A GDPR checklist for small business websites.

The short answer

The GDPR applies to businesses in the EU that handle personal data, and to businesses elsewhere that offer goods or services to people in the EU or track their behaviour. A small business website handles personal data the moment someone sends a form, books a slot, writes in a chat window or is counted by analytics. The UK has its own version, the UK GDPR, built the same way.

Most of the work happens off the page. Work through it in this order:

• List what each part of the site collects and where it goes.
• List the outside companies that handle it for you, your processors, and check each one has a data processing agreement.
• Write down why you collect each item: your lawful basis.
• Cut the form fields you do not need, and drop the consent checkbox where it does not belong.
• Set how long you keep each kind of record, and make sure deletion happens.
• Decide who answers access and deletion requests, and how.
• Secure the accounts, and know what to do after a breach.
• Then write or update the privacy notice from what you found.

If you handle health data, children's data or large volumes of personal data, talk to a data protection adviser as well. Nothing here replaces advice on your own case.

List what the site collects and where it goes

Go through your site as a visitor would and write one line for every place personal data comes in. For a three-chair barbershop with online booking, the list might read:

• The contact form collects a name, email, phone number and message, and the form tool sends them to the shop's inbox.
• Online booking collects a name, phone, email, service and time, stored in the booking software, which sends confirmations and reminders.
• The chat window keeps the messages and any contact details typed in, stored by the chat provider.
• The newsletter sign-up collects an email address, stored in the email marketing tool.
• Analytics records pages viewed, the device and an approximate location, sent to the analytics provider.
• The embedded map and video send the visitor's IP address and browser details to Google or YouTube as they load.
• The host's server logs keep IP addresses and the pages requested.

For each line, add three things: who on your team can see it, which company holds it and in which country, and how long it stays there. This table is the base of everything that follows.

It is also close to the record of processing that Article 30 of the GDPR asks for. Organisations with fewer than 250 employees are exempt only for processing that is occasional, unlikely to put people at risk and free of special categories such as health data. The European data protection authorities gave the example of a small organisation's staff records: processed regularly, so not occasional, so they belong in the record. The same logic applies to bookings and enquiries that arrive every week, so most small businesses need a record, and the table is most of it.

List your processors, and check the contracts

A processor is an outside company that handles personal data on your behalf: the form tool, the email provider, the host, the booking software, the chat provider, the analytics tool and the newsletter tool. Under Article 28 you may only use processors that give enough assurance that they will protect the data properly, and there must be a contract, usually called a data processing agreement or DPA, that sets out what they may do with the data.

For a small business the DPA is rarely a negotiation. Many established tools publish one that you accept with their terms or switch on in the account settings. Your job is to find it, check it covers the service you use and keep a copy or a link with the date. For each processor, check:

• There is a DPA, and you know where it is.
• Where the data is stored, and whether it leaves the EU or the UK.
• If it goes to the US, whether the company is certified under the EU-US Data Privacy Framework, or which other safeguard the DPA relies on, such as standard contractual clauses.
• Which other companies it uses to process your data, its sub-processors, and how it tells you about changes.
• How you delete the data when you stop using the service.

Add your web designer or agency if they host the site or can read form submissions. An AI chatbot provider belongs on the list too: ask where conversations are stored, for how long and who can read them.

GGSites, for example, keeps the enquiries and chat conversations from its own site on a server in Germany, and names the other services that receive them, such as Telegram for new-enquiry alerts.

Write down why you collect each item

Every line in your table needs a lawful basis from Article 6. On a small business website, three cover almost everything:

• Replying to an enquiry, sending a quote or taking a booking the person asked for are steps before a contract, under Article 6(1)(b).
• Keeping server logs to protect the site, or following up a quote the person requested, can rest on legitimate interests, under Article 6(1)(f), where your interest is not outweighed by theirs.
• Send a newsletter or marketing messages, or set analytics or advertising cookies where the cookie rules require it, only with consent, under Article 6(1)(a).

Write the basis next to each line. It goes into your privacy notice, and it tells you what to do when someone objects or withdraws consent.

Special categories need more. Health details, such as symptoms typed into a dental clinic's contact form, are special category data under Article 9 and need an extra condition. The simplest answer is to keep them out of general forms and chats: ask for what you need to arrange the appointment, and collect health details through the system built for them.

The consent checkbox on contact forms

Many contact forms carry a required box that says "I consent to the processing of my personal data". It is usually unnecessary, and it can do harm.

When someone sends an enquiry and you reply, the lawful basis is taking steps at their request before a contract, not consent. The European Data Protection Board's guidelines on consent say that where processing is necessary for a contract, consent is not the appropriate basis. A required box also fails the test for consent, which has to be freely given: if the form cannot be sent without the tick, the visitor has no real choice.

What the form does need is information at the moment you collect the data, under Article 13. A line under the button is enough: "We use your details to reply to this enquiry. See our privacy notice."

Use a checkbox only for something optional and separate, such as joining your newsletter, and leave it unticked. Pre-ticked boxes are not valid consent: the EDPB guidelines say so, and so did the Court of Justice of the EU in the Planet49 case in 2019. Keep a record of who ticked the box, when, and what the form said at the time, because you must be able to show the consent was given.

Ask only for what the form needs

Data minimisation is one of the GDPR's principles, in Article 5: collect only what you need for the purpose. Every extra field is one more thing to protect, delete and explain. Go through each form and ask of every field what you do with the answer, and what happens if it is missing:

• A cleaning company's quote form needs the postcode and the size of the home, not a date of birth.
• A booking form needs a name and one way to reach the person, not a home address, unless you visit them.
• A recruitment agency's form needs a CV, not a photo or marital status.
• A general contact form needs no health, financial or identity details at all.

Make optional fields clearly optional, say what they are for, and remove the ones nobody on your team uses.

Set how long you keep each record

The GDPR gives no number. Article 5 says personal data must be kept no longer than the purpose needs, and your privacy notice must say how long you keep it, or how you decide. Pick a period for each line in your table and write down why:

• Keep enquiries that did not become customers long enough to follow up and deal with any reply, then delete them.
• Keep customer records as long as the relationship lasts, plus any period your tax or professional rules require.
• Keep chat conversations long enough to read them, correct the answers and follow up.
• Keep server logs for weeks rather than years, unless you are investigating a problem.
• Choose the shortest analytics retention setting that still answers your questions.

GGSites deletes the enquiry records from its own site after 180 days, chat conversations after 90 days and technical logs within 30 days, and says so in its privacy notice. Your periods can differ. What matters is that each has a reason, and that the deletion really happens.

Deletion is the step people skip. Turn on automatic deletion where your form tool, inbox, chat tool or booking software offers it, and put a calendar reminder in for the places that do not. An automation can also delete or anonymise old records on a schedule.

Be ready for access and deletion requests

People can ask what you hold about them, ask you to correct or delete it, object to marketing and ask for a copy. Under Article 12 you must reply without undue delay and within one month. You can extend that by two more months for complex or numerous requests, if you tell the person within the first month. In most cases you cannot charge.

A request needs no special wording or form. It can arrive by email, through your contact form or in a chat. Prepare before the first one arrives:

• Name the person who handles requests, and a backup.
• Use your table to know where to search: the inbox, the booking software, the chat tool, the newsletter tool, spreadsheets and backups.
• If you have reasonable doubts about who is asking, ask for enough to confirm it, and no more.
• For deletion, remove the data from each tool, and note what you must keep, such as invoices, and why.
• Keep a short log: the date the request arrived, what you did and the date you replied.

A request typed into a chat window is still a request. A customer service chatbot should pass it to the person you named rather than try to handle it.

Secure the accounts, and plan for a breach

Article 32 asks for security that fits the risk. For a small business website, most of it is about the accounts around the site:

• Two-step sign-in on the website, hosting, domain, email and every tool in your table.
• One login per person, removed on the day they leave.
• Form submissions and chat logs readable only by the people who need them.
• HTTPS on every page, and updates applied to the site and its plugins.
• Backups, and a test that you can actually restore one.

A personal data breach must be reported to your data protection authority without undue delay and, where feasible, within 72 hours of becoming aware of it, unless it is unlikely to put people at risk. Your processors must tell you without undue delay. Write down now who decides and how to reach the authority.

Record every breach, including the ones you do not report: what happened, what data was involved and what you did about it. A customer list attached to an email sent to the wrong person counts.

Cookies, embeds and tracking

Cookies fall under a separate law, the ePrivacy Directive, as each EU country applies it. Storing or reading information on a visitor's device needs consent unless it is strictly necessary for something the visitor asked for, such as a basket or a login. Analytics and advertising cookies generally need consent.

Look for tracking you did not choose. An embedded YouTube video, a Google map, a chat widget, a booking widget, social media buttons and fonts loaded from another company's servers can all send visitor data to third parties as the page loads. Load them only after consent, or replace them, for example with a link to the map or an image that loads the video when tapped.

Analytics has a guide of its own: Google Analytics and the GDPR.

Write the privacy notice last

Once the table, the processors, the bases and the periods are written down, the privacy notice is mostly a plain-language version of them. Writing it first, from a template, is how notices end up listing tools a business never used and missing the ones it does use.

Our guide to what a privacy policy needs goes through the contents line by line.

Then keep the table current. Add a line whenever you add a tool, such as a new booking system, a chatbot or an advertising pixel, and read the whole table once a year.

If your business is outside the EU

A US business that offers goods or services to people in the EU, or tracks their behaviour, falls under the GDPR for that data. That brings one extra item. Under Article 27 it may need to appoint a representative in the EU, unless its processing is occasional, unlikely to put people at risk and does not involve special categories on a large scale. Ask an adviser whether that applies to you.

Most small businesses do not need a data protection officer. Article 37 requires one where the core activities involve regular and systematic monitoring of people on a large scale, or large-scale processing of special categories such as health data, and for public bodies.