How to Fix Every GDPR Kit Finding

The four documents and where each one goes

Each document has a different home and a different audience. Getting that right is most of the deployment work.

Jump to a fix

• Missing or non-compliant consent banner: installing the generated banner code and checking it behaves correctly for new and returning visitors.
• Trackers firing before consent: finding tags that load too early and making them wait for the banner's accept signal.
• Missing or outdated policies: publishing the generated privacy and cookie policies and completing the parts a scan cannot know.
• Missing Article 30 record: storing, completing and maintaining the internal record of processing.

Fix a missing or non-compliant consent banner

The Kit's banner code is self-contained and tailored to the trackers found on your site. Installing it correctly takes a few minutes; checking it properly takes a little longer and is where most problems surface.

Installing the banner

1. Run the GDPR Kit on your URL and copy the generated banner code.
2. Paste it as the very first element inside the <body> tag, before any other scripts. In most CMSs this means a theme setting or plugin for "body open" code rather than the header box, which usually outputs inside <head>.
3. Make sure it appears on every template: home, content pages, shop and checkout pages, blog posts and error pages.
4. Clear any page cache or CDN cache so visitors receive the new code.

Checking it works

• Open the site in a private window. The banner should appear straight away.
• Choose an option, then visit another page. The banner should not return, because the choice is stored in a cookie.
• Repeat with the reject option and confirm it is as easy to find and use as accept. Consent is not valid if refusing is harder than agreeing.
• Check that the banner works on a phone and does not hide the page's own navigation permanently.

If you already had another consent tool, remove it completely before going live. Two banners confuse visitors and can leave tags controlled by the wrong one. For the underlying rules on what a valid banner must offer, see our guide to fixing cookie consent banners.

Fix trackers that fire before consent

A banner on its own changes nothing if analytics and marketing tags still load the moment the page opens. This is the failure regulators act on most often, and it is easy for anyone to spot.

Find out what loads too early

1. Open a fresh private window with the developer tools open on the Network tab.
2. Load your home page and do not touch the banner.
3. Filter the requests for names such as google-analytics, googletagmanager, facebook, hotjar or clarity. Any analytics or marketing request here is firing before consent.
4. Check the Application or Storage tab too: analytics cookies such as _ga should not exist yet.

Make tags wait, in Google Tag Manager

1. Create a Custom Event trigger for the banner's consent_accepted event.
2. Change every non-essential tag, including analytics, advertising pixels and heatmaps, to fire on that trigger instead of on page view.
3. Publish the container, then repeat the network test: nothing non-essential should load until you click accept.
4. Accept, then open a second page and confirm the tags now fire there too for a visitor who has already agreed.

Tags added outside a tag manager

Tracking code pasted into a theme header, added by a plugin or built into a platform integration will ignore your Tag Manager triggers. Find each one, remove it, and recreate it inside Tag Manager behind the consent trigger, or switch off the plugin's own tracking option. If you run Google advertising, check Google's current consent requirements for UK and EEA visitors as well. Our guide to fixing tracking before consent covers other setups in more depth.

Fix a missing or outdated privacy or cookie policy

The Kit's policies describe the trackers it actually detected, which is more accurate than a generic template listing services you have never used. To deploy them:

1. Create two pages, for example /privacy-policy and /cookies, and paste the generated content into each.
2. Link both from the site footer so they are one click away from every page, and link the cookie policy from the banner.
3. Add a visible "last updated" date to each page.
4. Replace any older policy pages, redirecting their URLs to the new ones so existing links keep working.

What you still need to fill in

A scan sees what your website loads. It cannot see what happens behind it. Before publishing, read the privacy policy through and add or check anything the scan could not know, such as:

• Your organisation's full name, address and contact details for privacy questions.
• Data you collect offline or by email, phone or in person.
• Suppliers that never touch the website, such as accounting, payroll or CRM systems.
• How long you keep each kind of data, and the lawful basis you rely on for each purpose.

For the full list of what a privacy notice must contain, our guide to fixing an incomplete privacy policy goes through each requirement.

Fix a missing Article 30 record (RoPA)

Article 30 of the UK GDPR requires a record of processing activities, usually shortened to RoPA. It is an internal document: you do not publish it, but you must be able to show it to the Information Commissioner's Office if asked. The Kit generates a first version pre-filled from the processing it detected on your site.

Where to keep it

Store it with your other business records, somewhere the people responsible for data protection can find and edit it, such as a shared drive or document management system. Do not upload it to your public website. Keep earlier versions so you can show how your processing has changed over time.

Completing it

The record typically needs to cover, for each processing activity: your name and contact details, the purpose, the categories of people and personal data involved, who receives the data, any transfers outside the UK, how long you keep it and a general description of your security measures. The Kit fills in what the website reveals. Add everything else, including staff records, supplier contacts and customer data held outside the site.

Does a small business need one?

There is a limited exemption for organisations with fewer than 250 employees, but it does not apply to processing that is regular rather than occasional, that is likely to put people's rights at risk, or that involves special category or criminal offence data. Most small businesses process customer or staff data regularly, so in practice most need a record for at least part of what they do. Check the ICO's guidance for your situation.

Which document to deploy first

If you are starting from nothing, deploy in the order that reduces risk fastest. The documents visitors experience come before the paperwork, because they are the parts anyone can test.

1. Gate the trackers. Moving tags behind consent stops the most visible and most often reported problem, even before the banner looks exactly right.
2. Install the banner. Without it, gated tags will never fire, so do this in the same session as step one.
3. Publish the cookie policy. The banner should link to it, so visitors can see what they are agreeing to.
4. Publish the privacy policy. Complete the parts the scan cannot know first, then link it from the footer and from every form that collects personal data.
5. Store the Article 30 record. It is not public, but it takes the longest to complete properly, so start it now and finish it over the following weeks.

The law in this area is changing. The Data (Use and Access) Act 2025 amends parts of UK GDPR and PECR in stages, including some cookie consent exemptions. Check the ICO's current guidance before relying on any new exemption, and re-generate your documents if your approach changes.

Deployment order, step by step

1. Run the GDPR Kit on your site's main URL and download all four documents.
2. Run the network test in a private window to record which trackers currently fire before consent.
3. Remove any old consent tool and any hard-coded tracking snippets from the theme.
4. Install the generated banner as the first element in <body> on every template.
5. In your tag manager, move every non-essential tag onto the consent_accepted trigger and publish.
6. Repeat the network test before and after accepting, on at least two pages.
7. Complete and publish the privacy and cookie policies, link them in the footer and from the banner.
8. Complete the Article 30 record and file it internally.
9. Re-run the Kit after any change to your tools, and review all four documents at least once a year.

For more detail on each generated document, read the GDPR Kit Guide or see the example Kit output. For what the law requires beyond these four documents, such as handling requests from individuals and supplier contracts, the GDPR Guide and the GDPR fixes hub cover the wider picture.