GDPR Compliance Guide
for small businesses & websites

What is GDPR and does it apply to you?

GDPR (General Data Protection Regulation) is a European Union privacy law that came into force in May 2018. It gives EU residents strong rights over their personal data and requires organizations that collect or process that data to be transparent about it.

In simple terms: if your website has any visitors from the EU and you collect any data (even just IP addresses via analytics), GDPR applies. This covers the vast majority of websites on the internet.

What counts as "personal data" under GDPR?

Personal data is any information that can identify a person, directly or indirectly. This includes:

• Name, email address, phone number
• IP addresses (yes, even these)
• Cookie identifiers and device IDs
• Location data
• Payment information
• Behavioral data from analytics tools

GDPR compliance checklist for small businesses

The minimum you need to do to be GDPR compliant as a small website or business.

• ✓
  Privacy Policy — A clear, accessible Privacy Policy that explains what data you collect, why, who you share it with, and how users can exercise their rights. This is non-negotiable under GDPR.
• ✓
  Cookie consent — If you use non-essential cookies (analytics, advertising, social media), you need a cookie consent banner that lets users accept or reject them before they're placed.
• ✓
  Lawful basis for processing — For each type of data you collect, you need a legal basis: consent, contract, legal obligation, or legitimate interest. Your Privacy Policy should state this.
• ✓
  Data subject rights — You must be able to respond to requests from EU residents to access, correct, or delete their personal data. Include a contact email in your Privacy Policy for this purpose.
• ✓
  Data processor agreements — If you use third-party services (Google Analytics, Mailchimp, Stripe), ensure they have their own GDPR compliance. Most major platforms already do.
• ✓
  Data breach notification — If a data breach occurs, you must notify your supervisory authority within 72 hours and affected users without undue delay.
• ✓
  Secure data storage — Store personal data securely with appropriate technical measures (HTTPS, encrypted databases, access controls).
• ✓
  Don't keep data longer than needed — Define and stick to data retention periods. Don't keep customer data indefinitely "just in case."

What small websites DON'T need for GDPR

A lot of GDPR advice is written for large corporations. Here's what most small sites can skip.

❌ You probably don't need a Data Protection Officer (DPO)

DPOs are required for large-scale data processors, public authorities, and organizations processing sensitive data at scale. A small business website, blog, or online store almost certainly doesn't need one.

❌ You probably don't need a formal Data Protection Impact Assessment (DPIA)

DPIAs are required for high-risk processing activities — large-scale profiling, systematic monitoring, processing sensitive categories of data. Standard website analytics and email marketing don't require one.

❌ You don't need to register with a supervisory authority

Most EU countries abolished the requirement for most businesses to register with their national data protection authority. The UK still has some requirements through the ICO, but small businesses are often exempt.

❌ You don't need explicit consent for everything

Consent is just one of six lawful bases for processing under GDPR. Processing necessary for a contract (like processing an order), legitimate interests (like fraud prevention), or legal obligations are all valid without additional consent.

Start with a GDPR-compliant Privacy Policy

The most foundational GDPR requirement is a clear, honest Privacy Policy. It's what GDPR enforcement authorities look for first, and it's what gives users the transparency the regulation demands.

Your Privacy Policy must cover — in plain language — what data you collect, your legal basis for collecting it, who you share it with, how long you keep it, and how users can exercise their rights.

After your Privacy Policy — cookie consent

If your site uses Google Analytics, Facebook Pixel, or any advertising cookies, you need a cookie consent banner. Free tools like CookieYes or Cookiebot (both have free plans) handle this for you — just paste a script tag into your site.

Google Analytics and GDPR

Google Analytics 4 (GA4) has improved GDPR compliance compared to Universal Analytics, but you still need to: disclose its use in your Privacy Policy, obtain cookie consent before loading it, and enable IP anonymization (it's on by default in GA4).

GDPR — Common Questions

More free tools and guides