Before your website goes live
Nine items. Each one takes under an hour to check.
Most GDPR problems start with someone missing a single item. This list covers what to check before launch, ordered by effort so the quick wins come first.
9 items before launch
Legal notice
Complete, with real contact details, reachable from a link in the footer of every page. A missing notice is actionable on its own.
Privacy policy
It has to describe the processing you carry out. Run analytics and the tools in use must be named there.
Contact form
Required fields, a privacy notice next to the form, a documented deletion deadline for the enquiries that come in.
SSL enforced
No plain HTTP, no mixed content. Enable the forced redirect in your server settings rather than relying on it.
Analytics and tracking
Cookieless with no consent requirement, or consent mode with a working banner and a consent log. A source status report falls short.
Cookie banner
Declining must be as easy as accepting. With no consent-requiring tracking, drop the banner entirely.
Hosting and backups
EU servers with a data processing agreement. Backups automatic, encrypted, and restored once in a test. An untested backup covers nothing.
Vendor contracts
Any vendor with access to personal data needs a contract under Art. 28 GDPR. That covers your newsletter provider and payment processor too.
Record of processing activities
Which data, which purpose, which legal basis. Under 30 staff this takes half a day and underpins everything else.
Detailed checklist by email
The short list above covers what has to be checked before launch. The detailed version walks through every item with the verification step, the legal basis, and the concrete action required.
After that
- You are not sure where you stand: The detailed checklist covers every item with the verification step and the action required. Free by email.
- You have already received an enquiry: Start with the record of processing, the data processing agreements and the deletion deadlines.
- You are still choosing the stack: The hosting and tracking decisions get made here. Changing either later costs more.
Have the website checked
We check your site against this list and tell you what is missing. No obligation.