GDPR for a small business website: the parts that actually apply

The General Data Protection Regulation (GDPR, Regulation (EU) 2016/679) sets the rules for handling personal data about people in the European Union. It applies to your website as soon as the site collects anything that identifies a person: a name and email address in a contact form, an IP address in server logs, a CV uploaded through a careers page. It can also apply to businesses based outside the EU that offer services to people in the EU (Article 3(2)). The United Kingdom has its own closely aligned version, the UK GDPR, alongside the Data Protection Act 2018.

This guide is general information, not legal advice. If you process health data, monitor people at scale or do anything unusual, speak to a data protection specialist.

First, map what your site collects

You cannot explain what you do with data until you know what you collect. Walk through the site and list every place personal data enters it, then note the purpose and the likely legal basis.

Choosing a legal basis under Article 6

Article 6(1) lists six legal bases: consent, contract, legal obligation, vital interests, public task and legitimate interests. For a typical business website, three do almost all the work.

• Contract (Article 6(1)(b)): processing needed to perform a contract or to take steps the person asked for before entering one, such as preparing a quote they requested.
• Legitimate interests (Article 6(1)(f)): processing that a business reasonably needs and that does not override the person's interests, such as replying to an enquiry or keeping security logs. Record a short balancing test showing you considered this.
• Consent (Article 6(1)(a)): needed for things like marketing newsletters. Under Article 7 and the definition in Article 4(11), it must be freely given, specific, informed and unambiguous, and as easy to withdraw as to give.

Consent is not automatically the safest choice. A common mistake is adding a compulsory consent tick box to a contact form. If you simply need the data to reply, contract or legitimate interests fits better, and a forced tick box is not freely given consent anyway. Special category data, such as health information, needs an additional condition under Article 9, so avoid collecting it through a general form.

What the privacy notice must say

Articles 13 and 14 set out what people must be told, and Article 12 requires it to be concise, transparent, intelligible and easily accessible, in clear and plain language. For data collected directly through your site, the notice should cover:

• Your company's identity and contact details, and your data protection officer's details if you have one.
• Each purpose of processing and its legal basis, including the legitimate interests you rely on.
• Who receives the data, at least by category, such as hosting, email and form providers.
• Any transfers outside the EU or EEA and the safeguard used.
• How long data is kept, or the criteria used to decide.
• People's rights: access, rectification, erasure, restriction, objection, portability and withdrawal of consent.
• The right to complain to a supervisory authority.
• Whether providing the data is required, and what happens if it is not provided.

If your site is in several languages, publish the notice in each of them. Link to it from the footer and next to every form.

Forms: collect less, explain more

• Ask only for fields you actually use; data minimisation is a core principle under Article 5(1)(c).
• Place a one-line notice and a privacy link next to the submit button.
• Keep marketing consent separate from the enquiry, as an unticked, optional choice.
• Send form submissions to a shared business mailbox rather than one person's inbox.
• Decide how long enquiries are kept and delete old ones on a schedule.
• Serve every form over HTTPS and limit file uploads to the types you need.

Processors: the providers behind the site

Your hosting company, email provider, form tool, newsletter platform and any AI assistant provider process personal data on your behalf. Under Article 28 you need a written contract with each, usually called a data processing agreement. Most reputable providers publish standard terms; keep a copy.

If a provider stores or accesses data outside the EU or EEA, Chapter V applies. Transfers can rely on an adequacy decision, such as the EU-US Data Privacy Framework for certified US companies, or on safeguards like the European Commission's standard contractual clauses. Ask each provider which mechanism they use. Article 30 also requires a record of processing activities. The exemption for organisations with fewer than 250 employees is narrow: it does not apply where processing is not occasional, is likely to result in a risk, or includes special category data, so most businesses that handle client data regularly should keep a simple record.

Rights requests and breaches

When someone asks for a copy of their data or for its deletion, you generally have one month to respond, extendable by two further months for complex or numerous requests (Article 12(3)). If personal data is lost, stolen or exposed, Article 33 requires notifying your supervisory authority without undue delay and, where feasible, within 72 hours of becoming aware, unless the breach is unlikely to result in a risk to people. Decide in advance who handles each of these.

A short action list

1. List every form, tool and embed on your site and the data each one handles.
2. Assign a legal basis to each purpose and note your reasoning.
3. Update the privacy notice in every language the site uses.
4. Remove unnecessary form fields and any compulsory consent boxes.
5. Collect data processing agreements from each provider.
6. Set retention periods and a named person for rights requests and breaches.

Cookies and similar tracking are governed by a separate law alongside GDPR; our guide to cookie consent and banners covers that side. For a specific question, contact us before you buy.

Questions and answers