GDPR: What your website needs to get right

Does GDPR apply to your business?

The EU GDPR applies to processing in the context of an EU establishment. It can also apply to organisations outside the EU that offer goods or services to people in the EU or monitor their behaviour there. Simply having a website that can be opened in Europe does not settle the question.

The UK has its own UK GDPR and related legislation. If you serve both markets, assess both regimes. A small team or low turnover does not automatically exempt your business. The EDPB’s small business guide explains the need for a lawful basis for each processing purpose.

Start with your actual audience and activities: where you operate, where you actively sell, and whether your tools follow people’s behaviour. Keep that scope assessment alongside your tracking inventory.

How GDPR and cookie rules fit together

GDPR regulates personal data. Rules on storing information on a device or accessing information already there come from the ePrivacy framework and national legislation in the EU, and PECR in the UK. Those device rules can apply even when the information is not personal data.

This means “we have a GDPR lawful basis” does not automatically authorise a cookie. Equally, obtaining cookie consent does not resolve retention, international transfers or every later use of the data.

Check the jurisdiction as well as the technology. EU countries do not all apply identical analytics exemptions. In the UK, the rules now include conditional exceptions for statistical purposes and adapting a service’s appearance or functionality. The ICO’s current exceptions guidance explains the narrow purposes, information and easy objection requirements. This is not a general exemption for advertising analytics or cross-site tracking.

Five things to get right

1. Map purposes before choosing banner categories

List the tools on your site and what each actually does. Separate delivering the requested service, understanding aggregate usage, measuring advertising and building audiences. One tool may perform several functions.

For each purpose, record the data involved, recipients, retention and applicable lawful basis. “Marketing” should not conceal unrelated activities that visitors would reasonably want to choose separately. Remove tools that no longer serve a clear purpose.

2. Make consent a real choice

Where consent is required, obtain it before the relevant activity starts. Explain the purpose, provide meaningful choices and avoid preselected optional settings. Scrolling, silence or simply continuing to browse is not a positive consent action.

The EDPB’s consent guidelines explain freely given, specific, informed and unambiguous consent, including withdrawal. Use clear language and a refusal route that does not create unnecessary friction. Assess any approach that makes access conditional on optional tracking carefully.

3. Connect the choice to what actually runs

A saved preference is only useful if the website follows it. Check scripts loaded through your tag manager, plugins, embedded videos, booking tools and third-party widgets.

Test a fresh visit before interacting with the banner. Then test rejection, selected categories and withdrawal. Check network requests and device storage, not just whether the banner disappears. Include server-side destinations: changing where data is sent does not remove your responsibility for its use.

4. Explain the data journey

Your privacy information should help a customer understand who is responsible, the purposes and lawful bases, recipients, retention, rights and relevant international transfers. Cookie details should accurately describe the technologies in use.

Make the information available where the decision happens. A useful first layer explains the essential choice, with accessible detail behind it. Keep names and purposes consistent across the banner, cookie information and privacy notice.

5. Make rights and ongoing reviews manageable

Set a process for access, correction, erasure and other applicable rights, including objections and withdrawal. Rights are not all absolute, so assess the request and relevant exceptions rather than promising automatic deletion of everything.

The ICO explains how PECR and the UK GDPR interact. Use that distinction when reviewing a new supplier or purpose. Keep appropriate consent evidence and review contracts, retention and transfers whenever the data journey changes.

What this means for your reporting

If fewer visitors agree to optional analytics, recorded traffic may fall without an equivalent fall in real visits. Explain that limitation in campaign reporting. Compare results with sales, enquiries and other business records, while respecting the rules that apply to those records.

For example, an online store may need a basket cookie to complete a purchase but separately ask for advertising tracking. Rejecting advertising should not quietly turn the basket into a marketing identifier. That separation protects the customer’s choice and makes measurement easier to interpret.

Website checklist

• Check scope: document whether EU GDPR, UK GDPR and local device-access rules apply.
• Check purposes: identify what each tool collects and why.
• Test a fresh visit: verify consent-dependent activity stays off until permission.
• Test rejection: check requests, storage and downstream destinations.
• Test selected choices: enable only the purposes the visitor accepted.
• Test withdrawal: make settings easy to reopen and stop future consent-based activity.
• Check information: align the banner, cookie details, privacy notice and actual configuration.
• Review changes: repeat checks after adding tools, changing purposes or entering a new market.

FAQ