How to comply with GDPR on your website: a step-by-step checklist

What GDPR compliance means for a website

GDPR applies whenever you handle personal data, meaning any information that identifies a living person directly or indirectly. On a website that includes names and email addresses from forms, order details, account logins, IP addresses in server logs, and the identifiers analytics and advertising tools store in cookies.

In the UK the law is UK GDPR together with the Data Protection Act 2018, and cookies and marketing emails are also covered by PECR. In the European Union it is the EU GDPR plus each country's ePrivacy rules. The core principles are the same in both. Personal data must be:

• processed lawfully, fairly and transparently;
• collected for specific purposes and not reused for unrelated ones;
• limited to what you actually need;
• accurate and kept up to date;
• kept no longer than necessary;
• kept secure.

On top of those, the accountability principle says you must be able to show that you comply. That is why so much of this checklist produces a document: a data inventory, a note of your lawful bases, a privacy notice, contracts and a retention schedule. If a customer complains or a regulator asks, those records are your evidence.

Start with a data audit

You cannot comply with rules about data you do not know you have. List every place your website collects or passes on personal data. Look at forms, checkout, accounts, comments, newsletter sign-ups, chat widgets, booking tools, analytics, advertising pixels, embedded videos and maps, and your server and security logs.

To find third parties you have forgotten about, load a page and list every external host it contacts:

curl -s https://www.example.com/ | grep -oE '(src|href)="https?://[^/"]+' | sed -E 's/.*:\/\///' | sort -u

That only catches what is in the HTML. Open the Network panel in DevTools as well, reload, and sort by domain to see hosts added later by scripts. Each one is a company that receives at least the visitor's IP address.

Record what you find in a simple table, one row per activity:

This table becomes the basis of your record of processing, your privacy notice and your retention schedule, so time spent here saves time later.

Choose a lawful basis for each use

Article 6 gives six lawful bases. A small website normally uses four of them:

• Contract for what you must do to deliver an order or service the person asked for.
• Legal obligation for records the law makes you keep, such as tax and accounting records.
• Legitimate interests for reasonable uses people would expect, such as answering an enquiry or keeping server logs for security. Write a short balancing note showing why your interest is not outweighed by the person's rights.
• Consent for newsletters, marketing and non-essential cookies, where PECR or the nature of the use requires it.

Pick the basis before you collect the data and do not swap later. If you rely on consent, it must be opt-in and as easy to withdraw as to give. A marketing tick box on a form should look like this, unticked:

<label>
  <input type="checkbox" name="newsletter" value="yes">
  Send me the Example Bakery newsletter. I can unsubscribe at any time.
</label>

Special category data, such as health information or ethnicity, needs an additional condition under Article 9. If your forms ask for anything like that, take more care and consider a data protection impact assessment.

Publish a clear privacy notice

Articles 13 and 14 list what you must tell people. Your privacy notice should say, in plain language:

• who you are and how to contact you;
• what personal data you collect, and why, with the lawful basis for each purpose;
• who you share it with, by name or by category;
• whether data goes outside the UK or EU, and the safeguard used;
• how long you keep each type of data;
• the rights people have and how to use them;
• the right to complain to the ICO or their local regulator.

Link it from the footer of every page and next to every form. Copying a template is fine as a starting point, but it must describe what your site really does, which is why the data audit comes first. The privacy policy guide walks through each section.

Then deal with cookies. Non-essential cookies need consent before they are set, through a banner that makes rejecting as easy as accepting. The cookie consent guide covers the set-up and cookie banner dark patterns shows the designs to avoid.

Processors, transfers and security

Every company that handles personal data on your behalf, such as your host, email marketing service, form tool, payment provider and analytics service, is a processor. Article 28 requires a written contract with each. Most providers publish a data processing agreement or addendum that you accept in your account settings; find it, accept it and keep a copy.

If a provider stores data outside the UK or EU, check which safeguard it relies on. For UK data that is usually an adequacy decision, the UK Extension to the EU-US Data Privacy Framework, or the International Data Transfer Agreement or Addendum. For EU data it is an adequacy decision, the Data Privacy Framework or standard contractual clauses.

Article 32 requires security appropriate to the risk. For a small website the essentials are:

• https everywhere, with HSTS and sensible security headers;
• updated CMS, plugins and themes, and removing what you do not use;
• strong, unique passwords and two-factor sign-in for every admin account;
• backups that are themselves protected and tested;
• form submissions sent by email only when necessary, not copied into several inboxes.

Retention needs a mechanism, not only a policy. For enquiries stored in a database, a scheduled job like this enforces the 24 months in the table:

DELETE FROM enquiries WHERE created_at < NOW() - INTERVAL 24 MONTH;

Rights requests, breaches and the ICO fee

People can ask to see their data, correct it, have it deleted, restrict or object to its use, and receive it in a portable form. You must respond without undue delay and within one month, which you can extend by up to two further months for complex or numerous requests if you tell the person. Requests do not have to use particular words or a form, so make sure anyone who reads your inbox recognises one.

Write down where to look for one person's data: the CMS, the shop, the mailing list, your email, the form tool and any spreadsheets. Most systems let you search and export by email address, and many CMS platforms have built-in export and erase tools.

If personal data is lost, stolen or exposed, you must report it to the ICO within 72 hours of becoming aware, unless it is unlikely to result in a risk to people. Keep an internal log of every breach, reported or not.

If you are based outside the UK or EU but target customers there, you may also need to appoint a representative. If you serve US customers too, read GDPR vs CCPA vs HIPAA.

The fix, step by step

Edge cases worth knowing

• Record of processing. Organisations with fewer than 250 staff are exempt from keeping a full Article 30 record unless their processing is more than occasional, likely to be risky, or involves special category data. Running a website and a customer list is usually regular processing, so keep the data audit table up to date anyway; it costs little and covers most of what a record needs.
• Server logs. IP addresses in access logs are personal data. Keep them for a set period, such as 30 to 90 days, and say so in your notice.
• Embedded content. YouTube videos, maps and social feeds can set cookies and send data as soon as the page loads. Use privacy-enhanced embeds or load them after consent.
• Industry rules. Online shops have extra points around payment and marketing, covered in GDPR for ecommerce. Software services acting as processors for clients should read GDPR for SaaS.
• Law changes. The Data (Use and Access) Act 2025 adjusts parts of UK GDPR and PECR, for example around searches for rights requests and some cookie exemptions. Check the ICO guidance for the current position.

Staying compliant

GDPR compliance is not a one-off project. Each new form, plugin, tag or supplier changes your data map. A few habits keep it accurate:

1. Before adding a new tool, ask what data it collects, where it sends it and whether it needs consent, and update the inventory, privacy notice and banner on the same day.
2. Every six months, repeat the external host check and compare the list with your inventory.
3. Once a year, confirm processor agreements are still in place, the ICO fee is paid and retention jobs are running.
4. Keep a short folder with the inventory, lawful basis notes, processor agreements, breach log and rights request log.

A regular GDPR scan catches the most visible problems, such as tags firing before consent and a missing privacy link, and the GDPR guide explains each check in more depth.