Updated August 2026 · Works on any CMS

The GDPR Compliance Checklist for Websites

Q: What is GDPR compliance for a website?

For most website owners, GDPR compliance means: a lawful basis for every cookie and tracker you set (usually consent), a consent banner that actually blocks tracking before opt-in, a privacy policy that names your data processing, working data-subject rights processes, secure transport (HTTPS/HSTS), and records of processing for anything beyond trivial use.

Q: How do I check if my website is GDPR compliant?

Work through this checklist manually, or run the free EUComply scanner which tests HTTPS and HSTS headers, detects your consent platform, checks whether cookies fire before consent, inspects forms for consent language, and verifies your legal pages exist — automatically, on any CMS.

Q: Is GDPR compliance required for small websites?

Yes if you target or measure visitors from the EU — there is no small-business exemption. Fines scale with turnover, but supervisory authorities do fine small companies, and the bigger practical risk is ad networks and analytics vendors requiring valid consent signals.

24 concrete requirements across 5 categories. Tick what's in place, watch your score update live, and get a prioritized fix list at the end. Nothing is stored — everything runs in your browser.

This is a self-assessment tool, not legal advice. It maps to widely accepted GDPR obligations for website operators. For high-risk processing, involve counsel.

1. Cookies & Tracking

ePrivacy + GDPR Art. 6 — consent before non-essential cookies fire.

Consent banner shown to EU visitors on first visit MUST A banner must appear before any tracking happens, not after the first pageview has already fired tags. No non-essential cookies fire before opt-in MUST Analytics, ads and social pixels must stay silent until the visitor accepts. Test with a fresh incognito window and DevTools → Application → Cookies. Rejecting is as easy as accepting MUST Equal-prominence buttons ("Accept all" vs "Reject all"). Pre-ticked boxes are invalid under German and French enforcement practice. Granular categories (necessary / analytics / marketing) SHOULD Visitors must be able to consent per purpose, not one giant yes. Consent is logged with timestamp and version SHOULD You must be able to prove consent existed. Most consent platforms store this automatically — confirm it's enabled. Banner offers a way to change or withdraw consent later SHOULD Usually a small "Cookie settings" link in the footer.

2. Legal Pages

GDPR Arts. 12–14 — transparency about what you collect and why.

Privacy policy exists and is reachable from every page MUST Linked from the footer, not buried three clicks deep. Policy names each category of personal data collected MUST Contact form data, analytics identifiers, newsletter emails, order data — list them concretely. Legal basis stated per purpose MUST Consent for marketing, legitimate interest for security logs, contract performance for orders. Data retention periods specified MUST Say how long you keep each category — e.g. "newsletter data until unsubscribe". Third-party processors named (analytics, hosting, email) SHOULD Art. 13(1)(e) requires naming recipients. Google Analytics, Mailchimp, your host — list them. Cookie policy or cookie table listing actual cookies SHOULD Name, provider, purpose, duration. Most consent platforms can generate this table. Policy has a last-updated date and version history SHOULD Regulators check whether policies track reality. A stale date is an easy red flag.

3. Forms & Data Collection

Every field you collect needs a lawful basis and honest labeling.

Marketing/newsletter checkboxes are unticked by default MUST Pre-ticked consent was explicitly rejected by the CJEU (Planet49). Each form states what happens to the data and links the policy MUST One line above the submit button is enough. Only necessary fields are collected SHOULD Data minimization, Art. 5(1)(c). Don't ask for a phone number you never use. Double opt-in on newsletter signups SHOULD Not strictly required by GDPR, but standard practice in DE/AT and your best proof of consent. Forms protected against spam without dark-pattern UX SHOULD Honeypot or server-side rate limiting beats unreadable CAPTCHAs that create accessibility problems.

4. Security & Technical Measures

GDPR Art. 32 — "appropriate technical measures". These also feed your SEO.

HTTPS enforced site-wide with redirects from HTTP MUST Table stakes. Any http:// URL should 301 to https://. HSTS header set (Strict-Transport-Security) SHOULD Strict-Transport-Security: max-age=31536000. The EUComply scanner checks this automatically. Security headers configured (CSP or at minimum X-Content-Type-Options) SHOULD Defense-in-depth against injected scripts that could exfiltrate user data. Access to admin areas restricted (2FA, limited attempts) SHOULD Compromised sites leak personal data — Art. 32 requires you prevent the obvious attacks. Backups exist and have been restore-tested SHOULD Availability is a GDPR principle too (Art. 5(1)(f)).

5. Data Subject Rights & Accountability

GDPR Arts. 15–22, 30 — people can ask, and you must answer within one month.

A working contact channel for privacy requests exists MUST privacy@yourdomain or a form. It must actually reach someone who responds. You know where all personal data lives (systems inventory) MUST You can't delete or export data you can't find. A simple spreadsheet listing system → data → owner is enough at this scale. Record of processing activities maintained (Art. 30) SHOULD Required for organizations over 250 staff — but recommended for everyone because it doubles as your systems inventory. Process defined for access/deletion requests within 30 days SHOULD Decide now who handles them and how you verify identity. Don't improvise when the first email arrives. DPAs signed with processors that handle EU personal data SHOULD Art. 28 requires a written agreement. Most SaaS vendors offer a standard DPA you can accept online in minutes — our template pack includes one for smaller vendors that don't.

Next step: several of these checks can be verified automatically. Run the free scanner on your URL — it tests HTTPS/HSTS, consent platform detection, cookies-before-consent, form consent text and legal pages on any CMS, in seconds. Need the documents behind items like DPAs and privacy policies? Browse ComplianceDocs templates.

Frequently asked questions

What is GDPR compliance for a website?

For most website owners it means five things: a lawful basis for every cookie and tracker (usually consent), a banner that actually blocks tracking before opt-in, a privacy policy that matches reality, working data-subject rights processes, and basic technical security like HTTPS and HSTS. This checklist walks through all of them.

How do I check if my website is GDPR compliant?

Two ways: work through this checklist honestly (10 minutes), or automate the parts that can be tested — the free EUComply scanner checks SSL/HSTS, consent platforms, cookies-before-consent, forms and legal pages on WordPress, Shopify, Webflow, Wix, Squarespace, custom HTML and anything else.

Is GDPR compliance required for small websites?

Yes, if you have visitors from the EU. There is no size exemption. Enforcement against small businesses is real but rarer than headline fines — the practical risk today is that ad networks and analytics vendors require valid consent signals to keep serving you.

Does this apply outside the EU?

GDPR applies extraterritorially: if you target or monitor people in the EU, it applies regardless of where you're based. Similar laws (UK GDPR, Swiss FADP, Brazil LGPD) largely follow the same playbook, so this checklist covers most of them by default.