li>Opt-Out Link: Cookies that require configuration from a third-party source in order to opt-out</li>
</ul>
Depending on the user preference setting, you can use the <code>is_allowed_cookie( $cookie )</code> function to save and set the cookies. The cookie with the user approved cookies can be found at another cookie named <code>gdpr_approved_cookies</code>. There’s also a helper function called <code>is_allowed_cookie( $cookie )</code> that you can use to prevent setting up a cookie.
Consent Management
Consents can be registered on the settings page. They can be optional or not. By default, this plugin comes with a Privacy Policy consent that users need to agree with on registration.
For optional consents, there’s a wrapper function <code>have_consent( $consent_id )</code> to help you display or hide something on the site depending if the user gave consent or not.
Consents are logged to the user record for auditing or for access purposes.
<h3>Requests Table & Rights of Data Subject</h3>
Right to Erasure Requests
<ol>
<li>The Data Subject is able to submit a request to be erased from the site using a shortcode.</li>
<li>
When a request is made, the Data Subject will receive an email confirmation to confirm the deletion request.
<ol>
<li>After email confirmation, the user request is added to the requests table for review by the Administrator. The Administrator can also add a user manually with an email look up and review.</li>
<li>If the Data Subject has content published on the site for any post types or comments, they will be added to this table. If they do not have any content, they will receive a confirmation of erasure request and be provided a 6 digit Token for safekeeping after erasure in case of recover data needs.</li>
<li>The requests table allows the Administrator to reassign any content to another user or delete it.</li>
<li>In the event of comments, the Data Subject’s content would be made anonymous.</li>
</ol>
</li>
<li>
Admin can also manually add users to the erasure requests table with a manual email search
</li>
</ol>
Right to Access Data Request & User Data Portability
<ol>
<li>The Data Subject can place a request to download their data with the shortcode.</li>
<li>After requesting their data, the user will receive a double opt-in confirmation email then the plugin will generate an XML or JSON file, which will be emailed to them for download with an expiration time of 48 hours.</li>
</ol>
Right to Rectify & Complaint Requests
<ol>
<li>The Data Subject can place a request to rectify data or file a complaint with the shortcode.</li>
<li>After making their request, the user will receive a double opt-in confirmation email and then add them to the table for admin to handle the request.</li>
</ol>
<h3>Tools</h3>
Access Data
The Access Data tool allows the Admin to look up a user email and view the data of a particular user. The Admin can download and export the data in a JSON or XML format and provide to the Data Subject if manually requested.
NOTE: This method should not be used without the Data Subject confirming their identity.
Audit Log
Everything the Data Subject does from registration, providing consent to the privacy policy, terms of service and other requests are logged and encrypted in a database. Data breach notifications are also logged to all Data Subjects upon confirmation by Controller.
<ol>
<li>Using the Data Subject’s email, you can look up and retrieve the user information and display it.</li>
<li>If the Data Subject has been removed from the site, this encrypted log is deleted from the database and saved as an encrypted file inside the plugin folder.</li>
</ol>
If in the future, the Data Subject makes a complaint or there is a need to recover the data, the user can provide their email address and the 6 digit token they received from the deletion confirmation email to decrypt and retrieve the file.
Data Breach & Notifications
In case of a data breach, the Admin can generate a Data Breach Notification to users by logging the information and confirm the breach through a double opt-in confirmation email. The following information would be recorded in the audit log:
<ol>
<li>Nature of the personal data breach</li>
<li>Name and contact details of the data protection officer</li>
<li>Likely consequences of the personal data breach</li>
<li>Measures were taken or proposed to be taken</li>
</ol>
Once the confirmation of the breach has been confirmed via email, the website will begin a batch email notification process to all users every hour until all users receive the notification.
<h3>Telemetry Tracker</h3>
The Telemetry Tracker feature will display all data that is being sent outside of your server to another destination. It will indicate the plugin or theme responsible, file and line where the data is being sent.
WordPress Core and some plugins gather data from your install and send this data to an outside server.
WordPress Plugin Repository does not allow plugins to do that, but premium plugins are able to do this because they are not bound by the Plugin repository rules. If you did not explicitly opt-in for this feature you should make a complaint.
<h3>Important!</h3>
Activating this plugin does not guarantee that an organization is successfully meeting its responsibilities and obligations of GDPR. Individual organizations should assess their unique responsibilities and ensure extra measures are taken to meet any obligations required by law and based on a data protection impact assessment (DPIA).

GDPR

We use this plugin as standard now on all WP websites we develop at Opace. Before the GDPR legislation came into force, I searched long and hard for a solution that would provide all of the necessary compliance measures and tested various plugins. Some provided part solutions and others simply failed to work. Finding one that provided a full cookie compliance and consent management solution was difficult. There are a lot of options and features available with this plugin, but it's one that I would highly recommend for any website owner.  

The best GDPR plugin available

This plugin is meant to assist with the GDPR obligations of a Data processor and Controller.

orcas - Mario Gleichmann

GDPR Notice will help you to make your site more GDPR compliant by informing the user of the use of external services when they first visit your website. You can add your own customized entries that will be displayed to the user.
If you website is using external serivces like Google Fonts and especially Google Analytics, the GDPR requires that users have to give their consent before any data is transferred to the external service.
With each retrieval of files from external servers (servers other than the one on which your website is running), it is technically possible to log which IP address the user of your site has, which browser on which operating system they use and many other things. This is also the case when using jQuery or Bootstrap, to name a few, from CDNs. And exactly such downloads and the resulting possibility of logging data your user must be able to disagree with.
In order to use your website, in the free version the user must agree to use all external services.
With <a href="https://www.orcas.de/wordpress-plugin/gdpr-notice/" rel="nofollow ugc">GDPR Notice Pro</a>, the user can also select which external services they want to allow and this plugin then removes any external styles, scripts and iframes that the user does not allow. This is necessary to prevent your website from being warned about the no-go policy.
IMPORTANT: This plugin can not and will not guarantee 100% compliance with GDPR. We can not ascertain that no other plugins run before this one and transfer data to external services without the user’s approval. This plugin is intended to help you make your site GDPR compliant, it is not a cure-all! Ultimately it is your responsibility to make sure your site complies with GDPR.
<h3>Features</h3>
<ul>
<li>First request checking: 
Only request users on the first visit, as long as the user has not yet accepted or declined.</li>
<li>Bots support: 
Ignores bots from AOL, Baidu, Bing, DuckDuckGo, Google, MSN, Teoma, Yahoo! and Yandex. 
You are also able to define a list of custom user agents to be ignored.</li>
<li>Cookie notice replacement: 
With GDPR Notice you can inform your visitors about the usage of cookies. No need for a separate cookie notice plugin.</li>
<li>Order changeable: 
Reorder your entries however you want.</li>
<li>Multiple entry types: 
You have several types of entries available to customize the notice to your liking.
<ul>
<li>Title entry type: 
You can change the title of the notice.</li>
<li>Message entry type: 
Use this to display custom text block entries in the notice. Multiple text entries are supported.</li>
<li>Informational entry type: 
Similar to the message entry type, but will display below the reject and accept buttons.</li>
<li>Informational link entry type: 
Link that displays additional information when clicked.</li>
</ul>
</li>
<li>Custom style: 
You can edit the style of the notice page in the backend, without the hassle of FTP and whatnot.</li>
<li>Custom URL: 
Define a custom URL that should be used for the GDPR consent page, instead of serving the page under the regular content’s URL</li>
<li>Custom background image: 
You can chose an image from your media library to be used as a background image.</li>
</ul>
<a href="https://www.orcas.de/wordpress-plugin/gdpr-notice/" rel="nofollow ugc">GDPR Notice Pro</a> Features
<ul>
<li>Detect browser language: 
Switch display language depending on detected browser language.</li>
<li>Multiple entry languages: 
Create entry versions for multiple languages.</li>
<li>Link entry type: 
Displays links with a checkbox. Link will show additional info when opened.</li>
<li>Required options: 
Link entries can be marked as required.</li>
<li>Remove tracking codes: 
Removes inline tracking codes, such as Google Analytics</li>
<li>Multiple view modes: 
You can chose to have the notice displayed as it’s own page before your actual page, as a box floating above your page in a corner or near an edge of the browser or even not display it at all.</li>
<li>Remove unwanted scripts and styles: 
Removes scripts and styles from your site, depending on the user’s selection</li>
</ul>

GDPR Notice

GDPR Notice allows you, in accordance to the General Data Protection Regulation, to ask the user in advance if your page may use external services.

GDPR vs GDPR Notice