GDPR and Website Privacy Compliance Checklist for Small Businesses

Overview

Website privacy compliance is not limited to publishing a privacy policy. A practical review connects your public explanations to what the business actually does: the forms it uses, the analytics it runs, the emails it sends, the vendors it hires, and the records it keeps.

GDPR may be relevant to a business established in the European Economic Area or to a business whose online activities involve people in that region. Applicability can depend on the business, the individuals affected, and the nature of the processing. Other privacy laws may also apply based on location, industry, or the type of information collected. This checklist is an organizational tool, not a substitute for advice about a specific business.

Start by assigning one person to maintain the checklist and one place to store supporting records. For each item, record the current status, the person responsible, the date reviewed, and any follow-up task. That simple audit trail makes it easier to identify gaps instead of relying on memory.

Checklist by scenario

1. Before launching a new website or form

• List the data collected. Record every field, including names, email addresses, telephone numbers, account credentials, payment details, location data, uploaded files, and information collected automatically by the site.
• Explain the purpose. For each data field, state why it is needed and whether the field is essential or optional. Avoid collecting information merely because a form builder makes it available.
• Map the data flow. Note where information goes after submission: a website host, customer relationship platform, email provider, payment processor, analytics tool, advertising platform, help desk, or other vendor.
• Review the legal basis. Identify the reason the business is processing each category of information. The appropriate basis may differ between fulfilling a request, performing a contract, complying with a legal obligation, pursuing a legitimate interest, or obtaining consent.
• Prepare the privacy notice. The notice should match the actual operation of the website and explain relevant purposes, categories of data, sharing, retention, rights, contact methods, and important choices available to users.
• Check form language. Make privacy information easy to find near collection points. Do not describe optional marketing as necessary to receive a service unless that is genuinely required and supportable.

2. When using cookies, analytics, or advertising tools

• Make an inventory of cookies, pixels, software development kits, tags, and similar technologies.
• Separate tools that are necessary for the requested website function from optional analytics, personalization, or advertising tools.
• Check whether optional tools load before a user has made the required choice. Configuration should reflect the consent approach used by the business.
• Provide a way to change or withdraw an optional choice that is reasonably accessible after the first visit.
• Ensure the cookie notice and settings panel use clear categories and do not hide important choices behind confusing labels.
• Confirm that the privacy notice describes the relevant tracking and sharing practices rather than referring vaguely to “partners.”

3. When hiring a vendor or adding a software tool

• Ask what information the vendor receives, why it receives it, where it processes the information, and how long it retains it.
• Determine whether the vendor is processing information on the business’s instructions or using it for its own purposes.
• Review the contract for data-processing terms, confidentiality, security duties, assistance with user requests, breach cooperation, deletion or return of data, and use of subprocessors.
• Check whether the vendor’s security and retention practices fit the sensitivity of the information.
• Update the data map, privacy notice, internal records, and cookie inventory when the tool goes live.

4. When responding to a privacy request

• Create a single intake route for requests, such as a monitored privacy email address or web form.
• Verify identity proportionately before disclosing or changing personal information.
• Record the request date, request type, systems searched, response, and any reason for limiting the response.
• Search relevant systems rather than only the main customer database. Information may also exist in email, support tickets, spreadsheets, backups, or marketing platforms.
• Use a documented process for access, correction, deletion, restriction, objection, portability, or consent withdrawal requests where those rights apply.
• Escalate unusual, disputed, or time-sensitive requests for legal review instead of making an improvised decision.

5. When a security incident occurs

• Keep an incident response contact list and define who can isolate systems, preserve evidence, communicate internally, and make legal or regulatory decisions.
• Record what happened, when it was discovered, which systems were involved, and what categories of information may be affected.
• Change exposed credentials, preserve relevant logs, contain the issue, and document corrective steps.
• Assess notification duties promptly with qualified advice. Do not wait for a complete technical investigation before beginning the assessment.
• Review whether the incident reveals a weakness in vendor controls, access permissions, training, backups, or retention practices.

What to double-check

Privacy notice accuracy: Compare every section with the live website and current workflows. A policy that says the business does not share data is not accurate if an email, analytics, advertising, or support platform receives it.

Consent records: If consent is used, keep enough information to show what the person was told, what they selected, and when the choice was made. Make withdrawal practical and ensure a withdrawn choice affects the relevant processing.

Data minimization: Remove unused form fields, old mailing lists, duplicate exports, and unnecessary administrative access. Less data can mean fewer records to protect and review.

Retention: Set a purpose-based retention rule for customer records, leads, support tickets, marketing contacts, and backups. A retention schedule should explain when records are reviewed and what happens at the end of the period.

International transfers: Identify whether vendors or infrastructure make information available across borders. The contractual and legal requirements can depend on the countries involved and the arrangement used, so this is an area where tailored advice may be important.

Security basics: Review multi-factor authentication, administrator permissions, software updates, encryption where appropriate, backups, password management, access logs, and staff training. Security should be proportionate to the nature and sensitivity of the information.

Children and sensitive information: If the site may attract children or collects health, financial, biometric, identity, or other sensitive information, do not rely on a general website review. Consider specialized requirements and obtain professional guidance.

Common mistakes

• Copying a generic privacy policy without comparing it to the site’s actual tools and data flows.
• Installing analytics or advertising tags before the consent configuration has been reviewed.
• Assuming a vendor’s standard terms answer every data-processing and security question.
• Collecting broad consent for unrelated purposes instead of presenting clear, separate choices where needed.
• Keeping personal data indefinitely because deletion has not been assigned to anyone.
• Treating a privacy request as an ordinary customer-service ticket without a verification and tracking process.
• Ignoring spreadsheets, inboxes, downloaded reports, and backups when mapping or deleting information.
• Failing to revisit the policy after adding a newsletter, online store, booking system, chatbot, or new advertising platform.

For related business compliance work, use this checklist alongside a broader small business legal compliance checklist. If a vendor agreement or data-processing contract is unclear, the contract review checklist can help organize questions before seeking advice.

When to revisit

Schedule a privacy review at least whenever the underlying facts change. Revisit this checklist before seasonal marketing or planning cycles, before launching a new website feature, and whenever the business adds a form, cookie, payment method, newsletter, customer platform, advertising tool, or international vendor.

Also review it after a security incident, a substantial change in products or audience, a business acquisition, a change in ownership or location, or a new type of personal information collection. Set a recurring calendar reminder even when no change is expected. During each review, test the live consent banner, submit a sample privacy request, verify that the privacy notice links work, check vendor contracts, and document completed corrections.

If the review identifies uncertainty about applicability, consent, international transfers, sensitive information, or a potential incident, pause the affected activity and seek qualified legal advice. Keep the completed checklist and supporting records together so the next review starts with evidence rather than assumptions.