OnWebPoint 
Table of Contents
WordPress GDPR has been in force since 2018 and the Data Protection Commission (DPC) in Ireland has been actively enforcing it — including against small businesses and sole traders. For most Irish WordPress site owners, achieving compliance is more straightforward than it appears, but the detail matters: half-measures leave you exposed, and the DPC has made clear that good intentions without correct implementation do not constitute compliance. This guide covers what your WordPress site actually needs in 2025.
Does WordPress GDPR Apply to Your Site?
WordPress GDPR applies if your site collects any personal data from EU-based visitors — which almost every business site does. Contact forms, newsletter sign-ups, ecommerce orders, analytics tracking, comment sections, live chat widgets, and social sharing buttons all involve personal data in some form. Even a sole trader with a five-page brochure site and a single contact form falls under WordPress GDPR. The regulation applies based on the data subjects’ location (EU residents), not the business’s location — though Irish businesses processing Irish residents’ data are clearly covered.
The good news: compliance for a small Irish business website is achievable in a structured day’s work if you approach it methodically. The requirement is not perfection — it is documented, good-faith compliance with the key obligations.
Cookie Consent: What Irish WordPress Sites Must Do
Cookies that are not strictly necessary for the site to function — analytics, advertising pixels, social media trackers, heatmap tools, live chat widgets — require explicit, informed consent before they are set. The DPC’s guidance is consistent with the wider EU standard: consent must be freely given, specific, informed, and unambiguous. Pre-ticked boxes, consent buried in terms and conditions, and “by continuing to browse you consent” banners are all non-compliant.
A compliant cookie consent implementation for an Irish WordPress site means: a banner that loads before any non-essential scripts run; a genuine accept/reject choice at the top level (not buried in settings); a preference centre that lets visitors choose by category; a record of consent with a timestamp; and a mechanism for visitors to withdraw consent as easily as they gave it. CookieYes and Complianz are the most widely used WordPress GDPR-compliant cookie consent plugins for WordPress in Ireland. Both handle the technical implementation — consent logging, script blocking, and preference storage — correctly when properly configured.
Many Irish sites load Google Analytics, Facebook Pixel, or Hotjar on page load regardless of consent. This is non-compliant. The DPC has issued decisions on exactly this point and fined organisations that loaded analytics before receiving consent.
Privacy Policy Requirements for Irish WordPress Sites
Your WordPress site must have a privacy policy that is accurate, specific, and accessible. The required content under WordPress GDPR: what personal data you collect and through which mechanisms; the legal basis for each type of processing (consent, legitimate interest, contractual necessity, legal obligation); how long you retain each category of data; who you share data with and in what capacity (Google as a data processor for Analytics, Mailchimp for newsletter delivery, Stripe for payment processing, etc.); details of any data transfers outside the EU; and how visitors can exercise their rights (access, rectification, erasure, portability, objection).
A generic template privacy policy copied from another site does not meet the accuracy requirement unless it happens to match your specific setup exactly — which it almost certainly does not. Your privacy policy must reflect what your site actually does. If you added a new contact form plugin, a live chat widget, or changed email marketing provider, the privacy policy needs updating. Our maintenance service includes an annual compliance review covering exactly this.
Contact Forms and Data Collection
Every contact form on your WordPress site is collecting personal data. Compliance requirements: a clear statement near the form explaining what you will do with submissions; no use of form submissions for marketing without separate, explicit consent; a defined retention policy (how long you keep submissions before deleting them); and a process for honouring erasure requests. Contact Form 7 stores nothing in the database by default — submissions are emailed and the data responsibility shifts to your email provider. Gravity Forms and WPForms store submissions in the WordPress database by default, which requires a documented retention and deletion policy and inclusion in your privacy policy.
If your forms include any sensitive personal data — health information, financial details, information about children — the compliance obligations are stricter and you may need a Data Protection Impact Assessment (DPIA) before processing begins.
Google Analytics and WordPress GDPR Compliance in Ireland
Google Analytics sets cookies and sends data (including IP addresses and behavioural data) to Google’s servers in the US — making Google a third-party data processor under WordPress GDPR. Requirements: disclose GA in your privacy policy and cookie notice; do not load the GA script until the visitor has consented to analytics cookies; have a Data Processing Agreement (DPA) in place with Google (available in your GA4 account under Admin > Data Processing Amendment); and consider IP anonymisation (enabled by default in GA4).
GA4 with consent mode configured correctly — where the analytics script loads only after cookie consent, and consent mode signals are passed to GA — is the compliant setup as of 2025. If you are unsure whether your Analytics implementation is loading correctly relative to your consent banner, our WordPress SEO service includes a technical compliance check as part of the audit.
WooCommerce and GDPR in Ireland
WooCommerce collects substantial personal data: customer names, addresses, email addresses, order history, and payment details (though payment card data never touches your server if you use Stripe or PayPal correctly — it goes directly to the gateway). WooCommerce has built-in WordPress GDPR tools since version 3.4: a personal data export tool, a personal data erasure tool, and data retention settings. These need to be configured, not just installed.
Key WooCommerce WordPress GDPR actions: configure the personal data retention period in WooCommerce > Settings > Accounts & Privacy; enable the account erasure request tool so customers can request deletion of their data through their account; ensure your checkout page includes a link to your privacy policy and a clear statement about how order data is used; and document your data retention policy for order data (typically two to seven years depending on Irish tax and accounting obligations).
Email Marketing and WordPress GDPR in Ireland
If you collect email addresses for marketing purposes — newsletter sign-ups, promotional emails, product updates — you need explicit consent for each subscriber. Pre-ticked newsletter subscription boxes on contact forms are non-compliant. A separate opt-in checkbox with a clear description of what the subscriber is signing up for is required. Import of existing email lists without documented consent records is non-compliant and creates significant risk.
Your email marketing provider (Mailchimp, MailerLite, ActiveCampaign, etc.) is a data processor under WordPress GDPR — you need a Data Processing Agreement with them, and most major providers include this automatically in their terms. Check that your provider’s servers are in the EU or that appropriate safeguards for US transfers are documented. MailerLite and Brevo (formerly Sendinblue) both offer EU-based data hosting, which simplifies the transfer documentation requirement.
Handling Subject Access Requests
Under WordPress GDPR, any individual has the right to request a copy of all personal data you hold about them (a Subject Access Request, or SAR). You must respond within one calendar month. For most Irish small business WordPress sites, a SAR means: checking your email for correspondence with that person, checking any form submission records, checking WooCommerce order history if applicable, and checking your email marketing subscriber list. You are required to provide this data in a portable format and at no charge. You can request enough identifying information to confirm the requester’s identity before responding. Our maintenance service includes documented SAR procedures as part of the compliance package.
Frequently Asked Questions
Can the DPC fine a small Irish business for WordPress GDPR non-compliance?
Yes. The DPC has fined organisations of all sizes. For most small business infractions, enforcement begins with an advisory notice and a requirement to remedy the issue within a defined period. Wilful non-compliance, non-compliance after an advisory notice, or serious breaches attract larger fines — up to 4% of global annual turnover or €20 million, whichever is higher.
Does my WordPress site need a cookie policy as well as a privacy policy?
Not strictly — but a separate cookie policy linked from your consent banner makes the consent process clearer for visitors. At minimum, your privacy policy must contain a full section on cookies, and your consent banner must link to it.
Is a free WordPress privacy policy generator enough for WordPress GDPR?
Only if it accurately reflects your specific site’s data processing. Most generators produce generic templates. Review any generated policy carefully against your actual setup — every plugin that sends data externally needs to be documented.
Do I need a cookie consent banner if I only use Google Analytics?
Yes. Google Analytics sets non-essential cookies and sends data to Google’s servers. It requires consent under GDPR before it loads, regardless of how widely it is used.
How often should I review my WordPress site’s GDPR compliance?
At minimum annually, and after any significant change: adding a new plugin that processes data, changing email marketing provider, adding a live chat widget, or making a change to the checkout process. A compliance review after a WordPress redesign is particularly important as the entire plugin stack often changes.
Not sure if your WordPress site is GDPR compliant? Ask us for a free check →
