GDPR basics
This page is for owners and managers of businesses that serve people in the European Union, or otherwise fall under the General Data Protection Regulation (GDPR). It gives the outline of the regulation in plain words and shows, for each part, which features of Exponential help and what you must still do yourself.
Warning
This page is basics, not legal advice. It does not say whether your site complies. Read the regulation text, Regulation (EU) 2016/679, in the official journal (https://eur-lex.europa.eu/eli/reg/2016/679/oj), and take advice from a lawyer or your data protection officer (DPO). Other laws may also apply, for example on e-mail marketing; the project maps several of them in E-mail preferences: the law checklist.
Contents
- Who decides: controller and processor
- The principles, and what helps
- People's rights, and the tools
- Security of processing
- What the software cannot do for you
- Getting started in five steps
Who decides: controller and processor
In a typical setup your business decides why and how personal data on your site is used, and a host or partner runs the infrastructure for you. Which legal role each party has, and which contract you need between you, is for you and your counsel to settle (Compliance and GDPR). Ask your host and partner how they support data protection requests; see Questions to ask a partner.
The principles, and what helps
The regulation sets principles for processing personal data. In outline, with the features that support each:
| Principle (in outline) | What helps in Exponential | Source |
|---|---|---|
| Lawful, fair, transparent | Mail says why it was sent; footers and the preference page can link your privacy notice | The law checklist |
| Purpose limitation | One consent switch per mail category | E-mail preferences |
| Data minimization | Request logs mask client addresses by default; the audit trail truncates addresses and hashes sessions | Compliance and GDPR |
| Accuracy | Users change their own account data; staff edit user objects in the administration | Accounts and sign-in |
| Storage limitation | Retention settings for logs, the audit trail, the consent log, trash and sessions | Data retention and deletion |
| Integrity and confidentiality | bcrypt passwords, two-step sign-in, security headers, roles | User accounts and passwords |
| Accountability | A record of consent changes, and a tamper-evident audit trail | Compliance evidence from the audit trail |
People's rights, and the tools
| Request | What the software offers | Source |
|---|---|---|
| See their data (access) | For mail data, the person's own download, or exp:mail:preferences export; audit records about a user with exp:audit export --subject-user=<id> | Compliance and GDPR |
| Take their data elsewhere (portability) | "Download my e-mail data" in JSON and CSV | The law checklist |
| Correct their data | Account editing by the user or by staff | Accounts and sign-in |
| Erase their data | exp:mail:preferences erase; removing a user account also erases its mail preferences; form collections can be removed in Setup > Collected information | Data retention and deletion |
| Object to marketing | "Stop all optional e-mail" by link puts the address on the suppression list | Consent and forms |
Some data is not covered by a single command: orders, newsletter subscriber records in cjw_newsletter, and copies
in backups. Plan how you handle each; Personal data in Exponential lists where
they are.
Note
The audit trail is built so that single records cannot be deleted without breaking its hash chain. The audit guide describes keeping records for their retention period and pseudonymizing personal fields after a set number of days (Audit: privacy and GDPR tasks). Whether that answers an erasure request in your case is a legal question.
Security of processing
What the software contributes is described in Security basics for businesses and Compliance and GDPR. What the host contributes (isolation, encrypted backups, patching) belongs in your hosting contract.
What the software cannot do for you
- Decide your legal basis for each kind of processing.
- Write your privacy notice and your record of processing activities.
- Fill in the sender name and postal address of your mail footer (
mailpreferences.ini [FooterSettings], empty after an installation). - Decide retention periods, and set backup retention to match.
- Judge third-party services your templates load (fonts, maps, analytics); the Content Security Policy makes them visible, it does not judge them.
- Sign contracts with your host, partner, payment provider or a hosted AI provider.
Getting started in five steps
- List the personal data you hold, with Personal data in Exponential.
- Answer the questions in Accessibility, security and compliance checklists with your DPO or lawyer.
- Set retention periods and the matching settings (Data retention and deletion).
- Write down how you answer requests to see, export or erase data, and who does it.
- Review it once a year with the annual review checklist.
Related pages
- Compliance and GDPR for hosts
- Consent and forms
- Protecting customer data (partners)
- Free documentation: this page is free to copy, translate and improve under the GNU FDL 1.3.