GDPR compliant website checklist

There is no GDPR badge.
There is a checklist.

A GDPR compliant website collects only what it needs, has a lawful reason for each use, asks before optional cookies, tells people what happens to their data, has contracts with the tools that handle it, keeps it safe and not too long, and answers people who ask. No plugin or banner does all of that for you. This is the checklist for EU and UK sites, with a checker that builds your own to-do from what your site runs.

Check my site Start free
EU and UK rules Checked 30 October 2026

By the Builderify team Not legal advice

01 / The short answer

How do I make my website
GDPR compliant?

By working through seven areas, for every tool on your site. GDPR sets the rules for personal data; a separate law, the ePrivacy Directive in the EU and PECR in the UK, sets the rules for cookies and marketing email. A website touches both, so the checklist covers both.

This is general information, not legal advice. It restates each rule in plain words and links the official text, checked on 30 October 2026. Choosing a lawful basis and deciding what is “necessary” are judgements about your own business; for anything that costs money if you get it wrong, ask a privacy lawyer.
  1. 01

    Cookies and consent

    Nothing optional runs before a yes, and no is as easy as yes.

  2. 02

    Privacy notice

    People are told what you collect, why, and who else gets it.

  3. 03

    Processors and DPAs

    Every tool that handles data for you is under contract.

  4. 04

    International transfers

    Data leaving the EU or UK has a legal route.

  5. 05

    Collect less, keep less

    You ask for less, and delete on a schedule.

  6. 06

    People’s rights

    You can find, hand over and erase one person’s data.

  7. 07

    Security, breaches and records

    HTTPS, tight logins, a breach plan and a written record.

02 / Site checker

Your GDPR website checklist,
built from what your site runs.

Tick what is on your site and choose where your visitors are. Each item says why in one line and links the rule it rests on. Tick items off as you go; nothing leaves this page.

Your site runs
Your visitors are in
Progress 0 of 29 done
GDPR can still reach a business outside the EU and UK when it offers goods or services to people there or monitors their behaviour (Article 3(2)). The list below shows the EU rules, the usual case.

Cookies and consent8

  • Storing or reading anything on a device needs consent first, unless it is strictly necessary for something the visitor asked for.

    ePrivacy Directive Art. 5(3) PECR reg. 6

  • Refusing has to be as easy as accepting. A Reject button one click deeper is the first thing regulators look for.

    EDPB cookie banner taskforce ICO, managing consent

  • A pre-ticked box, silence or carrying on scrolling is not consent.

    Court of Justice, Planet49 ICO, managing consent

  • A standard embed contacts the provider as the page loads and can set or read cookies before anyone has chosen.

    ePrivacy Directive Art. 5(3) PECR reg. 6

  • Since 5 February 2026 PECR exempts analytics used only to improve your own site. It never covers tracking people or ads.

    ICO, the exceptions PECR reg. 6

  • A consent request mixed into other terms must be clearly set apart from them. Exceptions for existing customers differ by country.

    GDPR Art. 7 UK GDPR Art. 7 Guide: Emailing without consent

  • A cookie settings link on every page, an unsubscribe link in every email. Withdrawing must be as easy as consenting.

    GDPR Art. 7 UK GDPR Art. 7

  • Where you rely on consent, you must be able to show it was given: when, to what wording, and how.

    GDPR Art. 7 UK GDPR Art. 7

Privacy notice4

  • Say who you are, why you collect each kind of data and on what lawful basis, who receives it, how long you keep it and what rights people have.

    GDPR Art. 13 ICO, right to be informed

  • Consent, contract and legitimate interests fit different jobs. Which one applies is a judgement, so record your reasoning.

    GDPR Art. 6 ICO, lawful basis

  • Recipients, or their categories, belong in the notice: your form tool, analytics, email platform, chat and embeds.

    GDPR Art. 13 UK GDPR Art. 13

  • People must be told when you collect, so a link under the button beats a footer link alone.

    GDPR Art. 13 ICO, right to be informed Guide: Contact page guide

Processors and DPAs2

  • Anyone processing data for you needs a written contract: your instructions only, security, sub-processors, help with requests, deletion at the end.

    GDPR Art. 28 ICO, processor contracts

  • They store your form entries, logs and backups, so they need the same contract as any other tool.

    GDPR Art. 28 ICO, processor contracts

International transfers3

Collect less, keep less3

  • Data must be adequate, relevant and limited to the purpose. Mark optional fields, and drop the ones nobody reads.

    GDPR Art. 5 UK GDPR Art. 5

  • Keep identifiable data no longer than its purpose needs, and give the period in your notice.

    GDPR Art. 5 UK GDPR Art. 5

  • Logs hold IP addresses, backups keep deleted data alive, and old enquiries sit in mailboxes. Each needs a period.

    GDPR Art. 5 UK GDPR Art. 5

People’s rights4

  • Access, correction, erasure, objection and portability requests get an answer within one month, free in most cases, extendable by two months when complex.

    GDPR Art. 12 EDPB, individuals’ rights UK GDPR Art. 12 ICO, subject access

  • One request reaches your forms, inbox, email list, chat and bookings alike, so know where each one lives.

    EDPB, individuals’ rights ICO, subject access

  • An objection to direct marketing is absolute. Keep the address on a suppression list so the stop holds.

    GDPR Art. 21 UK GDPR Art. 21

  • Since 19 June 2026 you must help people complain, for example with an online form, and acknowledge a complaint within 30 days.

    ICO, complaints law

Security, breaches and records5

  • Encryption is one of the measures the law names, and a form posted over plain HTTP can be read on the way.

    GDPR Art. 32 UK GDPR Art. 32

  • Remove people who have left, share no passwords, and keep plugins and themes updated.

    GDPR Art. 32 UK GDPR Art. 32

  • If a breach risks people’s rights, tell the regulator within 72 hours of finding it, and the people affected if the risk is high. Record every breach either way.

    GDPR Art. 33 EDPB, data breaches UK GDPR Art. 33 ICO, report a breach

  • Under 250 staff you may skip only occasional activities. A form that collects every day is regular.

    GDPR Art. 30 EDPB, records UK GDPR Art. 30 ICO, who must document

  • Organisations that process personal data pay a yearly fee unless an exemption applies. The ICO has a short self-assessment.

    ICO, data protection fee

General information, not legal advice. It applies the rules in this guide to your answers and nothing more. Rules checked 30 October 2026.

03 / What it collects

Start with what your website
actually collects.

Every later step depends on this list, so make it first. Open your site, note every form, script and embed, and check your site builder’s apps or plugins. An IP address and a cookie ID count as personal data when they can single someone out.

On your site What it collects Who else handles it Stores on the device?
Contact form Name, email, message; the IP often lands in logs Your form tool or site builder, your mailbox Usually not
Newsletter signup Email, maybe a name, and the consent itself Your email platform Usually not
Analytics Pages, referrer, device, a visitor ID The analytics provider Usually a cookie or ID
Ad pixels Visits and conversions, matched to ad accounts The ad platform Yes
Live chat or chatbot Messages, sometimes an email; for a bot, what is sent to the AI model The chat provider, and an AI model provider for a bot Often, to keep the thread
Booking Name, email, time, answers to your questions The booking tool, your calendar Usually not
YouTube, Maps IP and device details as the embed loads The embed provider Can, on page load
Comments Name, email, comment, IP Your CMS or comment system Sometimes
Online shop Name, address, order, payment Shop platform, payment provider, courier Yes, for the basket
User accounts Login, profile, activity Your site builder or membership tool Yes, to stay signed in
Server logs IP address, browser, pages, times Your host No

Not sure which cookies your site sets? Your browser’s developer tools list them under Application or Storage, and the cookie banner guide sorts them into the ones that need a yes and the ones that don’t.

04 / Lawful basis

Which lawful basis for which part
of your website?

GDPR lists six lawful bases, and each purpose needs one before you start. Three cover most small websites: consent, contract and legitimate interests. Consent is not the default; it is the right fit only where people have a real choice.

Replying to a contact form

Legitimate interests

They asked you to reply. If they want a quote, it is a step towards a contract.

Taking an order or a booking

Contract

You need the details to deliver what they asked for.

Keeping invoices

Legal obligation

Tax rules say what to keep and for how long.

A newsletter or offers by email

Consent

Existing-customer exceptions exist in some countries. Check before relying on one.

Analytics with a cookie or ID

Consent

The cookie rule asks for a yes first. In the UK plain statistics may run on an exception, and you still need a UK GDPR basis for the data.

Ad and conversion pixels

Consent

Advertising is never exempt from the cookie rule.

Security and fraud logs

Legitimate interests

Keeping the site safe. Keep the logs short-lived.

The honest caveat

These are the usual fits, not rulings. The right basis depends on what you do with the data and what people would expect. For legitimate interests, the ICO suggests a three-part test: is there a real purpose, is the processing necessary for it, and do the person’s interests outweigh it? Write your answers down. Whatever you choose goes in your privacy notice (GDPR Articles 6 and 13). For marketing email, the guide to emailing customers without consent covers the existing-customer exceptions country by country.

05 / Cookies

Cookie consent rules
for a GDPR website.

Cookies are the part people notice, and the part regulators test first. The duty to ask comes from the ePrivacy Directive in the EU and PECR in the UK; when you rely on a yes, GDPR sets what counts as a valid one.

Where the UK differs

Since 5 February 2026, PECR lets analytics used only to improve your own site run without a yes, if you explain it clearly and offer a simple, free way to object. The ICO says it never covers advertising, or tracking and profiling people. The EU has no such exception.

  1. 01

    Ask before anything optional runs

    Analytics that store an ID, ad pixels, recordings and embeds that set cookies wait for a yes. Logins, baskets, security and the cookie that remembers the choice don’t.

    ePrivacy Directive Art. 5(3) PECR reg. 6

  2. 02

    Make no as easy as yes

    Reject on the same screen as Accept, with the same weight. A “manage options” maze is not an equal choice.

    EDPB cookie banner taskforce ICO, managing consent

  3. 03

    No pre-ticked boxes, no “by continuing”

    Silence, scrolling and pre-ticked boxes are not consent. Every optional category starts off.

    Court of Justice, Planet49 ICO, managing consent

  4. 04

    Let people change their mind

    A cookie settings link on every page, and withdrawing a category stops what it allowed.

    GDPR Art. 7 ICO, managing consent

  5. 05

    Keep proof of each answer

    What was chosen, when, and which version of your banner they saw.

    GDPR Art. 7 UK GDPR Art. 7

Which cookies need a yes?

The cookie banner guide sorts them by place, with a six-question checker.

Do I need a cookie banner?

How do I add the banner?

Platform by platform, and what each built-in banner blocks.

Add a cookie banner

Running Google or Meta tags?

Consent Mode v2 passes the answer to Google; the Meta Pixel needs holding back.

Consent Mode v2

More on the details: holding the Meta Pixel until consent, whether Google Analytics is legal in the EU, counting visitors who say no, and for US visitors, Global Privacy Control. An EU proposal to change the cookie rules, the digital omnibus, is still being negotiated; until it becomes law, the rules above apply.

06 / Notice & forms

What your privacy notice
has to tell people.

When you collect data from someone, Article 13 says what they must be told, in plain language and at that moment. In short:

  • Who you are and how to contact you
  • What you collect, for which purposes, and the lawful basis for each
  • The legitimate interests, where you rely on them
  • Who receives the data: the tools you use, by name or by kind
  • Whether data leaves the EU or UK, and on what safeguard
  • How long you keep each kind of data
  • People’s rights, including to withdraw consent and to complain to the regulator
  • Whether giving the data is required, and what happens if they don’t

How to word each section of the policy is a subject of its own. The test here is simpler: every tool from chapter 03 should appear in it.

Collect less: one enquiry form, trimmed

Ask about wholesale
  • Name
    Keep · To reply to you
  • Email
    Keep · To reply to you
  • Message
    Keep · What you are asking
  • Phone (optional)
    Keep · Only if they prefer a call
  • Date of birth
    Drop · Not needed to answer
  • Home address
    Drop · Not needed until an order
  • Company size
    Drop · Nice to know is not need to know
Send

We use your details only to answer this message and keep them for 12 months. Privacy notice

Data must be “adequate, relevant and limited to what is necessary” (Article 5(1)(c)), so each field needs a job. The one-line note under the button tells people what happens at the moment they decide; the period in it is an example, so use your own. The contact page guide shows where that note sits on a real page.

07 / Processors

Every tool on your site
needs a contract and a route.

A tool that handles visitor data on your behalf is a processor: your host, form tool, email platform, chat and booking tools. Each needs a data processing agreement, usually a DPA in the vendor’s terms that you accept or download. And if the data leaves the EU or UK, it needs a legal route.

What a DPA has to say · Article 28(3)
Instructions
They use the data only as you instruct.
Confidentiality
Their staff are bound to keep it confidential.
Security
They protect it to the standard of Article 32.
Sub-processors
Only with your authorisation, on the same terms.
Help with requests
They help you answer rights requests and breaches.
The end
They delete or return the data when the service ends.
Audits
They give you what you need to check all of this.

Ad platforms and some embed providers also use the data for their own purposes, so their terms often treat them as separate or joint controllers rather than processors. Read which role each one claims.

Sending data to the US30 October 2026

  • From the EU: Data Privacy Framework

    In force

    Adopted by the European Commission on 10 July 2023 for US companies that certify to it. The EU General Court upheld it on 3 September 2025.

  • The appeal, C-703/25 P

    Pending

    Before the Court of Justice, with no judgment we could find. In July 2026 the EDPB asked the Commission to assess a US Supreme Court ruling on the FTC’s independence, as the IAPP reported. Know your fallback: standard contractual clauses.

  • From the UK: the data bridge

    In force

    Since 12 October 2023, for US companies certified to the UK Extension. Otherwise use the IDTA or the UK Addendum.

To check a vendor, search the Data Privacy Framework list for its US company name. The Google Analytics guide tracks the court cases in more detail.

08 / Keep, answer, protect

Retention, requests and breaches:
the GDPR checklist after launch.

A site can launch with the right banner and notice and still drift out of line a year later: old enquiries pile up, a request goes unanswered, a former freelancer keeps their login. These four habits keep it in line.

01

Keep it only as long as needed

Pick a period for each kind of record, such as enquiries, subscribers, chat transcripts and bookings, and delete on schedule. Don’t forget server logs, backups and your mailbox. GDPR sets no number; the purpose does.

GDPR Art. 5(1)(e)

02

Answer requests within a month

People can ask for a copy of their data, a correction, erasure, or for you to stop. You have one month, two more for complex cases, and it is usually free. You may ask for ID if you are genuinely unsure who is asking. In the UK, searches need only be reasonable and proportionate.

EDPB ICO

03

Report a breach within 72 hours

A lost laptop, a hacked form inbox or an email to the wrong list can be a breach. If it risks people’s rights, tell your regulator within 72 hours of becoming aware, and tell the people affected if the risk is high. Log every breach, even the ones you don’t report.

GDPR Art. 33 EDPB ICO

04

Write down what you do

A record of processing lists purposes, data, recipients, transfers, retention and security. Under 250 staff you may leave out only occasional activities, and both the EDPB and the ICO treat day-to-day processing like a website form as regular.

EDPB ICO

Security basics

Article 32 asks for security “appropriate to the risk” and names encryption among the measures. For a small site that means HTTPS on every page, one login per person with two-step sign-in, removing people who leave, updated plugins and themes, and letting your payment provider handle card details. An EU proposal would move breach reporting to 96 hours; as of 30 October 2026 it is a proposal, so 72 hours stands.

09 / EU vs UK

UK GDPR compliance checklist:
where it differs from the EU.

The UK kept the GDPR after Brexit, then changed it with the Data (Use and Access) Act 2025. The ICO says all its data protection provisions were in force by 19 June 2026.

Topic EU UK
The laws GDPR, plus each country’s ePrivacy rules for cookies and email UK GDPR and the Data Protection Act 2018, plus PECR, all amended by the Data (Use and Access) Act 2025
Analytics cookies A yes first Since 5 February 2026, statistics used only to improve your site may run if you tell people and let them object
Advertising cookies A yes first A yes first. No exception covers advertising
Rights requests One month, extendable by two The same, and since February 2026 searches need only be reasonable and proportionate
Complaints People complain to a national authority Since 19 June 2026 you must also run your own complaints process and acknowledge within 30 days
Breaches 72 hours, to your authority 72 hours, to the ICO
Paying the regulator No EU-wide fee The ICO data protection fee, unless exempt
Sending data to the US Data Privacy Framework, or safeguards The UK Extension (the data bridge), or the IDTA or Addendum
Cookie and email fines Set by each country’s ePrivacy law Since 5 February 2026 up to £17.5 million or 4% of global turnover

UK sources: ICO on the cookie exceptions, the ICO’s commencement statement (fines), complaints, the fee and GOV.UK on the data bridge. Since 30 September 2026 the regulator is formally the Information Commission, and it still goes by ICO. Whether GDPR reaches a business based outside Europe at all is its own question; the short version is in the checker’s “Elsewhere” note.

10 / In Builderify

Where Builderify helps
with the checklist.

Builderify covers several items on the list with settings rather than code. It doesn’t make a site compliant, and it doesn’t claim to: what you collect, the basis you choose and what your notice says stay your decisions.

Cookies and consent

Cookie Consent

Holds your tags until a visitor says yes, with Reject all beside Accept all, and logs every decision with its consent ID, choices and banner version, kept 24 months with the IP truncated. “Ask where the law requires it” asks first in consent-first regions such as the EU and UK. Google tags get all seven Consent Mode v2 signals, set before they run and updated when the visitor decides.

Cookie Consent
Cookies and consent

User Journey

“Wait for cookie consent” records only visitors who allowed analytics; if they change their mind, their ID is erased from the browser and what was recorded is deleted. Visitors who said no can still be counted without a cookie, under a key that changes every day.

User Journey
Consent and rights

Leads

Records where each contact came from and keeps a consent record for every signup: method, the wording shown, source, page, IP, browser and time. Every campaign carries one-click unsubscribe, and unsubscribed contacts are skipped on later sends.

Leads
Collect less, keep less

AI Chatbot

Masks anything that looks like a card number before a message is stored or sent to the AI model. Transcripts are deleted 180 days after the last message unless you pick another period, from 7 to 730 days, and visitor IPs are cut to their network after 30 days.

AI Chatbot
Collect less, keep less

Inbox

Keeps mail until you set a period: 90 days, 1 year or 2 years. Pick one, and old enquiries stop piling up.

Inbox
People’s rights

Privacy center

In your organisation settings, admins search one email address or visitor ID across every website, export what Builderify holds as JSON or erase it. An erased address stays on the do-not-email list, every export and erasure goes into the activity feed, and the same page sets how long each kind of widget submission is kept, from 30 days to 2 years.

Builderify goes on your list too

It handles your visitors’ data for you, so name it in your notice and your records like any other tool. Its privacy policy says data is stored on its own servers, which may be in Romania or other places where it operates. Ask support@builderify.com for its processing terms before you rely on it, as you would with any vendor.

Free to start

Every account gets 250 free credits a month, with no monthly fee; one-time packs cover anything beyond. See pricing, or the cookie consent banner on its own.

Start free
Questions

GDPR for your website, before you ask.

Not on its own. A banner covers the cookie part, and only if optional tags really wait for a yes and Reject is as easy as Accept. A GDPR compliant website also needs a privacy notice, a lawful basis for each purpose, contracts with the tools that handle data, sensible retention, a way to answer requests and a breach plan. This is general information, not legal advice.

Seven areas: cookies and consent, a privacy notice, processing agreements with every tool, a legal route for data leaving the EU or UK, collecting less and deleting on schedule, answering people's requests within a month, and security with a 72-hour breach plan and a short record of processing. The site checker on this page turns those into a to-do list for what your site runs.

Mostly in the details since the Data (Use and Access) Act 2025. Since 5 February 2026 UK sites may run statistics cookies used only to improve the site without consent, if they explain them and let people object; advertising cookies still need a yes. Since 19 June 2026 UK organisations must also run a complaints process and acknowledge complaints within 30 days. US transfers use the UK Extension of the Data Privacy Framework.

With every tool that processes personal data on your behalf, yes: GDPR Article 28 requires a written contract with each processor, including your host, form tool, email platform, chat and booking tools. Most vendors include a data processing agreement in their terms or offer one to download. Ad platforms often treat themselves as separate controllers, so check which role each one claims.

No, and it does not claim to. Cookie Consent holds tags until a visitor agrees and keeps proof of each decision, User Journey can wait for consent or count without cookies, Leads keeps a consent record for each signup and supports one-click unsubscribe, and the privacy center finds, exports or erases one person's data. What you collect, the basis you choose and your privacy notice remain your decisions. This is general information, not legal advice.

Sources

Each opened on 30 October 2026.

This is general information, not legal advice. ← All guides

Stop losing the visitors
you already paid for.

More leads from the traffic you already have, and follow-up that sends itself. Free to start. No card, no monthly fee.

Start free See what it does