25 May came and went. GDPR is now in force.

Data protection authorities have indicated they will not chase SMBs aggressively in the immediate aftermath. But the regulation is active, and "we didn't get around to it" is not a sustainable answer.

If you have not yet gone through your website, today is as good a day as any. Here is what actually needs to be in place.

1. Privacy policy

Your website needs a privacy policy written to be read, not to be avoided. It should explain:

  • what personal data you collect
  • why you collect it (legal basis)
  • who may have access to it
  • how long it is stored
  • how users can request access, correction or deletion

It should be easy to find, not just a link in the footer in small print.

2. Cookie consent

If your website uses cookies for tracking, analytics or marketing, you need a visible consent banner that lets the user choose. Informing users is not enough. They must actively consent to non-essential cookies.

That means Google Analytics, Facebook Pixel, remarketing tags and similar tools should not load until the user has said yes.

3. Contact forms

Contact forms collect personal data. Check that:

  • it is clear what the information will be used for
  • you are not asking for more information than you need
  • data is stored securely and not retained longer than necessary
  • you have a process for handling requests for access or deletion

4. Email lists

This is where most businesses have the most to clean up.

A GDPR-compliant email list means every subscription is based on active, documented consent, and you can demonstrate it. Contacts added manually, imported from a conference, or who never confirmed their subscription are in a grey area.

Many businesses ran re-permission campaigns in April and May. If you have not done this, consider reviewing your list and removing contacts for whom you do not have valid consent.

5. Data processing agreements

If you use third-party services that process personal data on your behalf (email platform, CRM, analytics tool, live chat) you need a data processing agreement with each supplier.

Most major vendors (Mailchimp, Google, HubSpot) have updated their terms and added GDPR clauses. Check that you have accepted them.

Do not be afraid: be systematic

GDPR is not designed to punish businesses making a genuine effort to handle data responsibly. It is designed to punish those who ignore it.

The priority now:

  • have a readable privacy policy in place
  • handle cookies correctly
  • know what personal data you hold and where it is

Everything else can be worked through methodically over time.

Not sure what is missing on your website? Get in touch: we will go through the site and give you a concrete list of what needs to be sorted.