A call from an online shop owner started like this: "We got a letter from the data protection authority. They are asking about our contact form." It turned out the form collected name, phone and email, sent them to a company mailbox, and said nothing underneath about what happened to the data afterwards. No policy, no checkbox, no retention period. The shop had been running that way for four years.
The story has no dramatic ending because the company reacted quickly. But it illustrates something typical: most company websites treat GDPR as a cookie banner that has to be added so nobody complains. The regulation is interested in something considerably broader, namely what personal data you collect, on what legal ground, how long you keep it, and who else sees it.
This article looks at GDPR from the point of view of someone maintaining a company website rather than a lawyer. The aim is to know what to check and what to ask your developer for.
What GDPR requires from a website
The General Data Protection Regulation applies whenever you process personal data of individuals in the European Union. Personal data is any information by which a person can be identified: name, email, phone, address, IP address, cookie identifier, order number.
Note the last two. Many site owners assume that if they do not ask for a name and email, GDPR does not concern them. Google Analytics, however, places an identifier in the browser and records an IP address, and that already counts as processing personal data. The requirements follow from there.
Legal grounds for processing
The regulation permits processing only if you have one of several lawful bases. Four matter in practice for a company website.
Consent. Freely given, specific, informed and withdrawable. Used for marketing cookies, remarketing and newsletters.
Performance of a contract. The data needed to fulfil an order. No consent is required, because without an address you cannot ship the parcel.
Legal obligation. Invoice data is retained because tax law requires it.
Legitimate interest. A more flexible basis, applicable for example to fraud prevention, but it requires a documented assessment that your interest does not override the individual's rights.
Which documents belong on the site
The minimum for a company website is a privacy policy and a cookie policy. An online shop adds terms and conditions plus information about the right of withdrawal. These documents are not a formality to be copied from another site. They must describe your actual tools, your actual retention periods and your actual data recipients.
Cookies and the consent banner
Cookies are small files a site stores in the browser. Some are necessary for the site to function: session, cart, language, bot protection. The rest serve analytics and advertising.
The distinction is critical. Necessary cookies require no consent. Everything else does, and consent must come before those cookies load.
What a lawful banner looks like
This is where most mistakes happen. A banner that merely announces "This site uses cookies. OK" does not meet the requirements, because it offers no choice.
A correct banner has three characteristics. First, it offers an equally visible reject option, not just a green "Accept" button and a hidden settings link. Second, it does not load analytics and advertising scripts before the choice is made. Third, it lets the visitor change their decision later, usually through a small icon in the corner.
Comparing consent approaches
| Approach | Compliance | Effect on data | Suitable for |
|---|---|---|---|
| Information only banner | Non compliant | Full data | No lawful case |
| Accept and Reject, equal weight | Compliant | 20 to 40 percent data loss | Most company sites |
| Granular choice by category | Fully compliant | 30 to 50 percent loss | Shops and script heavy sites |
| Consent Mode with modelling | Compliant | Partial data recovery | Sites running active ads |
The last row deserves attention. Google Consent Mode lets scripts load in a restricted state, without cookies, and send signals without identifiers. When a visitor declines, the data is not lost entirely but modelled instead. That is the practical compromise between compliance and useful analytics when running advertising.
Technical checks you can run yourself
Open your site in incognito mode and press F12. Under Application, in the Cookies section, look at what has been stored before you touch the banner at all. If _ga, _fbp or similar are already there, your banner is not blocking scripts and is purely decorative.
Second check: the Network tab. Look for requests to facebook.net, googletagmanager.com or doubleclick.net before consent. Every such request means visitor data has already left your site.
Third check: fill in your own contact form and follow where the data goes. If it lands in a personal mailbox on a free service and stays there forever, that is a problem both for retention and for security.
The role of hosting and security
GDPR requires appropriate technical measures. In practice that means a valid SSL certificate, regular updates, restricted admin access and working backups. A site without an encrypted connection that collects names and phone numbers is exposed in a way that is hard to explain during an inspection.
If you use external services that process data on your behalf, such as an email platform, accounting software or a hosting provider, you need a data processing agreement with them. Most serious providers offer one as part of their terms.
User rights and how to serve them
Every individual has the right to request a copy of their data, correct it, delete it, restrict processing and object to it. The response deadline is one month.
For a small site this sounds alarming, but in practice it comes down to preparation. Know where the data lives: in the site database, in the email platform, in accounting. Write your procedure down on a single page. When a request arrives you follow what is written instead of improvising under pressure.
The right to erasure is not unconditional
If a customer requests deletion but an invoice has been issued, the invoice data stays because the law requires it. What gets deleted is what is not needed: the site account, the newsletter record, behavioural data. A clear distinction prevents disputes.
The most common gaps
A copied privacy policy. A document mentioning tools the site does not use and omitting the ones it does. It is immediately obvious during a review.
Pre ticked boxes. A consent checkbox ticked by default is not valid consent.
A newsletter signup tied to the order. You cannot make marketing subscription a condition of purchase. Consent must be separate and voluntary.
No record of processing activities. Even a small company should be able to describe what data it processes and why. A few pages of text, written once.
An unprotected admin panel. A website admin with a simple password and no login attempt limits is a risk the regulation treats as a lack of appropriate measures.
Frequently asked questions
Are there fines for small companies
Data protection authorities do impose penalties on small companies, with the amount weighed by severity and intent. The more common scenario, however, is not a fine but an order with a deadline to fix the issues. The problem is that fixing things under pressure and on a short deadline costs more than preparing properly in the first place.
Do I need a cookie banner if I run no ads
If the site uses only necessary cookies and no analytics at all, a banner is not mandatory. The moment you add Google Analytics, Meta Pixel or an embedded video player that sets cookies, the banner becomes necessary.
Do I lose Google Analytics data because of consent
Yes, some visitors will decline and will not be counted. The loss is typically between 20 and 40 percent depending on the audience. Configuring Consent Mode with conversion modelling recovers a meaningful part of that picture without overriding the visitor's choice.
Who is liable if the developer made the mistake
Liability before the regulator sits with the company behind the site, since it determines the purposes of processing. The relationship with the contractor is settled separately by contract. That is why compliance requirements are best written into the brief at the website build stage.
How do I check whether my site is compliant
Do three things: open the site in incognito and inspect cookies before consent, read your own policy and compare it against the tools actually in use, and trace where form data ends up. If all three match reality, the foundation is in place.
Next step
GDPR compliance is not a one off project but a state that has to be maintained. Every new tool on the site, every new form and every new integration changes the picture and calls for a short review.
If you want someone to review your site and say specifically what is missing, get in touch. We run a technical check of cookies, forms and tracking settings, describe what needs changing, and prepare an individual quote within 24 hours.
