GDPR and Your Website: The Basics for Small Businesses

The General Data Protection Regulation (GDPR) is the European Union's data protection law. The UK has its own version, often called UK GDPR, which is very similar. If your website deals with people in those places, these rules may apply to you, wherever your business is based. This is a general overview, not legal advice. For decisions that matter, consult a qualified adviser.

When does it apply?

Broadly, the rules can apply if you:

• Are established in the EU or UK and process personal data, or
• Offer goods or services to people in the EU or UK, or
• Monitor the behavior of people there, for example with tracking tools

Personal data is any information relating to an identifiable person: names, email addresses, IP addresses, online identifiers, and more.

Key principles

• Lawfulness, fairness, and transparency. Have a valid reason to use data, and tell people what you do
• Purpose limitation. Use data only for the purposes you stated
• Data minimization. Collect only what you need
• Accuracy. Keep data correct
• Storage limitation. Don't keep it longer than necessary
• Security. Protect it appropriately
• Accountability. Be able to show how you comply

Lawful bases

You need a lawful basis for each type of processing. The main ones are consent, contract, legal obligation, and legitimate interests. For example:

• Replying to a contact form enquiry can rely on taking steps toward a contract or legitimate interests
• Marketing emails usually need consent, or fall under specific rules for existing customers
• Non-essential cookies and similar technologies typically need consent under separate e-privacy rules

What this means for your website

1. Publish a clear privacy notice. Explain what you collect, why, who you share it with, how long you keep it, and people's rights. See privacy policy and cookie banner basics. You can see how a plain-language policy reads in our own Privacy Policy.

2. Handle cookies and tracking properly. Strictly necessary cookies don't need consent, but analytics, advertising, and many embedded tools usually do. Don't load them before consent where it's required. Make rejecting as easy as accepting. Audit your site to see what actually runs. See third-party scripts and website speed.

3. Be careful with forms. Collect only needed fields, explain how you'll use the data, and don't pre-tick marketing boxes. See email signup form best practices and contact form design.

4. Know your processors. Services that handle data for you, such as form providers, hosting, analytics, email tools, and booking systems, are processors. Use reputable providers, and make sure appropriate data processing terms are in place.

5. Consider international transfers. If data goes outside the EU or UK, specific safeguards or frameworks are needed.

6. Secure the site. Use HTTPS, keep software updated, restrict access, and use strong authentication. See how to keep your website secure and password managers for small teams.

7. Respect people's rights. Individuals can ask for access, correction, deletion, restriction, portability, and to object. Have a simple way to receive and answer requests, within a month in most cases.

8. Plan for breaches. Know how you'd detect and respond. Some breaches must be reported to the authority within 72 hours, and sometimes to the people affected.

9. Keep records. Document what data you hold, why, and where. Small organizations have lighter record-keeping requirements, but it's still useful.

Do you need a data protection officer?

Only in specific cases, such as large-scale monitoring or processing of sensitive data. Most small businesses don't, but should still have someone responsible.

Penalties

Regulators can issue significant fines and corrective orders, though for small businesses the more common outcomes involve warnings, guidance, and requests to fix problems. Take it seriously anyway.

Practical first steps

1. List the personal data your website collects and where it goes
2. Remove what you don't need
3. Write or update your privacy notice
4. Fix your cookie and tracking setup
5. Check your providers' terms
6. Set up a process for rights requests
7. Review yearly

Related laws

Other regions have their own rules. See US state privacy laws and your website.

The bottom line

Collect less, explain clearly, get consent where required, secure what you keep, and respect people's rights. Get professional advice for anything complex.