Running a website means collecting data about people, whether or not you intended to. Contact forms, analytics, order records and server logs all count, and in several jurisdictions that carries obligations.
This is not legal advice. It is what the requirements mean in practice on a hosting account, and where people get them wrong.
Consent has to come before the tracking
The most common mistake, and it is not a technicality.
A banner announcing that cookies are used, while analytics has already loaded, is not consent. The tracking happened before the visitor was asked. Compliance requires the tag to be blocked until they agree.
A consent tool that actually blocks scripts is the arrangement. One that only displays a notice is decoration, and it is a common configuration precisely because it is the default in some plugins.
This reduces your data, which is the trade. Reporting on visitors who consented is the honest position instead of a problem to engineer around. How to Verify Your Site and Set Up Analytics explains installing the tag once, properly.
Not every cookie needs consent
Cookies strictly necessary for the site to work do not require it: the session that keeps someone logged in, the cart that remembers what they added, the token that protects a form.
Analytics, advertising and anything tracking behaviour across sites do.
So a shop can keep working without consent, and cannot track without it. That distinction is worth understanding before installing a tool that blocks everything and breaks the checkout.
Know what you are actually collecting
List it once and the rest becomes straightforward.
Form submissions: often stored in the database as well as emailed, which people forget when they say they do not keep data.
Order records, including addresses and payment references.
Account data for anyone who registered.
Server logs, which record IP addresses, and an IP address is personal data in several jurisdictions.
Third-party tools: analytics, chat widgets, embedded video, remarketing tags. Each one sends data somewhere else, and that is the part most sites have never inventoried.
Third-party embeds send data before anyone clicks
An embedded video, a hosted font, a map, a chat widget. Each contacts its provider when the page loads, passing the visitor's address and what page they are on.
That happens whether or not the visitor interacts with it, and it happens before any consent banner if the embed is not blocked.
Two practical answers: host what you can locally, fonts especially, which is also faster, and load the rest only after consent, using the privacy-preserving embed options most providers now offer.
Write the privacy notice from the list
A privacy page assembled from a template describes a site that is not yours, and the gap between them is what makes it useless.
Say what you collect, why, how long you keep it, who else receives it, and how someone asks for a copy or deletion. Name the third parties: that list is the part people actually check.
Link it from the footer of every page and from any form that collects something.
Retention: decide, then actually delete
"We keep it indefinitely" is a decision, and usually not the right one.
Old form submissions, abandoned accounts and years of logs are a liability rather than an asset: they add nothing and they are what leaks if anything does.
Set a period and enforce it. WooCommerce has retention settings for orders and personal data. Logs rotate if you configure them. How to Manage Logs and Log Rotation on a VPS goes into that side.
Requests for data and deletion
People can ask what you hold and ask you to delete it, and you need to be able to answer within a defined period.
WordPress has export and erasure tools built in, and they cover core data and whatever plugins implement. Plugins that store data without implementing them leave a gap you have to handle by hand, which is worth knowing before a request arrives rather than during one.
Note that deletion has limits: order records you must keep for tax purposes are a legitimate exception, and saying so is a better answer than deleting them.
Where the data lives matters
Some regimes restrict transferring personal data outside a region.
That applies to your hosting location, your backup location and every third-party service you send data to, and backups are the one people overlook, because they are configured once and never reviewed.
If it matters for your business, check all three rather than only the first.
A breach has a clock on it
If personal data is exposed, several jurisdictions require notifying a regulator within a short window, often 72 hours, and sometimes the people affected.
That is far easier when you already know what you hold, where it is, and who to contact. Deciding all three during an incident is how the deadline is missed. How to Clean Up a Hacked WordPress Site deals with the technical response, and the notification obligation runs alongside it.
The practical minimum
A real inventory of what you collect and which third parties receive it. A consent tool that blocks rather than announces. A privacy notice written from that inventory. A retention period you enforce. And knowing, in advance, what you would do about a request or a breach.
That is an afternoon, and it is the difference between a considered position and finding out under pressure.
Requests and complaints arrive the same way and share one property: ignoring them is the worst option. How to Respond to a Copyright or Takedown Complaint explains the response.