The short answer
Yes, updates are a legal obligation for website and store owners, even though the word “update” appears in no law. Art. 32 of the General Data Protection Regulation requires personal data to be protected by appropriate technical and organizational measures, taking into account the state of the art.
The law does not name a fixed deadline in days. The yardstick is risk: what is appropriate depends on which data you process and how likely and severe any harm would be.
A website that leaves known vulnerabilities open for weeks will have a hard time meeting the GDPR’s standard. Timely, tested updates are part of the security the law requires.
Who this applies to
Art. 32 applies to anyone who processes personal data, regardless of company size, and to service providers who do so on your behalf. On a website, little is enough:
Contact form
A name and an email address are enough.
Online store
Customer accounts, orders, addresses.
Newsletter
Every sign-up is personal data.
Login
For customers, members or employees.
That covers the vast majority of business websites.
What “state of the art” means in practice
Art. 32(1) GDPR lists examples of what the measures include.
- aPseudonymization and encryption of personal data
- bEnsuring the ongoing confidentiality, integrity, availability and resilience of the systems
- cBeing able to restore data promptly after an incident
- dA process for regularly testing whether the measures work
For a website, in practice this means
- 01
Updates, timely and tested
Security updates for core, plugins, themes and extensions reach the website promptly, ideally after a test on a copy.
- 02
HTTPS
Forms, logins and the checkout run encrypted.
- 03
Access and permissions
Personal accounts, strong passwords, a second factor where possible, administrator rights only for those who need them. Old accounts get deleted.
- 04
Backups
Regular backups, stored separately from the website, and a restore that actually works.
- 05
Regular review
Check at fixed intervals whether updates have been applied, whether unknown files or accounts show up and whether the backups are complete, and record it.
This list is my translation of the law for websites, not an exhaustive requirement. A store with customer accounts needs more than a simple brochure site with a contact form.
What the supervisory authorities say
The Bavarian Data Protection Authority (BayLDA), one of the German state supervisory authorities, put it most clearly, in an information sheet on its online audits of websites (in German, February 2018, shortly before the GDPR applied):
A legal requirement
Patch management, meaning obtaining, testing and applying important updates, is “a legal requirement from a data protection perspective”.
For website operators too
Controllers, “that is, website operators too”, have to establish a process for regularly reviewing whether their measures are effective.
Apply promptly
Security patches should be applied promptly, because only a few hours can pass between a vulnerability becoming known and its exploitation.
Plugins and themes
Not only the CMS itself, but plugins and themes too need equally consistent patch management.
As tips, the BayLDA names regular backups, a secured admin area, security patches, restricted user rights and an encrypted login, with a second factor where appropriate.
€65,500 for outdated store software
In its 2020 activity report (in German), the data protection commissioner of the German state of Lower Saxony describes exactly such a case.
Fine for a violation of Art. 32(1) GDPR, imposed by the data protection authority of Lower Saxony
LfD Niedersachsen, activity report 2020, pp. 97 f.- Trigger
- A data breach notification under Art. 33 GDPR. The authority then examined the website.
- Findings
- The store software xt:Commerce in a version that had received no security updates since 2014 at the latest, with vulnerabilities allowing SQL injection. Passwords could be reversed quickly.
- Outcome
- Violation of Art. 32(1) GDPR, a fine of €65,500, accepted by the company.
The authority’s reasoning applies to any website: updating the software is regularly enough on its own to close known vulnerabilities, and the cost of doing so is in principle not a disproportionate effort.
For context: published fines over outdated website software are rare, and this case is several years old. Not every missing update leads to a fine. But it shows how the authorities apply the standard when they examine a site after an incident.
The TDDDG: security for digital services (German law)
Besides the GDPR, there is a second provision in German law: Section 19(4) TDDDG (Telecommunications Digital Services Data Protection Act, formerly TTDSG). Under it, providers of digital services offered on a commercial basis must ensure, as far as technically possible and economically reasonable, that no unauthorized access to their technical facilities is possible and that these are secured against disruptions, including external attacks. The precautions must take the state of the art into account.
The Regensburg Chamber of Commerce and Industry (IHK Regensburg) counts websites and web stores among the digital services within the meaning of the TDDDG and translates Section 19(4) into practice mainly as HTTPS. Unlike Art. 32, this provision protects the technical systems themselves, not just the personal data on them.
If something does happen: the notification duty
Applies when personal data is affected by an attack.
- 72 h
Notification to the data protection authority without undue delay and, where feasible, within 72 hours of becoming aware, unless a risk to the people affected is unlikely (Art. 33).
- Always
Every breach is documented, even if no notification is needed (Art. 33(5)).
- High risk
Where the risk is likely to be high, the people affected are informed themselves as well (Art. 34).
What to do in the first hours is explained in my guides WordPress hacked: what to do? and Online store hacked: what to do?
Which rule applies to you?
| Rule | Applies to you? | What it is about |
|---|---|---|
| GDPR, Art. 32 | YesAs soon as personal data is processed | Security that takes the state of the art into account, regardless of size. |
| TDDDG, Section 19(4) (Germany) | YesGenerally, if you offer the website on a commercial basis | Protection of the technical systems against unauthorized access and attacks. |
| NIS2 (German BSI Act) | MaybeOnly for certain businesses, often indirectly through customers | Risk management, registration and reporting obligations. More in the guide NIS2 for small businesses. |
| Cyber Resilience Act | NoIt obliges manufacturers, not owners | Obligations for software vendors, including vendors of commercial plugins. More in the guide Cyber Resilience Act. |
Checklist for your website
- 01
Overview
Which software runs: WordPress or Shopware, all plugins, themes and extensions. Whatever is not needed gets deleted.
- 02
Updates
Security updates within a few days, tested on a copy first. Software without security updates gets replaced.
- 03
HTTPS
The whole website runs encrypted, and the certificate is renewed in time.
- 04
Access
Personal accounts, strong passwords, a second factor where possible, administrator rights only for those who need them.
- 05
Backups
Regular, stored separately from the website, and the restore has been tried at least once.
- 06
Review
Check at fixed intervals whether everything is up to date and the measures work, and record it.
- 07
Emergency plan
Who decides after an incident, who reports to the authority, where access credentials and contacts are kept.
- 08
Contracts
With service providers who have access to personal data, there is a data processing agreement (Art. 28 GDPR).
Where the Doppelgänger helps
The Doppelgänger is not a compliance product and does not make you “GDPR compliant”. It helps put the technical side of Art. 32 into practice day to day.
Tested updates
I apply every update to an exact copy of your website on a dedicated server in Germany first and test it. Security updates usually go live within 24 to 48 hours.
Nightly security checks
An inventory of all plugins and extensions matched against known vulnerabilities, a file comparison and a content check of the live website.
Encrypted backups
An encrypted backup on servers in Germany every night.
The dossier and reports
Every change goes into the dossier, plus regular reports. That lets you show when what was checked and applied.
More on this on the pages for WordPress and Shopware.
Note: this guide is not legal advice. Which measures are appropriate for your website is something to clarify with your data protection officer or a lawyer if in doubt.
Quick answers.
Does Art. 32 GDPR apply to small businesses too?
Yes. Art. 32 has no size threshold. It applies to anyone who processes personal data, including a small business website with a contact form or a store with only a few orders. Size only matters for which measures are appropriate: the GDPR requires a level of protection that matches the risk, not the same program for everyone.
Is there a fixed deadline by which I have to apply updates?
No. Neither the GDPR nor the supervisory authorities name a deadline in days. The Bavarian Data Protection Authority writes that security patches for websites should be applied promptly, because only a few hours can pass between a vulnerability becoming known and its exploitation. My recommendation: security updates within a few days, tested beforehand.
Will I get a fine if a plugin is outdated?
Not automatically. Fines under the GDPR are possible, but published cases over outdated website software are rare. The best known is an online store whose software had received no security updates since 2014; the data protection authority of Lower Saxony imposed €65,500. More often, a neglected website becomes a problem when, after an incident, the question comes up whether its security reflected the state of the art.
Are automatic updates enough to meet the obligation?
Automatic updates close vulnerabilities quickly, but they go live untested. The Bavarian Data Protection Authority explicitly describes patch management as obtaining, testing and applying. It also includes backups, secured access and regular review. How to apply updates safely is explained in my guide Updating WordPress safely.
Does the Doppelgänger make me GDPR compliant?
No, no technical service can do that on its own. The GDPR also involves a privacy policy, a record of processing activities, contracts and much more. The Doppelgänger helps with one part of Art. 32: applying updates tested and promptly, checking the live website every night, creating encrypted backups and documenting every change in the dossier.
What do I have to do if my website has been hacked?
If personal data is affected, the incident generally has to be reported to the data protection authority without undue delay and, where feasible, within 72 hours (Art. 33 GDPR), unless a risk to the people affected is unlikely. The individual steps are in the guides WordPress hacked and Online store hacked.