Personal data on public-sector websites
Personal data is any information relating to a natural person who can be identified, directly or indirectly. Such data includes not only a first name, surname or personal identification number, but also an e-mail address, telephone number, IP address, location information, login data or, in certain cases, cookie identifiers. It is important to understand that even information that seems technical at first glance can become personal data if it can be linked to a specific person.
In the European public sector, personal data processing is particularly relevant, because municipalities, schools, libraries, museums and other organisations provide digital services to residents every day. Website contact forms, event registration, request submission functions, newsletter subscriptions and e-services often involve the collection, storage and use of personal data. Every such action may involve the collection, storage and use of personal data.
What data is most often processed?
Public-sector websites most often process the data needed to provide a service or manage an enquiry. For example, on a municipality website, a resident may provide a first name, surname, e-mail address and the content of a request when applying for social support, registration or information. On school or preschool websites, parents’ contact details, registration form information or data related to the admissions process may be processed.
Museums, libraries and arts centres often collect data through education registration forms, event bookings or reader services systems. Even if only minimal information is collected, the organisation still needs to know clearly what it is used for, how long it is kept and who has access to that data.
GDPR requirements and legal basis
GDPR requires every processing of personal data to have a clear and lawful basis. In public-sector institutions, this is often a legal obligation, the performance of a task carried out in the public interest, or the data subject’s consent. For example, if a library collects data to issue a reader card, this may be linked to the lawful provision of a service; if a website offers news subscriptions, explicit consent from the person may be required.
The data minimisation principle also applies. This means that a website must not ask for more information than is actually needed for the specific purpose. If a contact form is intended to answer a general enquiry, a first name and e-mail address are usually sufficient, while additional fields may create unnecessary risk and fail to meet GDPR principles.
Transparency and privacy information
Residents have the right to know how their data is processed. For this reason, every public-sector website should provide a clear privacy notice stating in plain language what data is collected, for what purpose, how long it is kept, to whom it may be passed on and what rights the data subject has. This is especially important for organisations serving a broad part of the public, including older people or residents with lower digital skills.
Privacy information must be easy to find and written clearly, avoiding unnecessary legal jargon. A well-prepared privacy policy increases trust in the organisation and helps avoid misunderstandings about how residents’ data is used.
Security and access control
Personal data protection is not limited to legal texts. Public-sector websites must be technically secure: they should use a secure HTTPS connection, limit access to the administration environment, regularly update content management systems and plugins, and ensure backups are made. If a website uses forms or integrations with external systems, it is necessary to assess how data is transferred and stored in them.
In practice, this means that municipality or school staff should see only the data needed to perform their duties. The more people have unnecessary access to information, the greater the risk of accidental disclosure or a security breach.
Accessibility and responsible form design
When creating forms in which personal data is entered, it is important to consider not only GDPR but also accessibility requirements. Forms must be clear, understandable, properly labelled, keyboard-accessible and compatible with screen readers. This is especially relevant for the public sector, because digital services must be accessible to all residents, including people with disabilities.
Accessible forms help not only to comply with legal requirements, but also reduce the likelihood of errors. When the user clearly understands what data is needed and why, they can complete the form more easily, and the organisation receives more accurate information.
What should an organisation assess?
- What data you collect. Review all website forms, registrations and integrations. It often becomes clear that some fields are unnecessary or left over from older processes.
- What basis you use to process it. Every case of data collection must have a clear legal basis. If consent is relied upon, it must be given freely, be specific and be clearly expressed.
- How you inform residents. Privacy information should be easy to access near forms and in other important places on the website. It is useful to provide a short explanation next to each form and detailed information in the privacy policy.
- How you protect the data. Assess technical and organisational measures: access rights, password policy, system updates, data transfer and retention periods. This helps reduce risk and ensure responsible processing.
Personal data on public-sector websites must be processed responsibly, transparently and only to the extent necessary. A properly designed website helps not only to comply with the GDPR and other requirements, but also builds trust between the organisation and the resident. For municipalities, schools, museums and libraries, this is not only a legal obligation, but also part of quality digital service delivery.