The GDPR website checklist: 12 things to check on your site

Most GDPR problems on business websites are not dramatic data breaches. They are small, everyday things: a tracking pixel that fires before consent, a contact form that asks for more than it needs, a font loaded from a server in another country, a privacy policy copied from a template that describes tools you no longer use. Each one is easy to fix. Together they are what regulators, and increasingly visitors, notice.

This checklist walks through every part of a typical website that touches personal data, in the order you would check them.

First: does GDPR apply to your website?

GDPR applies if your business is established in the EU, or if you offer goods or services to people in the EU or monitor their behaviour (analytics and ad tracking count). So a company in London, New York or Dubai with European customers is in scope too.

"Personal data" is broader than most people expect: names and emails, but also IP addresses, cookie identifiers, device fingerprints and anything that can single out a person. Almost every website processes some.

1. Know what data your site collects

You cannot protect what you have not listed. Make a simple table of every place your site collects or sends personal data:

• Forms: contact, quote, newsletter, booking, job applications
• Analytics: Google Analytics, Matomo, Plausible or similar
• Advertising pixels: Meta, TikTok, Google Ads, LinkedIn
• Embedded content: YouTube, Google Maps, Instagram feeds
• Chat widgets and AI assistants
• Payment and booking tools
• Server logs and security tools

For each, note what data, why, where it goes, which company processes it and how long it is kept. This becomes the backbone of your privacy policy and your records of processing.

2. Collect only what you need

Data minimisation is one of GDPR's core principles. On a website it mostly means shorter forms:

• A contact form rarely needs a phone number, date of birth or full address. Make extra fields optional or remove them.
• Do not ask for sensitive data (health, religion, ethnicity) in an open form unless it is truly necessary.
• Do not add newsletter sign-up to a contact form by default.

Shorter forms also convert better, so this is one rule that pays for itself.

3. Have a legal basis for every purpose

Every use of personal data needs one of the legal bases in Article 6. For websites, the common ones are:

• Contract or pre-contract steps: replying to a quote request, processing an order.
• Legitimate interest: basic security, fraud prevention, some first-party analytics, after you have weighed it against visitors' interests.
• Consent: newsletters, advertising pixels, most third-party analytics and any non-essential cookies.

Consent must be freely given, specific, informed and unambiguous. No pre-ticked boxes, no "by using this site you agree".

4. Get cookie consent right

Under the ePrivacy rules, any cookie or similar technology that is not strictly necessary needs consent before it is set. That includes analytics and advertising cookies. The details of a compliant banner (equal "Accept" and "Reject" buttons, no pre-ticked categories, blocking scripts until consent) are covered in our guide to EU cookie banner rules.

The most common failure we see is technical, not visual: the banner looks fine, but tags fire on page load anyway. Test it: open your site in a private window, do not click anything, and check in the browser's developer tools which requests and cookies appear.

5. Check third-party tools and their contracts

Every tool that processes visitors' data on your behalf is a "processor", and you need a data processing agreement (DPA) with it under Article 28. Most reputable providers offer one in their terms or dashboard: Google, Meta, Mailchimp, HubSpot, your hosting company, your form tool. Make sure it is accepted and keep a copy.

6. Handle international transfers

If data leaves the European Economic Area, the transfer needs a legal mechanism. For US companies certified under the EU-US Data Privacy Framework, the Commission's adequacy decision of July 2023 covers transfers, and the EU General Court upheld it in September 2025. For providers that are not certified, standard contractual clauses and a transfer assessment are needed. Check your providers' certification and mention transfers in your privacy policy.

7. Load fonts and embeds carefully

In January 2022 a German court (Landgericht München I) awarded damages to a visitor because a website loaded Google Fonts from Google's servers, sending his IP address to Google without a legal basis. The amount was small, but it triggered a wave of warning letters.

The fix is easy and makes your site faster: host fonts on your own server. The same thinking applies to embeds. A YouTube video or Google Map can load a "click to load" placeholder first and only connect to the third party when the visitor chooses to.

8. Write a privacy policy that matches reality

Article 13 lists what you must tell people when you collect their data: who you are, contact details, purposes, legal bases, recipients, transfers, retention periods, their rights and their right to complain to a supervisory authority. A good privacy policy:

• Describes the tools you actually use, by name
• Is written in plain language, not legal fog
• Is linked from every page and next to every form
• Has a date and gets updated when tools change

A template that mentions services you have never used, or misses the pixel you added last month, is a red flag to any regulator.

9. Secure the basics

GDPR requires appropriate security. For a website that means:

• HTTPS everywhere, with modern TLS
• Updated CMS, plugins and server software
• Strong admin passwords, two-factor authentication and as few admin accounts as possible
• Spam and abuse protection on forms
• Backups that are themselves encrypted and access-controlled
• Form submissions not sitting forever in an inbox that half the company can read

10. Set retention periods

Decide how long you keep each kind of data and delete it after that. Contact form enquiries that never became clients do not need to live forever. Analytics data can be set to expire. Write the periods down and, where possible, automate the deletion.

11. Make it easy to exercise rights

Visitors can ask to see, correct, delete or export their data, object to processing and withdraw consent. You must answer within one month. Make this easy:

• A clear contact for privacy requests in your privacy policy
• A way to change cookie choices at any time (a footer link that reopens the banner)
• An unsubscribe link in every marketing email
• A simple internal process so requests do not get lost

12. Be ready for a breach

If personal data is exposed, you may need to notify your supervisory authority within 72 hours and, in serious cases, the affected people. Know in advance who decides, who your hosting and security contacts are, and where your list of systems and data lives.

What it costs to ignore this

GDPR fines can reach €20 million or 4% of worldwide annual turnover for the most serious breaches. Small businesses rarely see numbers like that, but supervisory authorities do fine small companies, and complaints from visitors, competitors and privacy organisations are how many cases start. There is also the trust cost: a visitor who sees a dark-pattern cookie banner or a form asking for too much is less likely to become a client.

A quick self-check

Open your website in a private window and answer honestly:

• Do any analytics or ad requests fire before you click anything on the banner?
• Can you reject cookies as easily as you can accept them?
• Does every form link to the privacy policy and ask only for what you need?
• Are fonts, maps and videos loaded from third parties before any interaction?
• Does the privacy policy name the tools you actually use today?
• Do you have a DPA with every provider that handles visitor data?

If any answer is wrong, you know where to start.

How we build privacy-first websites

Every site we build is set up this way from the start: fonts and assets self-hosted, tags blocked until consent, Consent Mode configured for Google tools, short forms with spam protection and first-party analytics where possible. If you want your current site checked, get in touch and we will tell you what to fix first.