Website privacy is not solved by publishing one notice or adding a cookie banner. A company needs to know what personal data the website and its connected services process, why the processing is necessary, who receives the data and how people's rights work in practice.
Begin with an inventory of personal data and data flows
List the forms, newsletters, analytics, advertising tags, chats, booking, payments, embeds, logs and other services connected to the site. For each one, record the data collected, purpose, legal basis, recipients, location, retention period and accountable owner. An IP address, online identifier or conversation content may be personal data when it relates to an identified or identifiable person.
The inventory separates the company's own processing from a supplier's tasks. A company may remain the controller even when a technical partner installs a form or analytics service. Assess the supplier's role, processing agreement, subprocessors and possible transfers outside the EU or EEA from the real data flow rather than from a product name or marketing claim.
The GDPR's territorial scope is not based on EU citizenship
Territorial scope relates, among other things, to processing in the context of an EU establishment and, in specified circumstances, offering goods or services to people in the EU or monitoring their behaviour there. EDPB guidance makes clear that this protection is not based on a person's citizenship. Each organisation needs to assess scope against its own establishment and activities.
When a website collects personal data, the person must receive the information required by the GDPR in a concise, intelligible and easily accessible form. Depending on the situation, Article 13 covers matters such as the controller's identity, purposes and legal bases, recipients, retention period or criteria, and individual rights. A privacy notice can provide this information when it accurately reflects the website's processing; an identical document is not automatically required for every site that processes no personal data at all.
| Processing situation | First question | Typical documentation |
|---|---|---|
| Contact form | which data is needed to respond? | privacy notice and retention practice |
| Analytics or advertising | which identifiers are used and when? | cookie information, consent and a service assessment |
| External provider | does it process data for the company? | processing agreement and supplier documentation |
Every processing purpose needs a legal basis and a boundary
Consent is not the GDPR's only legal basis and should not be requested for everything as a precaution. Responding to an enquiry, fulfilling an order, complying with a legal obligation and marketing may rely on different bases. Define each purpose before collection and request only the data necessary for it. Document the legal basis and any legitimate-interest assessment.
Distinguish required form fields from optional ones and do not invite unnecessary sensitive data in an open text field. Newsletter consent should not be bundled into a service request when marketing is not necessary to provide that service. Double opt-in can help demonstrate a subscription and reduce misuse, but it should not be presented as an explicit universal GDPR requirement in every situation.
Non-essential cookies and similar technologies generally require consent
According to Finnish Traficom guidance, storing information on a user's device or accessing information already stored there generally requires consent unless the technology is strictly necessary to transmit a communication or provide a service explicitly requested by the user. The assessment covers cookies and similar technologies and depends on purpose rather than a label such as analytics or functional.
Valid consent needs to be freely given, specific, informed and unambiguous. Non-essential tags should not start before the choice, preselected options should not be used, and withdrawing consent should be as easy as giving it. Explain purposes, durations and third parties clearly, and retain enough evidence to demonstrate the consent obtained without collecting unnecessary additional data.
Test analytics, advertising and embeds in practice
The presence of a banner does not prove that choices work. Inspect browser storage and network requests to determine what loads before consent, after acceptance, after rejection and after withdrawal. Include embedded videos, maps, chat, forms and services that may set identifiers from their own domains.
Google Consent Mode or another technical consent signal does not establish legal compliance by itself. The company still needs to assess the services, legal bases, information provided to users and the actual operation of its configuration. Update the banner, notices and processing documentation whenever tags or providers change, rather than allowing an undocumented data flow to become permanent.
Privacy is an operating model, not a launch-day check
Define retention, access, deletion, backups and security for each system. The applicability of access, rectification, erasure, restriction, objection and portability rights depends on the processing, but the business needs a recognisable process to receive, assess and fulfil requests within the relevant deadlines. It also needs an internal process to detect, assess and, where required, notify personal-data breaches.
Review the system whenever a new form, integration, advertising tag, chatbot or personal-data supplier is added. An annual review is not enough if services change more frequently. Keep company ownership of accounts and documentation, assign responsible people and seek a qualified privacy or legal assessment when the correct interpretation is uncertain.
- a current inventory of data flows and service providers
- documented purposes, legal bases and retention periods
- working consent, rejection and withdrawal choices
- processes for individual rights requests and personal-data breaches
When you want privacy considered in the structure, integrations and quality assurance of your website, explore our business website service.
Sources and further information
The legal principles in this article are based on the EU GDPR, EDPB guidance and Traficom's Finnish cookie guidance. The content is general information, not a legal assessment of an individual company.
