GDPR-Compliant Website Checklist for Small Businesses

If your website collects names, emails, phone numbers, IP addresses or analytics data from people in the European Union, the General Data Protection Regulation applies to you. That is true whether you are a five-person agency in Lisbon, an online shop in Munich, or a company outside Europe selling to EU customers.

GDPR can feel intimidating, but for most small business websites, compliance comes down to a manageable set of practical steps. This GDPR website checklist walks you through them in order: what data you collect, how you explain it, how you get consent where needed, who you share it with, and how you keep it safe.

This article is general information, not legal advice.

Who does GDPR apply to?

GDPR is Regulation (EU) 2016/679, and you can read the full text on EUR-Lex. It applies to organizations established in the EU, and also to organizations outside the EU that offer goods or services to people in the EU or monitor their behavior, for example through tracking.

There is no general exemption for small businesses. Some obligations are lighter for smaller organizations, but the core principles apply to everyone: process data lawfully, fairly and transparently, collect only what you need, keep it accurate and secure, and do not keep it longer than necessary.

If you are based outside the EU and GDPR applies to you, you may also need to appoint a representative in the EU. Check whether this applies to your situation.

Know your data: mapping and lawful basis

Step 1: Map the personal data your website collects

You cannot comply with rules about data you do not know you have. Start with an honest inventory.

Look for personal data in:

• Contact, quote and booking forms (names, emails, phone numbers, messages)
• Newsletter sign-ups
• Checkout and customer accounts on an online store
• Analytics and advertising tools (IP addresses, device identifiers, cookie IDs)
• Embedded content such as videos, maps and social media widgets
• Live chat, chatbots and WhatsApp buttons
• Server logs and security tools

For each item, note what data is collected, why, where it is stored, who can access it, and how long you keep it. This forms the basis of your records of processing. The exemption from formal records for organizations with fewer than 250 employees is narrow, so many small businesses still need them in practice.

Step 2: Choose a lawful basis for each purpose

GDPR requires a lawful basis for every processing purpose. For a typical small business website, the common ones are:

• Contract: processing an order, delivering a service the customer asked for.
• Legal obligation: keeping invoices for tax purposes.
• Legitimate interests: basic security logging, answering a contact form, or reasonable business needs that do not override the person's rights.
• Consent: marketing emails to new contacts, non-essential cookies, most advertising tracking.

Consent must be freely given, specific, informed and unambiguous. Pre-ticked boxes do not count, and it must be as easy to withdraw consent as to give it.

Tell people clearly: privacy notice and cookies

Step 3: Publish a clear privacy notice

Your privacy notice (often called a privacy policy) should be easy to find, linked in the footer and next to every form, written in plain language, and cover:

1. Who you are and how to contact you (and your data protection officer, if you have one).
2. What data you collect and for which purposes.
3. The lawful basis for each purpose.
4. Who you share data with, such as hosting, email and payment providers.
5. Whether data is transferred outside the EU and what safeguards apply.
6. How long you keep each type of data.
7. The rights people have: access, rectification, erasure, restriction, objection, portability, and the right to complain to a supervisory authority.
8. Whether you use automated decision-making that significantly affects people.

Avoid generic templates that list tools you do not use; a notice that does not match reality is a problem in itself.

Step 4: Get cookie consent right

Cookie rules come mainly from the ePrivacy Directive (2002/58/EC) as implemented in each country, with GDPR setting the standard for valid consent. In short, you need prior consent before placing non-essential cookies or similar trackers, such as analytics and advertising tags, on a visitor's device. Strictly necessary cookies, like a shopping cart or login session, do not need consent.

A compliant cookie banner should:

• Block non-essential scripts until the visitor consents.
• Offer "Accept" and "Reject" options with equal prominence.
• Let visitors choose by category, and change their mind later through a link in the footer.
• Keep a record of consent.

The EU has proposed changes to cookie and GDPR rules through its "Digital Omnibus" package, so check the current status before relying on any simplification. For a deeper walk-through, read our guide to cookie banners and analytics under GDPR.

Collect less and share carefully: forms and vendors

Step 5: Make your forms data-minimal

Every field on a form is data you must protect. Ask only for what you genuinely need.

• A contact form usually needs a name, an email and a message, not a date of birth or home address.
• Separate marketing consent from the main purpose: an unticked checkbox for "Send me news and offers" rather than automatically subscribing everyone.
• Link to your privacy notice next to the submit button.
• Make sure form submissions are sent and stored securely, not emailed in plain text to a shared inbox that everyone can access.

Step 6: Review your vendors and data transfers

Most websites rely on third parties such as hosting, email marketing, payment, analytics and chat tools. Under GDPR, many of these act as processors on your behalf, and you need a data processing agreement (DPA) with each one. Most reputable providers offer a standard DPA you can accept.

Also check where each vendor stores and accesses data. Transfers outside the European Economic Area need a valid mechanism, such as an adequacy decision or standard contractual clauses. Keep a simple list of vendors, their DPAs and their transfer safeguards.

Protect the data and respect people's rights

Step 7: Secure the website

GDPR requires appropriate technical and organizational measures to protect personal data. For a small business website, the basics are:

• HTTPS everywhere, with a valid certificate.
• Strong, unique passwords and two-factor authentication on admin accounts, hosting and email.
• Regular updates to the CMS, themes and plugins, or a simpler architecture with fewer moving parts.
• Backups that are tested and stored separately.
• Access limited to people who need it.

At HEXACODES, we learned this first-hand when we cleaned up a spam-injection compromise on our own WordPress site and then moved to a fast static site. A smaller attack surface makes security much easier to maintain. Our guide on moving from WordPress to a static site explains the trade-offs.

If a personal data breach occurs, you generally must notify your supervisory authority within 72 hours of becoming aware of it, unless the breach is unlikely to result in a risk to people's rights and freedoms. Have a short plan ready so you are not improvising.

Step 8: Prepare for data subject requests

People can ask to see, correct, delete or export their data. You generally have one month to respond. Make it easy:

• Provide an email address for privacy requests.
• Know where data lives (your Step 1 inventory helps here).
• Verify the identity of the person asking before sharing data.
• Keep a simple log of requests and how you handled them.

How HEXACODES can help

HEXACODES builds websites and online stores with privacy in mind from the start: minimal forms, consent-aware analytics, secure hosting and clean code without unnecessary third-party scripts. We also offer cyber security services to help you harden an existing site. A full business website starting at $30/month can be set up with these foundations in place.

For a review of your current site, contact us. We can handle the technical side; for legal wording, we recommend working with a qualified privacy professional.

Frequently asked questions

Does GDPR apply to my small business website?

If you collect personal data from people in the EU, such as contact form submissions, newsletter sign-ups or analytics identifiers, GDPR very likely applies regardless of your company's size. It can also apply to businesses outside the EU that target EU customers. Some record-keeping duties are lighter for small organizations, but the core principles apply to all.

Do I need a cookie banner if I only use Google Analytics?

In most EU countries, analytics cookies are not considered strictly necessary, so you need consent before setting them. Some privacy-focused analytics setups may be treated differently by certain national authorities, so check the guidance in the countries you target. A properly configured consent banner is the safest default.

What are the penalties for not complying with GDPR?

GDPR allows fines of up to 20 million euros or 4% of worldwide annual turnover, whichever is higher, for the most serious infringements. In practice, regulators also issue warnings, orders to change practices and smaller fines. For small businesses, the bigger risks are often lost customer trust and the cost of fixing problems after a complaint.