GDPR & Privacy: What Your Website Must Have

GDPR (General Data Protection Regulation) affects any website that serves users in the European Union — regardless of where your business is located. Non-compliance can result in fines up to 4% of global annual revenue. Here's what your website actually needs.

Cookie consent must be informed and granular. A banner that says "We use cookies" with only an "Accept" button is not compliant. Users must be able to accept, reject, or choose which categories of cookies to allow (necessary, analytics, marketing). Don't load tracking scripts until consent is given — this means your Google Analytics, Facebook Pixel, and chat widgets should only fire after explicit opt-in.

Your privacy policy must be clear, specific, and accessible. It should explain what data you collect, why you collect it, how long you store it, who you share it with, and how users can request deletion. Generic templates are better than nothing, but a policy tailored to your actual data practices is what the regulation requires.

Right to access and right to deletion are user rights you must support. If a user asks "what data do you have on me?" you must be able to answer within 30 days. If they ask you to delete their data, you must comply (with limited exceptions). This means your database needs to support data export and deletion workflows.

Data minimization means only collecting what you actually need. Don't require a phone number if you'll never call. Don't collect a date of birth if you don't need age verification. Every field in your forms should have a clear business justification.

Third-party services are your responsibility too. If you use Google Analytics, Stripe, Mailchimp, or any SaaS tool that processes user data, your privacy policy must disclose this. Ensure these services have their own GDPR-compliant data processing agreements in place.

Practical first steps: install a proper cookie consent manager (like Cookiebot or a custom solution), audit your data collection points, write a real privacy policy, add a data deletion flow to your user settings, and ensure your forms only collect what's necessary. It's not as overwhelming as it sounds — start with the basics and iterate.