GDPR-Compliant Website Checklist: Cookies, Forms and Analytics
Any website that collects data from people in the EU must follow the GDPR, including sites run by US companies. A practical checklist for cookies, contact forms, analytics and third-party tools.
The General Data Protection Regulation (GDPR) applies to any organisation that processes personal data of people in the EU, no matter where the company is based. For a website, that usually means cookies, contact forms, newsletters, analytics and every third-party tool that touches visitor data.
01Cookies and consent
Non-essential cookies, such as analytics or advertising cookies, may only be set after the visitor gives consent. Strictly necessary cookies, for example for a shopping cart or security, do not need consent but should still be explained. A compliant consent banner makes rejecting as easy as accepting and lets visitors change their choice later. We build this into every website we develop.
- Non-essential cookies load only after consent
- "Reject" is as easy to find as "Accept"
- Visitors can change their choice at any time
- A cookie policy lists cookies, purposes and lifetimes
- Consent choices are recorded
02Forms and personal data
- Collect only what you need. Every extra field is extra data to protect.
- Explain why. Link to the privacy policy near the form.
- No pre-ticked boxes. Marketing consent must be an active choice.
- Secure transfer and storage. HTTPS everywhere, limited access to submissions.
- Retention. Decide how long requests are kept and delete them afterwards.
03Analytics and third-party tools
Analytics, chat widgets, embedded videos, maps and fonts loaded from external servers can all transfer visitor data. For each tool, check where data is processed, sign a data processing agreement and load it only with consent when required. If your site exchanges data with a CRM or business system, the same rules apply to those integrations.
04Documents every website needs
GDPR documents and what they cover
| Document | What it covers |
|---|---|
| Privacy policy | What data you collect, why, legal basis, retention, rights of users |
| Cookie policy | Which cookies are used, for what and for how long |
| Data processing agreements | Contracts with hosting, analytics, email and other providers |
| Record of processing | Internal overview of what personal data you process |
| Breach procedure | What to do if data leaks, including notifying the authority within 72 hours where required |
05Rights of your users
Visitors can ask to access, correct or delete their data, and to object to marketing. Make sure there is a clear contact for these requests and that your team knows how to find and remove data across the website, email and CRM.
06Online stores need extra attention
Stores process more personal data: delivery addresses, order histories, payment details and customer accounts. Payment providers usually handle card data, but order data stays with you. Privacy should be designed into online store development from the start, together with an accessible and clear UI/UX design for consent and account settings.
Privacy done well is invisible to the user and reassuring at the same time.
Want to check your website's GDPR setup? Contact us and we'll review cookies, forms and integrations. This article is general information, not legal advice.
