GDPR Website Compliance Checklist for UK and EU Businesses

Does GDPR apply to my website?

The EU GDPR applies to organisations established in the EU, and to organisations elsewhere that offer goods or services to people in the EU or monitor their behaviour. The UK GDPR applies in the same way for the UK. So a US or Asian business actively selling to European customers is usually covered too. Fines for serious breaches can reach €20 million or 4% of worldwide annual turnover, whichever is higher, although most enforcement against small businesses starts with orders and reprimands.

How should cookie consent work?

Under the ePrivacy rules (PECR in the UK), you need consent before storing or reading non-essential cookies and similar technologies: most analytics, advertising pixels, heatmaps and many embedded players. Strictly necessary cookies, such as a shopping basket or login session, don’t need consent.

Consent must be a clear, affirmative choice. Pre-ticked boxes and “by continuing to browse you agree” banners don’t count, and rejecting should be as easy as accepting. Most importantly, the banner must actually block the scripts until the visitor agrees; many banners on the web are only decorative. In the UK, the Data (Use and Access) Act 2025 introduces some exemptions for low-risk cookies such as certain analytics, being phased in; check the ICO’s current guidance before relying on them.

What should a website privacy notice include?

Who you are and how to contact you; what personal data you collect and from where; why you use it and your lawful basis for each purpose; who you share it with, including processors such as your hosting and email providers; any transfers outside the UK or EU and the safeguards used; how long you keep it; and people’s rights, including the right to complain to the regulator. Write it in plain language, specific to your business, not copied from a template.

How do you make forms and analytics compliant?

Ask only for data you need. A quote form rarely needs a date of birth. Explain the purpose next to the form and link to the privacy notice. Keep marketing consent as a separate, unticked checkbox, and record when and how consent was given.

For analytics, either load them only after consent, or use a privacy-focused configuration (for example cookieless, aggregated analytics) and document your reasoning. Remove tracking scripts you no longer use; old pixels are a common finding in audits.

What about hosting and data transfers?

Your hosting, email, CRM and analytics providers are data processors, so you need data processing agreements with them; most major providers include these in their terms. If data leaves the EU or UK, a transfer mechanism is required, such as an adequacy decision (for example the EU–US Data Privacy Framework for certified US companies) or standard contractual clauses. Choosing EU or UK hosting regions simplifies this for many businesses.

How do you handle data requests and breaches?

People can ask for a copy of their data, corrections or deletion, and you generally have one month to respond. Know where personal data lives (website database, CRM, email tool, backups) so you can find it quickly. For breaches, have a simple plan: contain, assess risk, notify the regulator within 72 hours where required, and inform affected people when the risk is high.