GDPR Policy Generator for WordPress
Written for the plugin stack - because on WordPress, the plugins are the data flows.
WordPress ships genuine GDPR tooling - suggested policy text, personal data export and erase - but it only reaches core and plugins that implement the privacy API. The accountability gap is everything else, which on a typical site is most of the plugin list.
WordPress core collects very little: comment author details, a login cookie, and whatever the theme adds. Everything else comes from plugins, and a typical business site runs between fifteen and forty of them. Contact forms, analytics, SEO tools, caching, backups, security, membership, e-commerce and email marketing each collect, store or transmit personal data.
That makes the plugin list the single most important input to a WordPress privacy policy. WordPress core has built-in privacy tooling - a suggested policy text assembled from plugins that implement the privacy API, plus personal data export and erase tools - but only some plugins participate, so the suggested text is always incomplete.
Self-hosting adds a layer most site owners forget: your host processes personal data too, server logs record IP addresses, and backups replicate everything including data a user has asked you to delete.
What a GDPR policy for a WordPress site has to cover
A record of processing derived from the plugin inventory, not from the suggested text
Which plugins implement the privacy API and which are silent, with the gap documented
Article 28 terms with the host, and with each plugin vendor that receives data
Whether the export and erase tools actually reach comments, forms, orders and logs
Backups and staging as locations an erasure request has to account for
How a WordPress site actually moves personal data
Contact form submissions
Contact Form 7, WPForms and Gravity Forms may email submissions, store them in the database, or both - and each has its own retention setting that defaults to keeping everything.
Comment metadata
WordPress stores the commenter’s IP address and user agent alongside the comment, which many site owners do not realise and few disclose.
Analytics and SEO plugins
Analytics plugins inject tracking, and some SEO plugins phone home with usage telemetry. Both belong in the disclosure.
Security plugins and firewall logs
Wordfence, Sucuri and similar log IP addresses and login attempts, retain them, and often send data to a vendor cloud.
Backups and staging copies
Full-database backups replicate personal data to another location, and a deletion request has to reach them or your erasure is incomplete.
Gravatar and remote avatars
Enabled by default, sending a hash of the commenter’s email address to Automattic on every page view that shows an avatar.
Third parties the draft will ask you about
Automattic (Jetpack, Gravatar) · WooCommerce · Stripe · PayPal · Mailchimp · Wordfence · Cloudflare · UpdraftPlus · Google Analytics 4 · your hosting provider
The rules that apply
WordPress privacy tools
Settings → Privacy assembles suggested policy text from participating plugins, and Tools → Export/Erase Personal Data handles subject requests for core and participating plugins.
Plugin-by-plugin obligations
Each plugin that transmits data off-site introduces a new recipient and usually a new processor agreement to obtain.
Hosting and server logs
Your host is a processor. Access logs containing IP addresses are personal data with their own retention question.
WooCommerce and payment gateways
Order, customer and payment data, with gateway plugins handing card details to the provider.
Comment and user data
Core stores comment author name, email, IP address and user agent, and sets a cookie if the consent checkbox is ticked.
What the generated GDPR policy contains
Article 13 and 14 transparency notice
The full disclosure set, split by whether the data came from the person or from somewhere else.
Lawful basis register
Every processing activity mapped to one of the six bases, with the legitimate interests assessment written down where you rely on that basis.
Records of processing (Article 30)
The internal register a supervisory authority can ask for at any time, covering purposes, categories, recipients, transfers and retention.
Data subject rights procedure
How a request arrives, how identity is verified, who handles it, and the one-month clock with its two-month extension.
International transfer mechanism
Adequacy, SCCs with a transfer impact assessment, or the UK IDTA/addendum - named per destination, not asserted in general.
Breach detection and 72-hour notification
The internal escalation path, the assessment test, and the template for notifying the regulator and, where required, the individuals.
Processor and sub-processor controls
Article 28 terms, the sub-processor list, and the change-notification commitment your customers will ask for.
Publishing the document on WordPress
Create the page and set it as the privacy policy page
Settings → Privacy lets you designate it, which makes core link it from the login and registration screens.
Export your plugin list first
It is the raw material for the recipients and cookies sections. Note which ones transmit data off-site.
Configure form and comment retention
Set a real period in each form plugin and decide how long comment metadata is kept.
Decide on Gravatar
Disable it, or disclose it. Discussion settings control whether avatars render at all.
Test the export and erase tools
Tools → Export Personal Data and Erase Personal Data. Confirm what they actually return, and document what they miss.
Add the policy links to the footer widget or menu
So they appear site-wide rather than only where the theme happens to place them.
Where this usually goes wrong
Publishing the suggested privacy text unedited
Settings → Privacy generates suggested content with instructional placeholders. Sites publish it verbatim, brackets included.
Undisclosed plugin data flows
Only plugins that implement the WordPress privacy API contribute to the suggested text. The others - often the ones sending the most data - are silent.
Gravatar left on without disclosure
It transmits an email hash to a third party for every avatar rendered.
Erasure requests that miss backups and caches
A deletion that leaves the record in nightly backups and a CDN cache is not a deletion.
No processor agreement with the host
Hosting is processing. The contract needs Article 28 terms if you serve UK or EU visitors.
Comment IP logging with no retention rule
Stored indefinitely by default, with no purpose after the spam check is done.
Frequently asked questions
Does WordPress generate a privacy policy for me?
It generates suggested text assembled from core and from plugins that implement the privacy API. It is a scaffold with placeholders and it is silent about every plugin that does not participate.
Do I need to list every plugin in my privacy policy?
Not every plugin, but every plugin that collects personal data or sends it somewhere. A caching plugin that stays local is different from an analytics plugin that transmits to a vendor.
Does WordPress store IP addresses?
Yes - comment author IP addresses and user agents are stored by default, and most security plugins log far more. Both are personal data.
What about my hosting provider?
They are a processor. You need appropriate contractual terms with them, and your policy should disclose hosting as a category of recipient including where the servers are.
Does GDPR apply to a business outside the EU?
Yes, where you offer goods or services to people in the EU or monitor their behaviour. Article 3(2) is about where the person is, not where you are - and Article 27 may also require you to appoint an EU representative.
What is the difference between EU GDPR and UK GDPR?
The text is nearly identical, but they are separate laws with separate regulators, separate fine ceilings in different currencies, and separate transfer regimes. A business serving both needs both named, not "GDPR" as shorthand.
Do I need a Data Protection Officer?
Only where your core activities involve large-scale regular monitoring or large-scale special-category data, or you are a public authority. Many businesses do not need one - but if you do not have one, say who is accountable instead.
Is a GDPR policy the same as a privacy policy?
No. The privacy policy is the outward-facing notice. The GDPR policy set is the internal machinery - lawful basis register, ROPA, rights procedure, breach plan - that lets you answer a regulator when they ask how the notice is honoured.
GDPR Policy Generator for WordPress
Answer a short questionnaire and get a draft written for a WordPress site. Free to start, no card required.
Generate your GDPR policyOther documents a WordPress site needs
Each one is written for the same context, not a generic template.
The same document, by platform
Go deeper
PolicifyAI is a technology provider, not a law firm, and this page is not legal advice. Generated documents are a structured starting point that a qualified adviser should review before you publish or rely on them.