What makes a website GDPR-compliant?

A GDPR-compliant website collects only the personal data it genuinely needs, tells people plainly what happens to that data, and can honour their rights over it. Under the UK GDPR and the Data Protection Act 2018 the obligations for a typical small business site are narrower than the acronym suggests, but they are real: you need a lawful basis for every form you run, a privacy notice describing your actual practices, consent before any non-essential cookie is set, and the ability to find and delete an individual’s data on request. Most small business sites fail on the cookie requirement, and almost always for the same reason — an embedded map, video or font is setting cookies the owner never knew existed.

The third-party problem

The single largest source of accidental non-compliance is content loaded from someone else’s server. A social media feed, a hosted video player, a map iframe, an analytics script, or a web font served from a font CDN will typically set a cookie or transmit the visitor’s IP address before any consent is requested. The site owner is responsible for that, even though they did not write the code and cannot see what it does.

This is why “self-host everything” is the simplest compliance strategy available to a small business. Self-hosted fonts, images and video served from your own domain, and analytics that identifies nobody, remove the requirement entirely rather than managing it.

Do you need a cookie banner?

Only if you set non-essential cookies. Strictly necessary cookies — a session token, a security check — do not require consent. Analytics and advertising cookies do.

If you set none, you do not need a banner at all. You still publish a privacy notice, but there is nothing to ask permission for, and visitors reach your content without an obstacle. Given that consent banners suppress a meaningful share of analytics data anyway, the cookieless route often costs less insight than people assume.

What a privacy notice must contain

Who you are, what personal data you collect, why, on what lawful basis, how long you keep it, who you share it with, and what rights the individual has. It has to be in plain language and easy to find.

A template copied from another company is worse than useless — it describes practices that are not yours, which is itself a misrepresentation. If your notice mentions a CRM you do not use, it is wrong.

Contact forms are personal data

A name and an email address are personal data. So a contact form needs a lawful basis (usually legitimate interests, sometimes consent), a retention period you actually apply rather than one you invented, and disclosure of where enquiries go. If submissions are forwarded to a third-party inbox, mail service or CRM, that processor should be named.

ICO registration

Most UK organisations processing personal data must pay the ICO’s data protection fee, starting at £52 a year for small organisations. Running an enquiry form counts as processing. Exemptions exist, so use the ICO’s own self-assessment rather than guessing — and if you are registered, put the registration number in your privacy notice.

The realistic risk

For a small business, the likely consequence of getting this wrong is not a headline fine. It is a complaint from a customer, an ICO enquiry, and the time cost of responding to both. Collecting less data in the first place is consistently the cheapest position.