How to Make Your Business Website GDPR Compliant

Two conditions in Article 3(2) put a business outside the EU in scope: you offer goods or services to people in the EU or EEA, or you monitor their behavior. Nothing about your company address decides it.

Recital 23 spells out the signals a regulator reads as targeting. Prices in euros. A language you do not speak at home. Shipping options to European addresses. European phone formats in your contact block. Testimonials from customers in Madrid or Milan. Paid campaigns with European geography in the targeting. Any two of those together and the argument that you never meant to serve Europe stops working.

Behavior monitoring catches sites that never sell anything abroad. If you run retargeting pixels, session replay or profiling that follows a European visitor across pages and back again, that is monitoring, and it counts on its own.

What does not put you in scope is accessibility. A site that loads in Lisbon because the internet has no borders is not targeting Lisbon. This matters because the honest answer for a lot of small businesses is that GDPR does not apply yet, and the useful move is to decide deliberately rather than bolt a banner on out of nervousness. If you are building the store that will change the answer, our guide to building an ecommerce store is the point where currency, shipping zones and email flows get set, and those three settings are what pull you into scope.

One more thing worth knowing early: the UK left the EU but kept the regulation as UK GDPR, with the Information Commissioner as regulator. Selling into both means two supervisory authorities reading the same notice.

You cannot write an accurate notice until you know every doorway. Sit down with the site and list them: the contact form, the newsletter box, the checkout, account registration, the support inbox, the live chat transcript, the review widget, the analytics identifiers, the ad pixels, the embedded video player that sets its own cookie, and the web server logs holding IP addresses. Almost every one of those is a separate purpose with its own basis and its own retention period.

Then walk out of the browser, because paper collects data too and it is the part audits usually find missing. A sign up sheet at a trade show, an intake form on a clipboard, the bowl of business cards by the till, a written competition entry, a delivery signature sheet. Each is personal data collected by you, and Article 13 says the notice has to be given at the moment of collection, not emailed a week later.

Handle it the way you would handle it online. Print the short form notice directly on the form: who you are, what you will use the details for, how long you keep them, and a short link or QR to the full notice. Custom printed notepads from $93.37 work well as tear off intake pads because the notice is on every sheet, and a printed pad cannot quietly drift out of sync with your policy the way a hand written sheet does. If you want the link scanned rather than typed, our guide to QR codes for small business covers pointing a code at a page you control instead of a third party redirect that logs the scan.

The business card bowl deserves its own decision. A card handed to you at an event is data you now hold, and dropping it into your CRM is processing. Decide in advance whether those cards become a legitimate interests business to business list with an opt out in the first message, or whether they stay in the bowl. Your own business cards from $17.57 are the other half of that exchange, and printing your privacy page address on the back costs nothing and settles the question of where the person can go to see what you did with theirs.

Articles 13 and 14 set what the notice must contain, and the list is longer than most published policies. Include all of it:

• Who the controller is, with a real contact route, plus the DPO or EU representative if you have one.
• Every purpose you process for, each paired with its lawful basis, and the legitimate interest named where you rely on it.
• Recipients and categories of recipient. Your email platform, your CRM, your host and your payment processor are recipients.
• Transfers outside the EEA, with the safeguard you rely on: an adequacy decision, standard contractual clauses, or the EU to US Data Privacy Framework.
• Retention periods, stated as a period or as the criteria you use. "As long as necessary" on its own is not an answer.
• The rights: access, rectification, erasure, restriction, portability, objection, and no solely automated decisions with legal effect.
• The right to withdraw consent at any time, and the right to complain to a supervisory authority.
• Whether providing the data is a statutory or contractual requirement, and what happens if it is not provided.

Then the clocks. A rights request gets an answer within one month of receipt, free of charge, extendable by a further two months only where the request is genuinely complex and you tell the person why inside the first month. Verify identity proportionately: enough to be sure, not so much that you collect more data than the request itself. Requests arrive anywhere, so brief whoever reads the support inbox that a sentence like "send me everything you have on me" starts the clock even without the words data subject access request.

Where the exchange gets formal, and it does when a request turns into a complaint or a legal claim, a written response on printed letterheads from $99.95 is worth the paper. Post gives you a dated record, it survives a spam filter, and it avoids attaching a file full of someone's personal data to an email that may sit unencrypted in two mailboxes.

The second clock is shorter. Article 33 gives you 72 hours from becoming aware of a personal data breach to notify the supervisory authority, unless the breach is unlikely to result in a risk to people. If the risk is high, Article 34 says you tell the affected people too, without undue delay. Seventy two hours is not long enough to work out who to call, so write the contact list before you need it. Breach here means more than a hacker: a laptop left on a train, an export mailed to the wrong client, or a bulk email sent with every address in the To field.

Work through these in order. Steps one to three are the ones that make the rest possible, and they are also the ones teams skip because they produce no visible change on the site.

1. Decide whether you are in scope and write down why, using the targeting signals from Recital 23. Date the note.
2. Build the data map. Every doorway, online and on paper, with the purpose, the lawful basis, the retention period and the systems the data lands in.
3. Write the Article 30 record. The exemption for organisations under 250 people is narrower than it reads, and the record is the document a regulator asks for first.
4. Fix the tag firing order so nothing non essential runs before consent, then prove it in the network tab of a clean private window.
5. Rewrite the notice against the Article 13 list above, replacing every generated placeholder with what your systems actually do.
6. Get Article 28 terms in place with every processor: host, email platform, CRM, analytics, payment processor, backup provider.
7. Check your transfers. Know which vendors move data outside the EEA and which safeguard covers each one.
8. Write the rights request procedure, including who owns it, how identity gets verified, and where the one month clock is tracked.
9. Write the breach plan with names and phone numbers, because 72 hours starts the moment somebody realises, not the moment the meeting is scheduled.
10. Set a review date. Every new tool, form or campaign adds a doorway, and the map goes stale within a quarter.

What it costs to skip: Article 83 sets two tiers, up to €10 million or 2% of worldwide annual turnover for administrative failures such as missing records and inadequate processor contracts, and up to €20 million or 4% for breaches of the principles, the lawful basis rules, consent, transfers or data subject rights, whichever figure is higher in each case. Small businesses rarely see the headline numbers. What they see is an order to stop processing, which can mean switching off the marketing database in the middle of a campaign. More compliance context for business owners sits in the rules and regulations guides, and how we handle data on our own site is set out in the 4OVER4.COM privacy policy. Slot the checklist into your annual planning alongside the rest of your small business marketing plan.

This guide explains the regulation without the legalese. It is not legal advice, and a lawyer in your jurisdiction should review anything with real money or sensitive data behind it.