In reply to Tim Kaye.

I disagree.

While many aspects of the GDRP are straightforward to say there is not a burden on small businesses is simply wrong.

There will indeed be a burden due to the very nature of WordPress ease of use and low barrier to entry for small businesses and individuals. Do you think these types of users can afford to hire or consult with EU legal experts to make sure that what they do with WordPress is OK by the GDRP. Do you think WordPress users outside of the EU, let alone inside the EU, even know about or understand the GDRP?

I’ll use form solutions as an example. Gravity Forms is a tool much like a desktop publishing app is a tool. It’s a blank canvas. I can’t tell you what type of data a user is going to capture with it because they can use it to create whatever type of form they want. It doesn’t create default forms or force them to use a specific set of forms. It’s a blank slate.

Because of that blank slate nature it can’t take into account every scenario in which they could be used because just like a desktop publishing app we don’t know what they are going to build. It’s not merely a contact form builder it’s used for all kinds of th He’s such as code generators , product configurators and custom applications built on top of it that may have nothing to do with sensitive personal data. If you want a contact form use Contact Form 7. Gravity Forms is far more than a mere contact form solution which means it can’t simply force all of the GDRP rules out of the box because you may not even fall into that box.

What this does is out the onus of being GDRP compliance on the site owner. And the way the GDRP law was written this doesn’t just mean EU site owners either. Do you think users in Brazil will have any clue what the GDRP? Or site owners in practically any international market outside of the EU? Or even small business and individual site owners in the EU that are not technical savvy... of which there are a ridiculously high number? Do you think they read legal blogs or WordPress sites such as WPTavern? Or even the Gravity Forms blog if they are a Gravity Forms user? The simply fact is the vast majority do not, yet they can easily be exposed because of the EU regulation.

Thankfully because of the open source nature of WordPress and how plugins work this means it most definitely allows you to implement things in a way that is GDRP compliant. Gravity Forms included. It can do whatever you want it to do. But it may require using additional plugins/add-one/extensions or even custom code to accomplish implementing something that would be compliant depending on what exactly it is you are trying to accomplish and what type of data you are dealing with. It means the site owner needs to know what it is you need to do and what tools you’d need to do it.

I have no issues with the GDRP from a data protection standpoint. I also have no issue helping educate people on what it is they need to do. But we only have so much reach (we being the WordPress community) because the vast majority use WordPress but are outside of our little bubble. With this in mind, to say it doesn’t add a burden to site owners is not true.

Most WordPress site owners won’t even know the GDRP exists, let alone how to make sure they are compliant.

Apologies for any typos or autocorrect snafus in this one... it’s a long comment and I’m typing it out on my iPad.