GDPR compliant website: the complete guide to the requirements and the 2026 checklist
Having a GDPR compliant website isn't a bureaucratic detail to postpone, it's a basic condition for operating online in the European Union. If you collect even a single email address through a contact form, if you use Google Analytics or an advertising pixel, if you sell products or manage user accounts, you're processing personal data. And the moment you process personal data, the General Data Protection Regulation (EU Regulation 2016/679) imposes a set of precise obligations on you.
The good news is that making a GDPR compliant website doesn't require being a lawyer. It requires understanding the fundamental requirements, putting them in order and checking them methodically. In this complete guide — the central article of our compliance path — we look at what you actually need, requirement by requirement, with a practical checklist and the most common mistakes to avoid.
Why GDPR compliance concerns your site too
Many people think the GDPR is only a big-company problem. It's the opposite: the Regulation applies to anyone processing the personal data of people located in the EU, regardless of size. A personal blog with a newsletter, a small online shop, a landing page with a form, an app built over a weekend with vibe coding: they all fall within scope.
The risk isn't theoretical. Supervisory authorities can impose fines of up to 20 million euros or 4% of worldwide annual turnover, and in recent years the most frequent complaints have concerned precisely the smaller sites: non-compliant cookies, missing notices, trackers activated without consent. They're easy mistakes to make and, fortunately, just as easy to fix once identified.
The fundamental requirements of a GDPR compliant website
Let's look at the pillars compliance rests on. Each one is a piece of the puzzle: missing one means exposing yourself to challenge.
1. A clear, specific privacy notice
The privacy notice (or privacy policy) is the document explaining to users what data you collect, why, how long you keep it, who you share it with and what rights they can exercise. It must be written in plain language, reachable from every page (usually in the footer) and — this is the critical point — it must reflect what the site actually does.
A privacy policy copied from another site or generated with default values is useless and potentially harmful: it declares processing that doesn't exist or, worse, omits processing that does. If you want to really understand whether and when it's mandatory and what it must contain, we've dedicated a specific piece to when a website privacy policy is required.
2. Cookie policy and cookie banner with prior consent
This is where most non-compliance concentrates. The law (the GDPR together with the ePrivacy Directive and national guidelines) requires non-essential cookies and trackers — profiling analytics, advertising pixels, marketing tools — to be activated only after the user has given free, specific and unambiguous consent.
That means that on the first visit the banner must:
- block non-essential trackers until the user chooses;
- offer a "Reject" button as visible as "Accept";
- allow a granular choice by category;
- not use pre-selected boxes or mere scrolling as a form of consent.
The cookie policy, whether separate or built into the notice, lists every cookie in detail with its purpose and duration. It's the most delicate area because it requires correct technical configuration, not just a text.
3. Legal basis for processing
Every processing activity must rest on one of the legal bases in Article 6 of the GDPR: consent, performance of a contract, a legal obligation, legitimate interest and others. You can't process data "because you need it": you must know which basis you're relying on. For a newsletter the basis is consent; for fulfilling an order it's performance of a contract; for invoicing it's a legal obligation. Mapping legal bases correctly is what makes each of your choices defensible.
4. Record of processing activities
The record of processing activities is an internal document listing every processing operation you carry out: what data, for what purposes, on what legal bases, for how long, and who you share it with. There are some simplifications for very small organisations, but in practice it's a valuable tool even for the most modest operation, because it forces you to get organised and it's what you use to demonstrate compliance if you're inspected.
5. Handling data subject rights
Users have precise rights: access to their data, rectification, erasure ("right to be forgotten"), restriction, portability and objection to processing. A compliant site must provide a simple channel to exercise them — typically a dedicated email address stated in the notice — and an internal procedure to respond within the legal deadline (normally one month).
6. Data security
The GDPR requires technical and organisational measures adequate to protect data. At site level that means at least: an active HTTPS certificate, updated software and plugins, strong passwords, backups, access control and attention to any vulnerabilities. A security flaw leading to a data breach brings notification obligations and can turn into a fine. Security and compliance travel together: a vulnerable site is never truly compliant.
7. Appointing processors (DPA)
Every supplier processing data on your behalf — hosting, the email marketing service, the payment gateway, analytics systems — is a "processor". With each of them you must have a data processing agreement (DPA) in place. Many suppliers make one available with a click in the account settings: the point is knowing which parties are involved and making sure the contract exists.
8. Appointing a DPO, where required
A Data Protection Officer (DPO) is mandatory only in specific cases: large-scale processing of special categories of data, systematic large-scale monitoring, or when the controller is a public authority. Most small sites aren't required to appoint one, but it's important to assess your own situation rather than assume.
GDPR compliance checklist
Here's a concise list to take stock of your site. Every ticked item is a step towards a GDPR compliant website.
- Privacy notice present, specific and linked from the footer of every page
- Detailed cookie policy listing cookies, purposes and duration
- Cookie banner with prior consent, a "Reject" button and granular choice
- Non-essential trackers blocked until consent
- No pre-selected boxes in forms
- Legal basis identified for every processing activity
- Record of processing activities completed and kept up to date
- Working channel for data subjects to exercise their rights
- Active HTTPS certificate and up-to-date software
- DPA in place with every external supplier
- Assessment of whether a DPO is needed carried out
If you want to see at a glance where your site stands, you can start with a GDPR website audit that analyses the most exposed points in minutes.
The most common mistakes (and how to spot them)
Some instances of non-compliance repeat with striking regularity. Here are the three most frequent.
| Mistake | Why it's a problem | How to spot it |
|---|---|---|
| Trackers activated before consent | Google Analytics, the Meta pixel or similar fire on page load, before the user chooses | The site sends data to third parties on the very first visit, with no interaction |
| Copied or default privacy policy | It declares processing that doesn't exist or omits real processing | Names of third-party companies, addresses or tools you don't use |
| Pre-ticked boxes | Consent is neither free nor unambiguous | In forms the checkbox is already ticked when the page opens |
The first mistake is by far the most widespread and the hardest to spot with the naked eye, because it happens "behind the scenes" in the code. It's exactly the kind of problem an automated scanner like Appurai helps with: it analyses the site, identifies trackers firing before consent, and flags a non-compliant cookie banner and missing or generic notices, without you having to inspect the code by hand.
GDPR alignment: where to start
If you're starting from scratch, the most effective order is this: first map what the site does and what data it collects, then sort out the privacy and cookie policies, then configure the banner correctly and block the trackers, and finally get DPAs, the record and rights handling in place. Bringing a site into line with the GDPR is an iterative path, not a single job: every time you add a new tool — a chat widget, a new pixel, a plugin — you go back and check.
To generate the missing documents so they reflect your real site, there are privacy policy generators that start from your actual processing activities, a far more solid approach than copying someone else's text. Anyone running an online shop then has additional specific requirements, which we cover in the dedicated guide to GDPR for e-commerce.
Frequently asked questions
Does the GDPR apply to a small personal blog?
Yes, if you process the personal data of visitors located in the EU — and a newsletter, comments or even just analytics involve that. Size reduces some obligations, but it doesn't exclude the Regulation from applying.
Are the privacy policy and the cookie policy the same thing?
No. The privacy policy describes all the site's data processing; the cookie policy is specific to cookies and trackers. They can coexist but they cover different ground and you need both.
Can I use a free template for the privacy notice?
A template can be a starting point, but it must always be adapted to your site's real processing. A notice that doesn't reflect what you do is, in effect, non-compliance.
What do I risk if my site isn't compliant?
Fines can reach 20 million euros or 4% of annual turnover. In the most common cases the amounts are lower, but even a single complaint can trigger an investigation.
Is an all-in-one tool better than separate solutions?
It depends on your needs. Some people prefer integrated platforms; for a reasoned comparison you can read our analysis of the alternatives to iubenda and judge what best fits your case.
In summary
Making a GDPR compliant website means covering eight areas in an orderly way: the notice, cookies, legal basis, the record, rights, security, processors and, where required, a DPO. None of them is insurmountable, but together they require method and periodic checks. The concrete first step is knowing exactly where the problems are today: a scanner like Appurai shows you for free and, if you want, guides you on how to fix them and generate the missing documents. From there, compliance becomes a matter of maintenance rather than anxiety.
This article is purely informational and does not replace professional legal advice. For specific situations, consult a lawyer or a qualified DPO.