GDPR and Your Website: What a Small Business Must Do

Yes, GDPR applies to your website as soon as it collects personal data: a contact form, an email address, visit statistics or a cookie. For a small business, this does not mean writing a document of dozens of pages. It means meeting a few precise obligations. Without them, your site exposes your business to complaints and to compliance requests that usually arrive at the worst possible moment.

This article covers what really matters for a showcase site, an online shop or an appointment page, without unnecessary jargon. I am not a lawyer: for a specific case, the CNIL, France’s data protection authority, remains the reference, and a lawyer can give you a precise answer.

Which obligations really apply to your website?

Three elements are needed on almost every professional website:

• Legal notices: company identity, registration number, publication manager, contact details and hosting provider. They are mandatory for any professional website, GDPR or not.
• A privacy policy: which data you collect, why, how long you keep it, and how a person can request access, correction or deletion.
• Cookie consent: non-essential cookies (audience measurement, advertising, embedded videos or maps) may only be set after the visitor agrees.

The record of processing activities is lighter for small organisations. It remains useful as soon as you regularly handle customer or prospect data.

Your contact form, an often forgotten point

Every form collects data: a name, an email address, sometimes a phone number. A few simple habits help:

• Ask only for the fields you really need. A form that requests a postal address for a simple question is hard to justify.
• Add a short line under the send button, with a link to your privacy policy.
• Set a reasonable retention period for messages, and respect it.

A contact form is included from the Essentiel showcase site package, priced at 890 euros, so you can plan it from the start instead of fixing it later.

Cookies: what the CNIL expects in practice

The cookie banner is the most checked element. To be compliant, it should follow a few rules:

• No pre-ticked boxes: the visitor must act to accept.
• Refusing as easily as accepting: a "Refuse all" button shown at the same level as "Accept all".
• Effective blocking: non-essential tools must not set anything until the visitor has accepted.

Some audience measurement tools can work without cookies or with a lighter setup. The right choice depends on what you actually want to learn about your visitors, and it is worth deciding with your developer.

The most common mistakes

• Copying a privacy policy from another site: it does not describe your own processing and protects nobody.
• Forgetting third-party services: fonts loaded from foreign servers, embedded YouTube videos, social media widgets. Each one is a data transfer to account for.
• A form without information: the visitor must know what their data will be used for.
• No process for deletion requests: you must be able to answer a request for access or erasure within a reasonable time.

A six-point checklist

1. Complete legal notices, up to date, with the hosting provider named.
2. A privacy policy written for your actual activity.
3. A form limited to useful fields, with a link to the policy.
4. A cookie banner where refusing is as visible as accepting.
5. A verified list of third-party tools: measurement, videos, fonts, maps.
6. A dedicated email address for personal data requests.

A compliant website is not a complicated one. Most often it is a simple site that collects only what it truly needs.

How much does compliance cost?

If your site is already online, a first review shows which pages and tools cause problems. The simplest starting point is a free audit of your website. If you would rather have legal pages written or reviewed, the page writing option is listed at 70 euros per page in my catalogue. For a new project, everything can be built in from the design stage, with no extra cost for rework.

Frequently asked questions

Does a showcase site without a form need to follow GDPR?

Legal notices remain mandatory. Without a form or measurement tool, obligations are limited, but as soon as a tool sets cookies or a third-party video is embedded, they must be taken into account.

Is Google Analytics forbidden?

No, but its use requires the visitor’s prior consent and proper safeguards for data transfers. Its configuration should be checked case by case.

Does a small business need a data protection officer?

For most small businesses, no. This obligation mainly concerns organisations whose core activity involves large-scale data processing.

Do I need to change my site whenever the rules change?

The core rules change little, but your tools do. A regular check, for example as part of maintenance, avoids unpleasant surprises.

Not sure your current site is compliant? Book a free 30-minute call and we will look together at what needs fixing first.