The General Data Protection Regulation (GDPR) is a new law that applies to all companies that collect and process data belonging to EU citizens, even if it's done outside of the European Union. This includes companies with operations in the EU and/or a web site or app that collects and processes EU citizen data.

The most important points of GDPR cover privacy rights, data security, data control and governance. In short, you can collect and process data only for authorized purposes and users have to give explicit consent to storing their data and they have to be able to view what was stored and delete if necessary. This is where Breezing Forms comes into play. Before we analyse what is necessary, let's start off with BF itself. By default, it stores the IP along with the submission. We have added a new option under Configuration where you can disable IP storing. That way, all the records will be stored with no IP.

 

 

As for the forms themselves, there are a couple of possible scenarios, so let's break them down.

If you have a general form (e.g. contact form, simple request form) that doesn't contain any sensitive data, you can turn logging to database off (form advanced settings). However, in that case, you have to receive the info via mail as you don't have any other way of viewing who filled the form and what they entered. There are also two scenarios here. The first is if the mail address is a general purpose address (info@example.com). That address is not considered personal and you don't have to do anything. The second option is if it's a personal mail (johdnoe@example.com).  In that case you have to have a clear notification to the users that they consent to their data being sent via mail and that they have the right to e-mail you and request you to delete their data (which you have to do if they request it). That notification can be done with a checkbox, or for a bit prettier solution, a checkbox group with a single line. Remember to put validation on that checkbox (ff_anychecked) so that the user has to agree to it along with a required asterisk.

 

 

The second scenario would be if you do have to store sensitive information. In that case, again, you must have a notification to the users that they consent to their data being collected (check out the checkbox solution from the previous paragraph). But, the users have to have a way of previewing what data is stored and if necessary, editing their entries. That's where Content Builder comes in handy. Create a new Content Builder view with the following options enabled (for the exact location of the options, refer to the Content Builder documentation):

• show edit button
• list own only
• force permissions on owner to list access, view, new, edit and delete

Simply create a new menu item pointing to the view that will be displayed only to logged in users. That is all you need to do to comply to the new law.

Remember not to store any information that isn’t vital, use SSL (we urge everyone to switch to https protocols) and allow them to view, edit and if necessary delete their data.