Skip to content
Almost every business website collects personal data.
A contact form, a newsletter sign-up, a webshop checkout, Google Analytics and a Facebook pixel all handle information about real people.
In the EU, that means the GDPR and the cookie rules apply to you, even if you are a small business.
The good news is that the basics are manageable.
In this guide we go through what a small business website needs, in plain language and without legal jargon.
This article is general information, not legal advice.
For specific questions about your business, talk to a lawyer or your data protection authority.
Two sets of rules: GDPR and cookies
When people talk about privacy on websites, they usually mean two different sets of rules.
The GDPR is the EU’s general data protection regulation.
It covers all personal data, such as names, email addresses, phone numbers, IP addresses and order history.
It decides when you may collect data, what you must tell people, how you protect it and how long you may keep it.
The cookie rules come from the ePrivacy directive and each country’s own law.
They decide when you may store or read information on a visitor’s device, for example with cookies or tracking pixels.
In short, cookies that are not strictly necessary need the visitor’s consent before they are used.
What counts as personal data on your website?
- Names, email addresses and phone numbers from contact forms.
- Addresses and order details from your webshop.
- IP addresses in server logs, security plugins and analytics.
- Data collected by tracking tools such as Google Analytics, the Meta Pixel or LinkedIn Insight Tag.
- Messages in your chat widget, and recordings or notes from calls.
- Comments and reviews with names attached.
If you can link information to a real person, directly or indirectly, it is personal data.
The cookie banner: what it must do
A cookie banner is not just a box to click away.
To follow the rules, it should do the following.
- Block before consent.
Analytics, advertising and other non-essential cookies must not load until the visitor says yes. - Offer a real choice.
Rejecting should be as easy as accepting, ideally with a “Deny” or “Reject all” button on the first layer. - No pre-ticked boxes.
Consent must be an active choice. - Explain clearly.
Tell visitors which types of cookies you use and why, and link to your cookie policy. - Let people change their mind.
There should be an easy way to withdraw or change consent later, for example a small link or icon. - Keep a record.
A good consent tool stores proof of the choices visitors make.
Strictly necessary cookies, such as those that keep a shopping cart working or remember a login, do not need consent, but they should still be described in your cookie policy.
Choosing a consent tool
On WordPress, plugins such as Complianz, CookieYes, Cookiebot and Borlabs can scan your site, block scripts until consent and generate a cookie policy.
Shopify has its own privacy settings and apps for the same purpose.
Look for a tool that supports Google Consent Mode, so Google Analytics and Google Ads can respect the visitor’s choice and still give you useful, anonymous data.
Whatever you choose, test it yourself: open your site in a private window, click “Deny”, and check that tracking does not load.
The pages every business website needs
Privacy policy
Your privacy policy explains what personal data you collect, why, on what legal basis, who you share it with, how long you keep it and what rights people have.
It must be written in clear language and be easy to find, usually linked in the footer and next to every form.
Cookie policy
The cookie policy lists the cookies and similar technologies on your site, what they do, who sets them and how long they last.
Many consent tools can create and update it automatically.
Legal notice
Many countries require businesses to show basic company details online.
In Spain, for example, the LSSI requires a legal notice with company name, tax number, address, contact details and registration data.
Other EU countries have similar rules, so check what applies to your business.
Terms and conditions
If you sell online, your terms explain prices, delivery, payment, returns, the right of withdrawal and how complaints are handled.
Contact forms and newsletters
Forms are where most personal data enters your website.
- Only ask for the information you really need.
- Link to your privacy policy next to the form.
- Use a separate, unticked checkbox if you also want to send marketing emails.
- Make sure form submissions are sent and stored securely, and delete old enquiries you no longer need.
- For newsletters, use double opt-in and include an unsubscribe link in every email.
Your suppliers: data processing agreements
When another company handles personal data for you, it is a data processor.
Typical examples are your hosting company, email tool, CRM, analytics provider and payment provider.
You need a data processing agreement with each of them.
Most large providers include one in their terms or let you accept it in your account settings.
Prefer providers that store data in the EU, or that have proper safeguards when data is transferred outside the EU.
People’s rights
Under the GDPR, people can ask to see the data you hold about them, correct it, delete it, receive a copy, or object to certain uses.
You normally have one month to respond.
Make it easy by having one email address for privacy questions, and know where the data is stored, so you can find it when someone asks.
Security and data breaches
You must protect the personal data you hold.
For a website, that means HTTPS everywhere, updated software, strong passwords, two-factor login, limited user access and regular backups.
If personal data is lost, stolen or exposed, you may have to report it to your data protection authority within 72 hours, and in some cases also tell the people affected.
Write down a short plan now, so you know what to do if it ever happens.
Analytics, pixels and advertising
Tracking tools are where many small websites break the rules without knowing it.
Google Analytics, the Meta Pixel, TikTok Pixel, Hotjar and embedded videos can all set cookies or send data to third parties.
Load them only after consent, through your consent tool or Google Tag Manager with consent settings.
Remember that embedded YouTube videos and Google Maps can also set cookies, and there are privacy-friendly ways to embed them.
How long to keep data
Keep personal data only as long as you need it for the purpose you collected it for.
Invoices and accounting records must often be kept for several years by law.
Old contact form messages, abandoned leads and inactive newsletter subscribers can usually be deleted much sooner.
Set simple rules, write them down, and clean up once or twice a year.
Extra points for webshops
A webshop handles more personal data than a simple company website, so a few extra points apply.
Customer accounts should be optional where possible, and customers should be able to delete their account or ask you to do it.
Do not store card details on your own server, but let your payment provider handle them.
Reviews, abandoned cart emails and product recommendations are allowed, but they must follow the same consent and transparency rules as the rest of your marketing.
When you share order data with shipping companies, accounting tools or marketplaces, list them in your privacy policy and make sure you have agreements in place.
Finally, check who in your team has access to customer data in the webshop admin, and remove access for people who no longer need it.
A quick GDPR checklist for your website
- Is the whole site on HTTPS?
- Do non-essential cookies wait for consent, and is “Reject” as easy as “Accept”?
- Are the privacy policy, cookie policy and legal notice up to date and linked in the footer?
- Does every form link to the privacy policy, with a separate box for marketing?
- Do you have data processing agreements with your hosting, email, CRM and analytics providers?
- Are plugins, themes and WordPress updated, and are backups running?
- Do you know who to contact and what to do if there is a data breach?
Who is responsible?
As the website owner, your business is the data controller and carries the responsibility, even if an agency built the site.
That is why it pays to understand the basics yourself and to ask your web partner how consent, forms and tracking are set up.
Common mistakes
- A cookie banner that only has an “OK” button.
- Google Analytics and the Meta Pixel loading before the visitor has made a choice.
- A privacy policy copied from another website that does not match your tools.
- Newsletter boxes that are ticked by default.
- Admin accounts shared between several people with one password.
- Keeping every enquiry and customer record forever.
Need help getting your website compliant?
We set up consent tools, cookie banners, privacy pages and tracking that respects consent, on WordPress, WooCommerce and Shopify.
We do this for our own websites and for clients across Europe, in English, Spanish and Danish.
See our prices or contact us for a free check of your website.
