WordPress Data Protection API: A UK Compliance Guide for 2026
16 August 2026
Learn how to use the WordPress Data Protection API for UK GDPR compliance. Export and erase personal data from your site in 2026.
What is the WordPress Data Protection API?
The WordPress Data Protection API is a set of built-in hooks and functions introduced to help site owners comply with data privacy laws like the UK GDPR. It provides standardised methods for exporting and erasing personal data stored across your site. Instead of manually hunting through user meta, comments, or WooCommerce orders, you can register exporters and erasers. These are callbacks that tell WordPress exactly where to find and how to remove personal data. For UK site owners, this means you can respond to Subject Access Requests (SARs) and erasure requests efficiently, without piecing together a custom solution. The API is particularly valuable for developers building privacy-conscious plugins and themes.
Why UK websites need it for GDPR compliance
The UK GDPR, retained after Brexit, gives individuals the right to access and delete their personal data. If your WordPress site collects any personal information—even just email addresses—you must be able to fulfil these requests promptly. The Data Protection API is the official WordPress way to do this. Without it, you risk non-compliance, which can lead to fines from the Information Commissioner's Office (ICO) of up to £17.5 million or 4% of annual global turnover. The API helps you document that you have a transparent, auditable process for data subject requests. It also makes it easier for your data processing to be tracked, which is essential under the UK GDPR accountability principle.
How to export personal data with the API
To export data, you register an exporter using the wp_privacy_personal_data_exporters filter. Each exporter returns an array of data groups, containing items with an item_id, group_label, and an array of data fields. For example, a custom plugin might register a function to export user session tokens. WordPress then aggregates all registered exporters when an admin triggers an export from the Privacy Tools screen. The exported data is delivered as a JSON or HTML file, which you can provide to the requester. For UK GDPR, you must ensure the export is secure and delivered via a verified method, such as a logged-in download link. The API handles the packaging, but you decide what to include based on your processing activities.
How to erase personal data with the API
Erasure works similarly using the wp_privacy_personal_data_erasers filter. Each eraser receives an email address and returns a response array with items_removed and items_retained. The script runs in batches to avoid timeouts, so your eraser should handle a limited number of items per pass. If you cannot fully erase something—for example, a financial record required by UK law—you must mark it as retained and provide a reason. WordPress logs these actions in the site's privacy log for transparency. This is crucial for UK GDPR compliance because you need to prove you tried to erase data and explain why you kept some. The API also integrates with the 'Erase Personal Data' admin screen, making the process straightforward for UK site admins.
Best practices for developers and site owners in the UK
For UK developers, always test your exporters and erasers with sample data before going live. Use the wp_privacy_* hooks and avoid collecting unnecessary personal data in the first place. For site owners, keep a record of all data subject requests and your responses. The WordPress privacy tools built-in audit log helps here. Remember that the API only handles data stored in your WordPress database; external services like Google Analytics or CRM tools need their own process. Also, consider anonymisation as an alternative to erasure where applicable—the API supports this if your plugin does. Finally, update your privacy policy to mention the API and how users can exercise their rights. Staying proactive reduces risk and builds trust with your UK audience.
FAQ
Yes, it was designed to align with GDPR principles, which the UK GDPR follows. The API provides a standard framework for handling subject access requests and erasure, helping you demonstrate compliance. However, you still need to ensure your site only processes lawful data and that you respond within the one-month timeframe.