If your website collects personal data from people in the EU or UK, through contact forms, analytics, newsletters or online orders, GDPR (or UK GDPR) applies. Compliance is less about legal jargon and more about being transparent, collecting only what you need, getting valid consent where required, and protecting the data. This checklist covers the website-specific steps.
1Map the Personal Data Your Website Collects
List every way your site collects data: contact and quote forms, newsletter sign-ups, checkout, live chat, analytics, advertising pixels, embedded videos and maps. For each, note what data is collected, why, where it is stored, who can access it and how long you keep it. This map is the basis of your privacy notice and records.
2Publish a Clear Privacy Notice
Link to the notice from your footer and next to every form.
- Who you are and how to contact you
- What data you collect and why
- The lawful basis for each purpose
- Who you share data with, including processors
- International transfers and safeguards
- How long you keep data
- People’s rights and how to exercise them
4Make Forms Compliant
Collect only the fields you need, explain how the data will be used, and do not pre-tick marketing consent boxes. Keep newsletter consent separate from enquiry submission, and store a record of consent. Use HTTPS and secure email delivery for form data.
5Check Your Processors
Hosting providers, email platforms, CRMs, analytics tools and agencies that handle your data are processors. You need data processing agreements with them, and safeguards for transfers outside the EU or UK. Most major providers offer standard agreements you can accept in their dashboard.
6Handle Rights Requests and Breaches
Have a simple process to respond to access, correction and deletion requests within one month. Know how to detect and report personal data breaches; serious breaches must generally be reported to the supervisory authority within 72 hours. This article is general information, not legal advice. Check your obligations with a qualified adviser.
Frequently Asked Questions
Does GDPR apply to businesses outside Europe?
It can. GDPR may apply if you offer goods or services to people in the EU or monitor their behaviour, even if your business is based elsewhere.
Do I need consent for Google Analytics?
In the EU and UK, analytics cookies generally require prior consent unless configured in a way regulators accept as exempt. Use a consent banner and Google Consent Mode.
Is a privacy policy enough for GDPR?
No. You also need lawful bases, valid consent where required, secure processing, processor agreements and processes for rights requests.
What are the fines for GDPR breaches?
Fines can be significant, but regulators usually focus first on guidance and corrective action, especially for small businesses that show good faith.
Want This Done for You?
Adkode helps businesses in India, Australia and Europe with website development. Get a free audit and a clear plan.
Get a Free Audit