GDPR compliant website: what you really need
A GDPR compliant website is usually reduced to the cookie banner that pops up on the first visit. Visitors click “Accept”, and that’s supposedly that.
It isn’t. The regulation covers every kind of personal data processing, and a website collects personal data even when you aren’t thinking about it – through forms, analytics, newsletter tools and content embedded from other platforms.
What counts as personal data
The term is broader than most people assume.
Personal data is any information that can be linked to a specific person. A name and an email address are obvious examples. An IP address, a cookie identifier and device data fall into the same category, even though on their own they don’t look like anyone’s name.
That is why analytics, ad pixels and embedded videos fall within the scope of the regulation. Each of them collects data before the visitor has done anything at all.
Where cookie consent most often goes wrong
Almost every website has a cookie banner. Only a minority have it set up correctly.
The most common mistake is that scripts run before consent is given. Analytics loads as soon as the page opens, and the banner only appears afterwards. By then the data has already been collected, and the consent has no effect.
The second is having no way to refuse. If the banner only offers “Accept”, refusing isn’t as easy as agreeing, which the regulation explicitly requires. The reject button has to sit at the same level and be just as visible.
The third is pre-ticked consent. A box that is already ticked isn’t consent, because doing nothing is not agreeing.
On top of that, since 2024 Google has required consent handling in line with its Consent Mode for users in the European Economic Area. Without it, your analytics and ad campaign data become incomplete.
Contact forms on a GDPR compliant website
A form is the most direct way of collecting data, and the easiest one to get right.
It needs clear information on who is collecting the data, for what purpose and how long it is kept. The consent checkbox must not be pre-ticked, and the text next to it must be easy to understand, with a link to the privacy policy.
Collect only what you need. If you need a name and an email address to answer an enquiry, there is no justification for a date-of-birth field.
Also think about where the messages end up. If they are stored in the website’s database, they are available to anyone who gets into the system – which brings us back to security.
What a privacy policy must include
This is the document most often copied from someone else’s website, and the one that least reflects reality.
It must state who the data controller is, with contact details, which categories of data are collected and for what purpose, on what legal basis and how long they are kept. It should also list the recipients of the data – hosting, email provider, analytics, ad platforms – and the rights visitors have, including access, rectification, erasure and objection.
If data is transferred outside the European Economic Area, this must be stated together with the safeguards in place.
Contracts with service providers
The part that is almost always skipped.
Anyone who processes data on your behalf – your host, newsletter tool or booking platform – is considered a data processor. You need a contract with each of them that governs that processing. Most reputable providers have one ready, and it is enough to accept it in your account settings.
How big is the real risk
The regulation provides for high fines, but in practice they are imposed in more serious cases.
A more realistic scenario for a smaller company is a complaint to the supervisory authority from a dissatisfied visitor or a competitor, followed by a request for a statement. At that point you will be asked for proof of the consents collected and insight into how the website is set up.
The second risk is commercial. More and more clients, especially in the public sector and abroad, check compliance before they start working with you.
Steps to a GDPR compliant website
The process can be done in a few steps.
List everything on the website that collects data, including embedded content. Set up a consent system that genuinely blocks scripts until consent is given and keeps a record of the consents. Fix your forms and add a consent checkbox. Write a privacy policy based on how things actually work, not on a template. Check your contracts with service providers. Put a procedure in place for when someone asks for their data to be deleted.
Please note that this is not legal advice. For more complex situations, especially when sensitive data is processed, it is advisable to consult a data protection expert.
Our approach
We set up basic compliance on every website we build: a consent system that blocks scripts until consent is given, properly configured forms and a privacy policy template tailored to your line of business.
