Home / Blog / Website Security / What does GDPR compliant mean for a website, and how do you get there?

Answers

What does GDPR compliant mean for a website, and how do you get there?

16 October 2026 · By John Carlsson

GDPR compliant means handling personal data in line with the seven data protection principles in Article 5 and being able to demonstrate that you do. For a website, that covers knowing what data you collect and why, telling people through a privacy notice, collecting only what you need, keeping it secure and accurate, deleting it on time and handling requests from individuals.

What does GDPR compliance actually involve?

The General Data Protection Regulation is Regulation (EU) 2016/679, which entered into force in May 2016. The UK has its own version, the UK GDPR, which is built on the same principles. If your website collects personal data, such as names and email addresses from a contact form, newsletter sign-ups, customer accounts or analytics identifiers, these rules are likely to apply to how you handle that data.

Compliance is not a badge, a plugin or a single page. It means processing personal data in line with the data protection principles and being able to prove that you do. The UK Information Commissioner's Office (ICO) describes the principles as the spirit of the data protection regime, with very limited exceptions, and calls compliance with them a fundamental building block for good data protection practice. This article is general information, not legal advice.

What are the seven principles of GDPR?

The ICO's guide to the data protection principles lists seven, set out in Article 5. The first six are in Article 5(1) and accountability is in Article 5(2):

Lawfulness, fairness and transparency: process data lawfully, fairly and transparently.
Purpose limitation: collect data only for specified purposes.
Data minimisation: limit what you collect to what is necessary.
Accuracy: keep data accurate and up to date.
Storage limitation: keep it no longer than you need it.
Integrity and confidentiality (security): protect it with appropriate security.
Accountability: the controller is responsible for, and must be able to demonstrate, compliance with the other six.

Accountability is the principle that many site owners overlook. Quietly following good practice is not enough. You need records and documents that show what you do and why.

How do you get a website GDPR compliant?

The ICO publishes a self-assessment for small business owners and sole traders that works as a practical checklist. Applied to a website, it covers these questions:

Do you have a record of the personal data you hold, what you use it for and why? Each use should fit one of the lawful bases.
Do people know you hold their data and how you use it? This is usually done through a privacy notice.
Do you collect only the data you need, and make clear which form fields are optional?
Have you set retention periods, and do you delete data securely when they end?
Do you check that data is accurate, and can you correct it quickly when asked?
Is the data secure, whether it is held electronically or on paper?
Can you handle requests from people using their rights, such as access, correction, erasure and objection, within the required timeframes?
Do your staff know their responsibilities, and do you know what to do after a personal data breach, including when to report it to the ICO and tell the people affected?
Do you know whether you need to pay the data protection fee?

The last question is specific to the UK. Organisations in the EU should check the requirements of their own national data protection authority, as each Member State has at least one independent authority that enforces the regulation.

What happens if you are not GDPR compliant?

In the UK, the ICO lists four types of enforcement action: enforcement notices, reprimands, monetary penalties and prosecutions. According to the ICO's fining guidance, the standard maximum fine under the UK GDPR is £8.7 million, or 2% of total worldwide annual turnover for an undertaking if that is higher. The higher maximum is £17.5 million, or 4% of turnover if that is higher.

In the EU, the European Commission explains that a data protection authority can issue a warning for a likely infringement. For an actual infringement it can issue a reprimand, impose a temporary or permanent ban on processing, or fine up to €20 million or 4% of total annual worldwide turnover. Fines must be effective, proportionate and dissuasive, and authorities consider factors such as how serious the infringement was, whether it was intentional and how well the organisation cooperated.

People affected can also go to court. The Commission's enforcement and sanctions page says individuals can claim compensation for material damage, such as financial loss, or non-material damage, such as distress, but they must prove that concrete damage was suffered, because an infringement alone does not give rise to compensation.

Sources

Frequently asked questions

Does UK GDPR differ from EU GDPR?

The UK GDPR is the UK's own version of the regulation and is built on the same seven principles in Article 5. The main practical differences for website owners are the regulator and the enforcement figures. In the UK, the ICO enforces the law and fines are set in pounds, while in the EU each Member State has its own data protection authority and fines are set in euros.

Is a cookie banner enough to make a website GDPR compliant?

No. Compliance covers every way your site handles personal data, not one notice. The ICO checklist includes keeping a record of the data you hold and why, giving people privacy information, collecting only what you need, setting retention periods, keeping data secure and accurate, handling individual rights requests and knowing how to deal with a breach. A banner alone cannot show all of that.