GDPR website checklist: what to check before you publish

Does GDPR apply to your site?

GDPR applies when you offer goods or services to people in the EU, or monitor their behavior, even if your company and servers are elsewhere. The UK has its own version, UK GDPR, plus the Privacy and Electronic Communications Regulations (PECR) for cookies. If you sell to customers in Dublin, Berlin or Manchester, plan for both.

Cookie rules come from the ePrivacy rules in each country, so a cookie banner and a privacy notice are two separate jobs.

We build sites for clients in several countries from our head office in Pune, India, and most items below are decisions made during the build, not text added at the end. Use the list as a technical pre-launch review, then ask a privacy lawyer to confirm the legal bases for your own business.

General information only, not legal advice. Rules and regulator guidance change, so check current guidance from your national authority.

Cookies, scripts and consent

Forms and data capture

• No pre-ticked boxes. A newsletter opt-in must be a separate, unticked choice from sending an enquiry.
• Ask only for fields you will use. A phone number you never call is data you must protect.
• Put a short notice and a link to the privacy notice next to the submit button.
• Write down the lawful basis for each form: consent, contract, legitimate interest or legal obligation.
• Set a retention period for enquiries and make it automatic where the platform allows.
• Check where entries are stored. Form plugins that save every entry in the site database are easy to forget when you answer a deletion request.
• Check your spam protection. Some tools load scripts from a third party and need to be listed in your notice.

What the privacy notice must say

Article 13 sets the minimum. Write it in plain language and date it.

• Who you are and how to reach you, and your EU or UK representative if you have no establishment there
• Each purpose, with the lawful basis for it
• Who receives the data, including vendors
• Whether data leaves the EEA or UK and what protects it
• How long you keep it
• The rights people have: access, correction, deletion, restriction, objection and portability
• The right to complain to a supervisory authority
• Whether giving the data is required and what happens if someone declines

Vendors and transfers

For each vendor keep a one-line record: what data, which agreement (Article 28), and what covers any transfer outside the EEA, such as standard contractual clauses or the vendor's participation in the EU-US Data Privacy Framework.

Data requests and breaches

1. Pick one intakeA monitored mailbox or form that goes to a named person, with a named backup.
2. Verify and logConfirm the person is who they say they are, and log the date. The response clock is one month.
3. Search every systemCMS, form storage, CRM, email platform, analytics, support desk and backups.
4. Export or deleteSend the export in a common format, or delete and note any records you must keep by law.
5. Plan for breachesIf personal data is exposed and people are at risk, the regulator must usually hear within 72 hours of you becoming aware. Keep a log of every incident, even small ones.

Download the list and our notes

The downloadable version of this checklist adds an owner column, a date column and our own margin notes for each line, so it can go straight into a launch ticket.

• Run the network-tab test again after the site goes live. Staging and production often differ.
• Do not copy another company's privacy notice. It will describe tools you do not use.

If you want the build done with these checks included, send us the site details and we will reply with a fixed quote after a short call.