A website that complies. The basics to know.
This section gives a simplified overview of the points to check before going live. It does not replace legal notices, a privacy policy, a consent mechanism or legal advice: the exact rules depend on the publisher’s country of establishment and on the site’s activity.
Personal data and GDPR
As soon as a site collects data that identifies a person (name, email, phone, message…), the GDPR applies in principle. You need to know what data is collected, why and on what basis, inform people clearly and collect only what is necessary.
Cookies and other trackers
Cookies and trackers that are strictly necessary for a service the visitor requested (such as the site’s technical operation) do not, in principle, require consent. Those used for audience measurement, advertising or third-party services are generally subject to it, after clear information. Depending on the tools actually used, a site may not need any banner at all: it depends on what it stores on or reads from the visitor’s device.
Legal information
A business website should in principle show who publishes it and how to reach them, plus information specific to its activity (for example a company number or the details of a regulated profession). The exact content depends on the country and the activity: it is written for each site, not copied.
Risks and possible penalties
In case of breach, a data protection authority may, among other measures, issue a warning, order the site to comply or impose an administrative fine. Under the GDPR (Art. 83), the possible ceilings are €10 million or 2% of worldwide annual turnover for certain breaches (for example controller obligations), and €20 million or 4% for others (basic principles, consent, individuals’ rights, transfers outside the EU), whichever is higher for a company. These are maximums: the authority considers the seriousness, duration, intent, measures taken and cooperation. A missing text does not, by itself, trigger an automatic fine.
Depending on the site’s features
- Forms: state which data is requested, why, who receives it and how to exercise one’s rights.
- Audience measurement: check whether the tool sets trackers and whether consent is required, depending on the tool and the competent authority.
- Embedded videos and third-party services (maps, fonts, social networks): they may send visitor data to the provider, so choose and configure them carefully.
- Individuals’ rights: access, rectification, erasure, objection… provide a simple way to exercise them and to respond.