Is Your Website GDPR Compliant? A Practical UK Checklist
UK data protection law applies to almost every business website, and most of the problems are fixable in an afternoon. Here is the checklist we use. It is general information, not legal advice.
If your website collects any personal information, including a name on a contact form, an IP address in analytics or an email address on a newsletter sign up, UK data protection law applies. The law is the UK GDPR together with the Data Protection Act 2018 and, for electronic marketing and cookies, the Privacy and Electronic Communications Regulations. Compliance is mostly a matter of knowing what you collect, being honest about it and keeping it safe. This is a practical checklist, not legal advice, so take professional advice for your own situation.
1. Know what you collect and why
List every place your site gathers personal data: contact forms, bookings, newsletter boxes, chat tools, accounts, orders, analytics and embedded services. For each one, write down why you need it and how long you will keep it. If you cannot explain why you collect something, stop collecting it.
2. Have a clear privacy notice
Your privacy notice should say who you are, what you collect, why, the legal basis, who you share it with, how long you keep it, how to exercise people's rights and how to complain. Write it in plain language and link to it wherever you collect data, including next to forms.
3. Handle cookies properly
Cookies and similar technologies that are not strictly necessary, such as analytics and advertising, generally need consent before they are set, with a banner that makes accepting and declining equally easy. Describe what each category does and let visitors change their mind later.
4. Make forms honest
Collect only the fields you need. Do not pre tick boxes for marketing. Explain what will happen to the details and link to your privacy notice. Keep a record of consent for marketing, including when and how it was given, and include a working unsubscribe in every marketing email.
5. Check third party tools
Chat widgets, analytics, fonts, maps, video embeds and payment tools may share visitor data with other companies. Know which you use, check their terms and data locations, and describe them in your notice.
6. Be ready for requests
People can ask to see, correct or delete their data. Decide who handles requests, where the data lives and how you will find and remove it, and aim to respond within the legal time limit, normally one month.
7. Keep the site secure
Use secure connections, keep software up to date, restrict who can see submissions, use strong passwords with multifactor authentication and back up regularly. A breach involving personal data may need reporting to the Information Commissioner's Office within 72 hours.
8. Check suppliers and staff
Make sure written agreements are in place with companies that process data for you, and that staff know the basics.
Register if you need to
Most organisations that process personal data must pay the data protection fee to the ICO unless an exemption applies. K4O5 builds privacy, consent and security into every site and can review an existing one, and we will always tell you where you need a solicitor.