GDPR on a Business Website: The Minimum You Actually Need
An email lands in your inbox: “during a routine audit we identified irregularities in the processing of personal data on your website, please contact us urgently.” It is signed by a law firm nobody has heard of, with a link to a form. Most of these are cold outreach at best and phishing at worst, but they do their job: for a week you think about GDPR instead of about work, with no idea whether you actually have a problem.
An ordinary business website, with no shop and no newsletter, touches personal data in exactly two places: the contact form and the visitor statistics. That is the whole list. The frightening stories are about organisations processing data at a scale a plumber in Piaseczno never gets near. What follows is the minimum you genuinely need. It is not legal advice, just the mistakes we run into most often when we take over somebody’s old site.
What actually counts as personal data here
Personal data is any information that points to a specific person. The name and email from your contact form qualify, and so does a phone number typed into the message. Less obviously, so does the identifier Google Analytics stores in a visitor’s browser, because it lets the same person be recognised on their next visit.
For a typical service website, that is where the list ends. Photos of your work, your price list, the map to your door: none of that is customer personal data. Two sources of data mean two duties: tell people what you do with theirs, and ask for consent where the law requires it.
The privacy policy: what has to be in it
A privacy policy is not decoration in the footer. It is how you meet the duty to inform, and it should answer the questions of the person whose data you collect, in language they can read without a lawyer.
| Element | What to actually write |
|---|---|
| Data controller | Full company name, address, tax number, contact email. Not “our company” |
| Purposes and legal basis | Answering an enquiry from the form (Art. 6(1)(b) or (f)), visitor statistics (consent) |
| Recipients | Who else sees the data: hosting provider, mail provider, Google if you run analytics |
| Retention | A period or a criterion, for example “until the correspondence ends, plus one year” |
| Rights | Access, rectification, erasure, objection, complaint to the supervisory authority |
| Is it required | Whether the data is necessary and what happens if somebody refuses to give it |
| Cookies | Which files and what for, listing only the ones you really use |
Copying a policy from another website looks like a five-minute saving and is a trap. You import somebody else’s company name and tax number (we have opened a policy naming a business from a completely different industry), somebody else’s tools, somebody else’s retention periods. If the document mentions a newsletter and online payments you do not have, it describes their company, not yours. The trap runs the other way too: a policy declaring analytics the site does not have.
The cookie banner: consent has to be real
The duty to ask about cookies comes from electronic communications law rather than from GDPR itself, and GDPR adds the requirements for the consent: freely given, specific, informed and easy to withdraw. Three things follow.
First, sequence. Analytics must not start before the visitor clicks “I agree.” A banner sitting on top of a page where the script has already dropped a cookie is worse than no banner, because it documents the breach. This is the most common technical fault we find on older sites.
Second, symmetry. The reject button has to be as visible and as easy to press as the accept button. A banner with one big “OK” and a grey “settings” link in the corner does not collect valid consent, because the choice is not real.
Third, the way back. Withdrawing consent must be as easy as giving it, so the site needs a permanent place where a visitor reopens the banner and changes their mind, usually a “cookie settings” link in the footer. Clicking “reject” should also delete the analytics cookies already stored.
Cookies that keep a session alive and the site secure need no consent. And if your site has no analytics, no social embeds and no maps that track people, you do not need a banner at all.
The contact form: a notice, not a catch-all checkbox
The classic mistake is a mandatory checkbox saying “I consent to the processing of my personal data” and a feeling that the subject is now closed. When somebody writes asking for a quote, the basis for processing is the contact they requested, not consent. A forced consent, without which the message cannot be sent, would not be freely given anyway.
What belongs under the form is a short notice: who the controller is, why you collect the data, how long you keep it, and where to read the full policy. Two sentences and a link are enough. A separate, optional consent comes in only when you want to do more than reply, such as adding someone to a mailing list. That is where a checkbox belongs, unticked by default.
Then there is where the enquiry lands. A free mailbox on somebody else’s service gives you less control over who you entrust the data to than mail on your own domain does. We take the form itself apart in our post on the contact form.
Google Analytics after a refusal
Google now requires sites in Europe to run consent mode, which passes the visitor’s decision to its scripts: everything starts blocked, and only a click on “accept” unlocks cookie storage.
So what happens to your statistics when a share of visitors say no? Google receives a signal without an identifier and models part of the data, so the numbers become approximate. For a small business that changes little, since you are not making decisions based on the gap between 180 and 195 visits. What matters more is how many ended in a phone call or a submitted form, which we cover in the piece on knowing whether your website brings customers.
If analytics does not interest you, skip it. A site with no tracking is the simplest compliance there is, at the cost of knowing what happens on it.
Five mistakes you can spot from the street
- No privacy policy, or a footer link pointing at an empty page.
- A banner with a single “OK” button and no way to refuse.
- Analytics firing before the visitor has decided anything.
- A form with no word about who the controller is or why the data is collected.
- A policy copied from another site, with somebody else’s company name still in it.
All five take about fifteen minutes to check yourself. The wider list of things worth clicking through after launch is in our guide to checking whether your website works.
What comes ready, and what is still on you
With Sitario you describe your company in a form and roughly an hour later you look at a finished site. Part of the GDPR side is handled straight away, because it is technical work rather than an owner’s decision: a privacy policy page filled in with your details from the order, a cookie banner with an equal reject button, analytics that fires only after consent, a “cookie settings” link in the footer, and deletion of the analytics files when consent is withdrawn. Prefer no statistics at all? Analytics can be switched off, and then no banner appears. The site costs PLN 249 once, with the first year of hosting, so there is no separate “GDPR package” at checkout.
What no automation does for you: it will not judge whether you run processes needing extra paperwork, such as CCTV on the premises, patient records or recruitment. It will not write processing agreements with your accountant or your booking system, and it will not decide how long you really keep client emails, because that is your call. In an industry handling sensitive data, medical practices and law firms first among them, the website is the smallest part of your GDPR work and an audit of the whole business is money well spent.
In short
For an ordinary service website the minimum comes down to four things: your own, truthful privacy policy, a cookie banner with a real choice and a way back, analytics that starts only after consent, and a short notice by the contact form. None of it needs a law firm. Records of processing and internal procedures live off the website and depend on how the company runs.
So ignore the email from the unknown law firm and walk through the five points above on your own site instead. If hosting and domains are also a fog to you, we explain them without jargon in the post on hosting, domains and SSL.