GDPR Compliance & Security Headers

Under the European Union’s General Data Protection Regulation (GDPR), website operators are legally required to protect the personal data of European citizens. While GDPR is often associated with consent banners and privacy policies, it also enforces strict requirements on technical security.

Specifically, Article 32 of the GDPR mandates that organizations implement appropriate technical and organizational measures to ensure a level of security appropriate to the risk.

Security headers and cookie configurations are essential tools to achieve this compliance.

1. How Security and Privacy Overlap

Many web security breaches directly result in the compromise of Personally Identifiable Information (PII) or user session cookies:

1. Session Hijacking: If an attacker intercepts a user’s session cookie (for example, because the site lacks HSTS or does not mark cookies as secure), they can log in as the victim. This constitutes a severe personal data breach under GDPR, requiring notification to regulatory authorities within 72 hours.
2. XSS and Keylogging: If an attacker exploits a Cross-Site Scripting (XSS) vulnerability to inject a keylogger script into your forms, they can capture user passwords and personal details in real time.

Implementing security headers is the most direct technical measure to mitigate these specific privacy risks.

2. Key Headers for GDPR Protection

To align your site with GDPR Article 32 requirements, you should configure the following:

Content Security Policy (CSP)

By restricting the execution of inline scripts and restricting connections to approved endpoints, CSP directly protects users against form-jacking, data-sniffing scripts, and keyloggers.

HTTP Strict Transport Security (HSTS)

HSTS ensures that all communications between the browser and the server remain encrypted, defending against snooping on public networks and preventing data exposure in transit.

Referrer-Policy

The default referrer settings in older browsers leak the exact page URL to external links. Under GDPR, URLs containing user identifiers, email addresses, or transaction numbers are classified as PII. A restrictive policy protects this data from exposure:

Referrer-Policy: strict-origin-when-cross-origin

3. Securing User Session Cookies

Cookies are the primary mechanism used to maintain logged-in states. If cookies are not properly hardened, they are highly vulnerable to interception and cross-site attacks.

To protect personal session data, ensure all cookies (especially session and authentication cookies) carry these three attributes:

Set-Cookie: session_id=xyz123; Secure; HttpOnly; SameSite=Strict

• Secure: Directs the browser to only transmit the cookie over encrypted HTTPS connections, preventing interception.
• HttpOnly: Blocks client-side JavaScript from accessing the cookie (using document.cookie). If your site has an XSS vulnerability, the attacker cannot steal an HttpOnly session cookie.
• SameSite: Restricts the cookie from being sent on cross-site requests (e.g. when clicking a link on an external site pointing to your site). This is the primary defense against Cross-Site Request Forgery (CSRF) attacks.
  • SameSite=Lax: Balances security and usability (default in modern browsers).
  • SameSite=Strict: Maximizes security for sensitive dashboards.

[!TIP] Not sure if your website is properly secured? Read our guide on How Do I Know My Website Is Secure?.

Sources & Standards

• European Parliament: General Data Protection Regulation (GDPR) Article 32 - Regulations regarding technical measures and security controls for personal processing environments.
• OWASP: Session Management Cheat Sheet - Cookie Attributes - Comprehensive guidelines on setting Secure, HttpOnly, and SameSite cookie attributes.
• GDPR Info: Article 25 - Data Protection by Design and by Default - Legal requirements for integrating data protection into your processing systems.