I was reading through the regulation itself and opinions on it. I was thinking that by the end of my inquiry I can come up with UX guidelines. Nope, did not happened.
Here's are my takeaways:
You need a lawyer
You should listen to legal people of your organization on this issue. They should be accountable for interpretation of the regulation. The fine for not complying is up to 4% of global turnover. If you don't have legal team see what big boys do. See how Microsoft, Google, Facebook and as such. I'm pretty sure they take action, see some examples below.
TL/DR: everything is personal data. Here is the language: "Any information which can identify or can be attributed to the person directly or using additional information". IP address, geolocation, salary (the number itself) if it can be connected to your identity - it is personal data.
Most important concept from UX perspective is a user consent, which is:
- freely given - means non-blocking unless you can prove that you can't provide service without the data. Good reason: email address for registration, bad reason: email for marketing campaign.
- specific - no bundling: email for sign up is one consent, newsletter is another.
- informed and unambiguous: should whom gets to process, what data, why and for how long.
- affirmative action: IMO it means there should be a checkbox or very clear notice (e.g. "enter email to receive newsletter from ...").
Cookies are personal data. Cookies notice should be changes because under GDPR implied consent ("By using this site ...") is not sufficient. It should be affirmative as any other consent.
Here are some examples for europa.eu subsites. Presumably they should know how to cookie, but some on them are really confusing.
For examples on how to provide user right see the following.
Here is example of newsletter subscription from one of EU websites
Notice how specific the language of the consent is.
I can recommend ICO'a website and guidelines. It is UK NPO and in my opinion, it is trustworthy.
To end on positive note, GDPR is a one-stop-shop. If you are cleared by one regulator in any UE country, you are good across entire EU (and UK … most likely)
And last thing: you should not take this as legal advice.