WordPress API GDPR Compliance: A 2026 UK Guide
16 August 2026
Learn how to make your WordPress REST API GDPR-compliant for UK users. Covers ICO guidance, data minimisation, authentication, and more.
Understanding UK GDPR and the WordPress REST API
The UK GDPR, retained post-Brexit, applies to any organisation processing personal data of UK residents. WordPress core exposes a REST API with endpoints like /wp/v2/users that can leak data such as usernames, names, and post author info. For UK site owners, failing to secure these endpoints risks ICO enforcement, fines up to £17.5 million or 4% of turnover, and reputational damage. This section explains the core principles: data minimisation, purpose limitation, and the right to erasure. It's essential to audit your API routes and understand what data is publicly accessible by default. Without intervention, your API may expose more than you think.
Auditing Your Endpoints for Personal Data
Start by using WP-CLI or a tool like Postman to list all REST routes via /wp-json. Look for endpoints that return personal data: user registrations, comments, contact forms, WooCommerce orders. For each, determine whether the data is truly necessary to be public. The ICO expects you to conduct a Data Protection Impact Assessment (DPIA) when using new technologies. In the UK, high-risk processing requires a DPIA under Article 35 of the UK GDPR. Document your findings, and consider disabling unused endpoints entirely. Use filters like rest_endpoints to remove sensitive ones. Regularly re-audit as plugins add new routes.
Implementing Authentication and Authorisation Controls
The REST API supports authentication methods like cookies and application passwords. For any endpoint that accesses personal data, you should enforce authentication and capability checks. Use the permission_callback parameter in register_rest_route() to check user roles. For third-party integrations, apply OAuth 2.0 or API keys with scope restrictions. The UK GDPR requires appropriate technical measures to ensure data confidentiality and integrity. Implement rate limiting and logging to detect unauthorised access attempts. Never rely on 'security through obscurity'. Also, ensure that your API responses respect user privacy settings, e.g., hiding authors if a user opts out via a user meta flag.
Handling Data Subject Requests (DSARs) via API
Under UK GDPR, individuals can submit Subject Access Requests (SARs) to access, rectify, or erase their data. Your WordPress site should have a process to export or delete personal data via the API. WP core provides wp/v2/search and users endpoints, but often insufficient for plugin data. Build custom endpoints using register_rest_route() that gather data from multiple tables, producing a JSON export protected by authentication. For erasure, ensure that any API-cached data is also purged. The ICO advises responding within one month. Also consider implementing verifiable requests: ensure you confirm the identity of the requester before sending personal data via API responses.
Privacy Notices, Consent, and UK-Specific Best Practices
When your API processes personal data, your privacy policy must mention it. For UK users, consent under the Privacy and Electronic Communications Regulations (PECR) also applies to marketing via API. If your API is used to trigger emails, ensure consent is recorded. Use the ICO's guidance on legitimate interests as a lawful basis, not consent, where appropriate. Document data retention periods for API logs. Also consider data minimization by default: return only fields needed, using _fields parameter. Finally, keep a record of processing activities (ROPA) as required by UK GDPR Article 30. For many WordPress sites, this means updating your internal documentation to include API endpoints.
FAQ
Yes, by default the REST API includes endpoints like /wp/v2/users that can expose usernames and author details (first name, last name) if not restricted. Also, comments and post meta could leak data. You should audit and disable or restrict these endpoints to comply with UK GDPR data minimisation principles.