GDPR · Compliance
GDPR Website Compliance Checklist — 10 Steps for 2026
GDPR fines can reach €20 million or 4% of annual turnover — but compliance doesn't require a legal team. Most small business websites only need 10 practical steps. Here's your checklist.
Why GDPR Still Matters in 2026
The General Data Protection Regulation has been in force since 2018, and regulators across Europe are more active than ever. In 2025 alone, EU data protection authorities issued over €2.1 billion in fines. Small businesses aren't immune — the most common violations are exactly the ones small websites get wrong: cookie banners, missing privacy policies, and unsecured contact forms.
The 10-Step GDPR Checklist
1. SSL/TLS Everywhere
If your site still loads over plain HTTP, stop reading and fix this first. GDPR Article 32 requires "appropriate technical measures" to protect personal data in transit. HTTPS is the minimum. Use Let's Encrypt for a free certificate.
2. Privacy Policy That Actually Covers Everything
Your privacy policy must name every service that touches visitor data. That includes your hosting provider, your email newsletter tool, your CDN, your analytics — even if you think "it's just a basic setup." List the data collected, the purpose, the legal basis, and the retention period. If you use Google Fonts or a YouTube embed, that counts too.
3. Cookie Consent That Works
A cookie banner that says "by using this site you accept cookies" is not valid consent. Under GDPR, consent requires an affirmative action. Pre-ticked boxes don't count. Neither does "implied consent" from scrolling. Your banner must let visitors reject non-essential cookies with the same ease as accepting them — ideally one click.
4. Contact Form Security
Every contact form submission contains personal data (name, email, message). That data must be encrypted in transit (HTTPS), stored securely, and deleted when no longer needed. Add a checkbox: "I have read the privacy policy and agree to my data being processed." Without it, you lack a documented legal basis.
5. Audit Your Third-Party Scripts
Google Analytics, Facebook Pixel, Hotjar, embedded tweets, YouTube videos — every third-party script on your site sends data somewhere. You need to know where and what. Remove anything you don't actively use. For what remains, list it in your privacy policy and configure your cookie consent tool to block it until the visitor opts in.
6. Data Access and Deletion Requests
GDPR gives individuals the right to know what data you hold about them and to have it deleted. Set up a process: a dedicated email address (e.g., privacy@yourdomain.com), a response template, and a way to locate and export or delete their data within 30 days.
7. Data Processing Agreement (DPA) With Your Host
Your hosting provider is a data processor under GDPR. You need a written Data Processing Agreement with them. Most European hosts provide one by default. If yours doesn't, or if your host is outside the EU without an adequacy decision, that's a compliance gap.
8. Secure Your Admin Area
Unauthorized access to your CMS admin panel is a personal data breach waiting to happen. Use strong, unique passwords, enable two-factor authentication, restrict login attempts, and consider IP whitelisting or a separate admin URL.
9. Regular Backups — and Tested Restores
GDPR Article 32 requires the ability to restore availability and access to personal data. Having backups is not enough — you need to have tested that you can restore them. Automate daily backups and run a restore drill quarterly.
10. Document Everything
If a regulator asks, you need to show what you've done. Keep a simple record: what personal data you process, where it's stored, who has access, what security measures are in place, and when you last reviewed them. A Google Doc is fine — the act of documenting matters more than the format.
One Thing You Can Skip
You don't need a Data Protection Officer (DPO) unless your core activity involves large-scale processing of sensitive data or systematic monitoring. A small business website with a contact form and a newsletter does not. Don't let consultants sell you one.
The Fastest Path to Compliance
Work through this checklist top to bottom. The first 5 steps cover 90% of the compliance risk for a typical small business website. If you want a second pair of eyes, our GDPR website checklist review includes a visible-signal security assessment — we check your headers, encryption, third-party exposure, and form handling.