Ensure that the forms you build with BBForms comply with the European Union’s General Data Protection Regulation (GDPR). Protecting personal data and respecting user privacy should always be a priority. Adding GDPR elements to your forms helps you manage user consent effectively and strengthen your data security practices.
What is GDPR?
The General Data Protection Regulation (GDPR) is a regulation of the European Union that came into effect on May 25, 2018. Its main goal is to protect the personal data of European citizens and give them greater control over how their information is collected, stored, processed, and shared.
Protection of personal data
Any information that directly or indirectly identifies a person (name, email, IP address, etc.) is covered by the law and must be secured using practices such as encrypted storage, password hashing, and strict access management.
Some of these measures may consist of:
- Use HTTPS/TLS to prevent data from being transmitted in plain text.
- Encrypt databases or storage devices (e.g., AES-256).
- Passwords never stored in plain text; apply salted hashing (e.g., bcrypt, Argon2, scrypt).
- Multi-factor authentication (MFA/2FA).
The technical implementation of these measures should be carried out by qualified IT and security professionals, such as system administrators, developers, and cybersecurity specialists.
Explicit consent
Companies must obtain clear and voluntary permission from the user before collecting or processing their data.
Consent requires the user to actively select a checkbox. Pre-selected options are not valid, and the checkbox must be marked to continue.
Right of access and rectification
Users have the right to know what data is stored about them and to correct it if it is inaccurate.
The Users Management add-on enables users to exercise their right of access and rectification by reviewing and updating their personal data.
Right to be forgotten
Anyone can request that their personal data be deleted.
To support GDPR compliance, you can insert the [delete_request] bbcode in BBForms form Actions, which automatically records the request in WordPress at Tools -> Erase Personal Data.
Data portability
Users can request their data in a structured format to transfer it to another provider.
BBForms provides the [export_request] bbcode for form Actions, enabling users to submit data export requests that are registered in WordPress under Tools -> Export Personal Data, in line with GDPR
How to create GDPR-Compliant forms
Follow these steps to design a form in line with GDPR standards, requiring explicit consent before processing personal data. The inclusion of a consent checkbox ensures that users make an active choice to share their information.
Insert a checkbox in your form to ensure the user agrees to GDPR. Include a link to the privacy policy for full transparency about personal data processing.
Using the [check] field in BBForms, you can add a mandatory checkbox that must be checked before the form can be submitted.
[check* name="privacy" value=""]1|I have read and agree with your [url="{site.privacy_policy_url}" target="_blank"]Privacy Policy[/url].[/check]The essential characteristics for this field to comply with GDPR are:
- Mandatory field: The GDPR field must be filled in by the user.
- Unchecked by default: The checkbox starts unchecked, requiring user action.
- Single checkbox: A form can include a single GDPR consent checkbox.
Disclaimer: We recommend seeking legal counsel to ensure your practices meet applicable laws. This form builder is not a substitute for professional legal guidance and does not ensure GDPR compliance.