GDPR Fixes: Every Audit Finding, One Place
If your website collects anything that identifies a person, from a contact form or a newsletter sign-up to analytics cookies or an order, data protection law applies to it. In the UK that means the UK GDPR and the Data Protection Act 2018, with cookies and marketing covered by the Privacy and Electronic Communications Regulations, known as PECR.
The GDPR Audit checks the parts of that you can see from outside the site. This page explains what each finding means, how serious it is, and which of our guides fixes it.
Before you start
These guides explain the rules in plain English and show common, practical ways to meet them. They are not legal advice. If your site handles sensitive information such as health data, processes data about children, or you are unsure whether a rule applies to you, speak to a solicitor or data protection specialist. The Information Commissioner's Office, the ICO, publishes free guidance for small organisations and runs a helpline.
The rules also change. The Data (Use and Access) Act 2025 is being brought into force in stages and adjusts several areas, including when some low-risk cookies need consent and how complaints are handled. Check the ICO's current guidance for any change that affects you.
The areas the audit checks
| Area | What the law expects | Where it comes from |
|---|---|---|
| Cookie consent | Clear consent before non-essential cookies are set, with refusing as easy as accepting. | PECR, with UK GDPR setting the standard for consent. |
| Tracking before consent | Analytics, advertising pixels and similar scripts do not run until the visitor agrees, unless an exemption applies. | PECR. |
| Privacy policy | A clear explanation of who you are, what you collect, why, on what lawful basis, who receives it, how long you keep it and what rights people have. | UK GDPR Articles 13 and 14. |
| Lawful basis | A valid reason for each use of personal data, chosen before you start. | UK GDPR Article 6. |
| Individuals' rights | A way for people to ask for their data, correct it, delete it or object, with a reply within one month. | UK GDPR Articles 12 to 22. |
| Processors | A written contract with every supplier that handles personal data for you. | UK GDPR Article 28. |
| Breaches | Report qualifying breaches to the ICO within 72 hours, and tell affected people when the risk to them is high. | UK GDPR Articles 33 and 34. |
| International transfers | A recognised safeguard when personal data leaves the UK. | UK GDPR Chapter V. |
The fix guides
Each guide covers one finding from start to finish: what the law expects, what the audit found, how to put it right, and the questions people ask most.
Cookies and tracking
Fixing cookie consent banners covers what a valid banner looks like: no pre-ticked boxes, a reject option as easy to use as accept, clear categories, and a way to change your mind later. Fixing tracking before consent covers the scripts that load before anyone has agreed, such as analytics tags and advertising pixels, and how to make them wait for consent, including Google's Consent Mode.
Policies and records
Fixing an incomplete privacy policy covers the information a policy must contain and how to write it so people can understand it. Fixing an unclear lawful basis covers the six lawful bases, how to choose the right one for each purpose, and the balancing test needed before relying on legitimate interests.
People's rights and incidents
Fixing the data subject rights process covers subject access requests and the other rights: how people can ask, how to check who they are, and how to reply within the one-month deadline. Fixing a missing breach response plan covers what counts as a breach, the 72-hour reporting deadline and what to prepare before anything goes wrong.
Suppliers and transfers
Fixing missing processor contracts covers the agreements needed with hosting, email, analytics, payment and other suppliers. Fixing international data transfers covers sending data outside the UK, including adequacy regulations, the UK extension to the EU-US Data Privacy Framework, and the UK's international data transfer agreement.
By type of business
The business guides bring the rules together for three common kinds of site: online shops, with checkout data, order records and marketing consent; B2B SaaS, where you are often a processor for your customers; and content sites, with comments, newsletters and advertising.
Which findings to fix first
Not every finding carries the same risk. A sensible order is to fix what visitors and regulators notice first, then the paperwork behind it.
- Tracking that runs before consent. It affects every visitor on every page, and it is easy for anyone to check with a browser.
- A banner that makes refusing harder than accepting. The ICO has written to many website operators about this and treats it as a priority.
- A missing or incomplete privacy policy. Without it, people cannot know what happens to their data, and you cannot show you told them.
- No route for rights requests. A request you did not notice still has a one-month deadline.
- Missing processor contracts and transfer safeguards. These are usually quick to fix, because most large suppliers publish a standard agreement.
- No breach plan. Seventy-two hours is very short if you are working out the process for the first time.
What a compliant cookie setup looks like
Cookie findings are the most common, so they are worth describing in more detail. A setup that meets current guidance usually has these features:
- Nothing optional before a choice. Only strictly necessary cookies, such as a session or shopping basket cookie, are set when the page first loads.
- Equal choices. "Accept all" and "Reject all" appear on the first layer of the banner, with the same size and prominence.
- No pre-ticked boxes. Optional categories start switched off.
- Clear categories. Visitors can see what analytics, advertising and other cookies do, and who sets them.
- Easy to change later. A link in the footer reopens the settings, and withdrawing consent is as easy as giving it.
- Scripts that wait. Analytics and advertising tags load only after the matching consent, rather than loading and then being hidden.
- A record of consent. What each visitor chose and when, so you can show it if asked.
The quickest test is to open your site in a private browser window, open the developer tools and look at the cookies and network requests before clicking anything on the banner. If advertising or analytics requests have already gone out, the tracking is running before consent.
A sensible order of work
- Run the GDPR Audit and note every finding.
- List every tool and supplier the site uses: hosting, analytics, email, forms, payments, chat, advertising, fonts and embedded content.
- For each one, write down what personal data it receives, why, and your lawful basis.
- Fix the cookie banner and make optional scripts wait for consent.
- Rewrite the privacy policy from that list, so it matches what the site actually does.
- Check each supplier has a data processing agreement and, where data leaves the UK, a transfer safeguard.
- Set up a simple process for rights requests and a short breach plan, and keep both where the team can find them.
- Run the audit again, and repeat the check whenever a new tool or script is added to the site.
For the full reference, see the GDPR Guide, the example audit or the beginner tutorial.
1. Does GDPR apply to a small website?
Yes, if it collects personal data, whatever the size of the business. A contact form, a newsletter sign-up, customer orders, comments and analytics cookies can all involve personal data. The rules scale with the risk, so a small site with simple processing has less to do than a large one, but it still needs a lawful basis, a clear privacy policy, valid cookie consent and a way to handle people's requests about their data.
2. Do I need consent for analytics cookies?
In most cases, yes. Under PECR, cookies that are not strictly necessary for the service the visitor asked for need consent, and analytics cookies have usually fallen into that group. The Data (Use and Access) Act 2025 introduces exemptions for some low-risk analytics, subject to conditions, as its provisions come into force. Check the ICO's current guidance before relying on an exemption, and keep advertising cookies behind consent in every case.
3. Is it legal to have only an Accept button on a cookie banner?
No. Consent has to be freely given, so visitors must be able to refuse as easily as they can accept. A banner with only "Accept", or with a large accept button and the reject option hidden in a second layer, does not meet the ICO's guidance. Put "Accept all" and "Reject all" side by side on the first layer, with equal prominence, and let people choose categories in more detail if they want.
4. How long do I have to answer a subject access request?
One month from receiving the request, or from receiving any information you need to confirm the person's identity. You can extend by up to two further months if the request is complex or you have received several from the same person, but you must tell them within the first month and explain why. Requests do not have to use a particular form or wording, so make sure everyone who reads your emails can recognise one.
5. When do I have to report a data breach?
You must report a personal data breach to the ICO within 72 hours of becoming aware of it, unless it is unlikely to result in a risk to people's rights and freedoms. If the risk is high, you must also tell the people affected without undue delay. Keep a record of every breach, including the ones you decide not to report, with your reasons, because the ICO can ask to see it.
6. What is a data processing agreement and do I need one?
It is the written contract required by Article 28 of the UK GDPR whenever another business handles personal data on your behalf, such as a hosting company, email service, analytics provider or payment processor. It sets out what they may do with the data and how they must protect it. Most large suppliers publish a standard agreement you can accept in their dashboard, so the fix is often simply finding and recording it.
7. Can I use US services such as Google Analytics or Mailchimp?
Yes, with the right safeguards. Sending personal data from the UK to the US is a restricted transfer, which is covered where the US company has signed up to the UK extension of the EU-US Data Privacy Framework, or by the UK's international data transfer agreement or addendum. Check which your supplier uses, mention the transfer in your privacy policy, and keep consent in place for any tracking cookies involved.
The GDPR Audit checks what a visitor can see: the cookie banner, the scripts that load before consent, the privacy policy and the routes people have to exercise their rights, and lists each finding with the guide that fixes it.
Run the GDPR Audit →