Is your website GDPR compliant? A plain-English checklist

Short answer: a compliant small business website collects only the data it needs, says clearly what it does with it in a privacy policy, and asks before setting any non-essential cookies or loading tracking tools. This checklist walks through each part.

UK GDPR and the cookie rules in PECR (the Privacy and Electronic Communications Regulations) apply to almost every business website. You don't need to be a lawyer to get the basics right. Work through these checks with your website open in another tab.

1. Cookies and tracking

• List every cookie your site sets. Your browser's developer tools show them, or use a free cookie scanner.
• Strictly necessary cookies (for example, keeping a basket working) don't need consent.
• Analytics, advertising and social media cookies generally need consent before they're set. A banner that sets them anyway, or only offers "Accept", isn't enough. Rejecting should be as easy as accepting.
• The Data (Use and Access) Act 2025 relaxes some of these rules, including for certain low-risk analytics, but the changes are coming in gradually. Check the ICO's current guidance before relying on them.

2. Analytics

Google Analytics sets cookies and sends data to Google, so it normally needs consent. Cookieless tools such as Plausible or Fathom count visits without cookies or personal data, which can remove the need for a cookie banner entirely. That's what we use on this site.

3. Fonts, maps and embedded content

• Fonts: loading Google Fonts from Google's servers shares visitors' IP addresses with Google. Hosting the font files on your own server avoids this, and is usually faster too.
• Maps and videos: embedded Google Maps and YouTube videos can set cookies as soon as the page loads. Use a link or a static image instead, or load the embed only after the visitor clicks.
• Chat widgets, booking tools and social feeds can do the same. Check what each one sets.

4. Contact forms

• Ask only for what you need to reply.
• Link to your privacy policy next to the form.
• If you want to add people to a mailing list, use a separate, unticked checkbox. Never pre-tick it.
• Make sure the site uses HTTPS, so form data is encrypted.

5. Privacy policy

Your privacy policy should say, in plain language:

• who you are and how to contact you
• what personal data you collect, and why
• your lawful basis for each use
• who you share it with (your host, email provider, booking tool and so on)
• how long you keep it
• people's rights, and that they can complain to the ICO

A generic template copied from another site rarely matches what your site actually does. Update it whenever you add a new tool.

6. The rest of the basics

• Keep the site updated and backed up, so personal data isn't exposed through an old plugin.
• Delete old enquiries you no longer need, in line with the retention periods in your policy.
• Check whether you need to pay the ICO data protection fee. The ICO has a short online self-assessment.

Every site we build is privacy-first by default: self-hosted fonts, cookieless analytics and no tracking without consent. This guide is general information, not legal advice. For anything complex, speak to a data protection specialist.

Frequently asked questions

Do I need a cookie banner?

Only if your site sets non-essential cookies or loads tools that track visitors. If it uses only strictly necessary cookies and cookieless analytics, you may not need one.

Is Google Analytics illegal in the UK?

No, but it normally needs the visitor's consent before it runs, because it sets cookies and shares data with Google.

What happens if my website isn't compliant?

The ICO can issue warnings and fines, but for small businesses the more common outcome is a complaint from a visitor. The fixes are usually quick and inexpensive.