GDPR Compliance Checklist for Websites (2026)

GDPR has been enforced since May 2018. By 2026, European data protection authorities have issued over €4 billion in fines and the pace is accelerating. Yet the most common violations are not sophisticated data architecture failures — they are basic oversights: missing lawful bases, pre-ticked cookie consent boxes, unsigned DPAs, and unanswered subject access requests.

This checklist covers the seven areas that regulators examine first. For each area, there is a clear statement of what you must do and the most common violation that triggers enforcement action.

Area 1: Privacy Policy

What you must do:

Your privacy policy must be publicly accessible (typically linked in the website footer), written in plain language, and cover every processing activity your website carries out.

Mandatory content under Article 13 and 14 of GDPR:

• Identity and contact details of the data controller (you)
• Data Protection Officer contact (if you have one)
• What personal data you collect (email addresses, IP addresses, cookie identifiers, payment data, etc.)
• The purpose of each processing activity
• The lawful basis for each purpose (see Area 4)
• Data retention periods for each category
• Third-party recipients and processors
• International data transfers and safeguards (e.g., Standard Contractual Clauses for US processors)
• All eight data subject rights
• Right to lodge a complaint with a supervisory authority

Common violation: A privacy policy that was generated once in 2018 and never updated. Adding a new analytics tool, a chatbot, or an email newsletter without updating the privacy policy is a violation.

Area 2: Cookie Consent

What you must do:

Non-essential cookies (analytics, advertising, social media pixels) require explicit, informed, freely given consent before being set. This means:

• No pre-ticked boxes
• No cookies firing before consent is given
• Granular options — users must be able to accept analytics without accepting advertising
• An equally prominent "Reject All" option alongside "Accept All"
• Easy withdrawal of consent at any time (a re-openable cookie preferences panel)

Common violation: "Soft" consent — displaying a banner that says "By using this site you agree to cookies" without any accept/reject mechanism. This was the basis of Google's €90 million fine by the French CNIL in 2022.

Area 3: Data Minimisation

What you must do:

Article 5(1)(c) of GDPR requires that personal data be "adequate, relevant and limited to what is necessary in relation to the purposes." In practice:

• Contact forms should ask only for the information needed (name and email for a quote; don't add phone number if you won't call)
• Do not store data longer than necessary for its original purpose
• Delete or anonymise data on a defined schedule
• Avoid collecting data "just in case it might be useful"

Common violation: Contact forms with 10 fields when three would suffice, or databases retaining customer data indefinitely with no deletion schedule.

Area 4: Lawful Basis for Processing

What you must do:

Every processing activity needs a lawful basis from Article 6 of GDPR. There are six:

You must document the lawful basis for each processing purpose in your privacy policy and internal records. You cannot change the lawful basis retrospectively — if you start with consent, you must always be able to demonstrate that consent was given.

Common violation: Relying on "legitimate interests" as a catch-all for everything, without conducting and documenting a Legitimate Interests Assessment (LIA). Regulators have rejected this basis for advertising and extensive tracking.

Area 5: Third-Party Processor Agreements (DPAs)

What you must do:

Under Article 28, every third-party that processes personal data on your behalf must be covered by a signed Data Processing Agreement (DPA). This is not optional.

Common processors requiring DPAs:

Common violation: Using a processor without ever signing their DPA. Most providers make DPAs available in their settings — they are not automatically in force until you explicitly accept them.

Area 6: User Rights

What you must do:

GDPR grants individuals eight rights. Your website must have a mechanism for users to exercise each one, and you must respond within one calendar month.

Common violation: No mechanism to receive or respond to data subject requests. A contact form labelled "Privacy Requests" with no defined internal process for handling requests within 30 days.

Area 7: Data Breach Response

What you must do:

Maintain an internal data breach response plan that covers:

1. Detection and containment: Identify what data was affected and stop the breach
2. Risk assessment: Is the breach likely to result in a risk to individuals' rights and freedoms?
3. 72-hour notification: If yes, notify your national supervisory authority within 72 hours
4. Individual notification: If high risk to individuals, notify them directly without undue delay
5. Documentation: Record all breaches in an internal breach register, even those that do not require notification

Common violation: Not knowing that a breach has occurred — common when using unsecured third-party integrations — or knowing about a breach and not notifying the supervisory authority within the 72-hour window.

Full GDPR Compliance Checklist at a Glance

Use our GDPR Privacy Policy Generator to create a compliant, up-to-date privacy policy with all mandatory fields. For cookie consent specifically, see our Cookie Consent Generator.