Website GDPR checklist: 12 points to check before and after launch
Most privacy problems on business websites are not caused by bad intent but by embedded services nobody remembers: a font from someone else's server, a map, a video, a chat widget. This checklist shows how to first find out which data your website actually sends, and then check the twelve points where complaints and German cease-and-desist letters usually start. It is not legal advice, but it turns a vague risk into a list you can tick off.
Start with an inventory: where does data go?
Open your website in a private browser window, open the developer tools (F12) and reload the home page with the Network tab open. Every request to a third-party domain sends at least the visitor's IP address to that provider. Write down every domain before you click anything, then repeat on the contact page, blog and shop.
Typical findings:
- Fonts from Google Fonts or Adobe Fonts loaded live.
- Embedded maps (Google Maps) and videos (YouTube, Vimeo).
- Analytics and advertising: Google Analytics, Google Tag Manager, Meta Pixel, LinkedIn Insight Tag.
- Chat widgets, booking tools, review widgets and captchas.
- CDNs for libraries such as jQuery or icon sets.
Required texts: privacy policy and legal notice
Under Article 13 GDPR the privacy policy must describe exactly the processing that actually happens on your site: controller, purposes, legal bases, recipients, transfers to third countries, retention and data subject rights. A generator is a good start, but only as good as your inventory. If it lists a service you don't use, or misses one you do, the text is wrong.
For German businesses the legal notice (Impressum) has been governed by Section 5 of the Digital Services Act (DDG) since 14 May 2024, no longer by the Telemedia Act. Update any reference to "§ 5 TMG". Both texts must be easy to find and directly reachable from every page, usually via the footer, and must not be hidden behind a cookie banner.
Ask for consent only where it is needed
Storing or reading information on the visitor's device (cookies, local storage, pixels) is governed in Germany by Section 25 TDDDG, which implements the EU ePrivacy rules. Without consent it is only allowed when strictly necessary for the service the user explicitly requested, such as a shopping cart or login. Analytics, advertising and embedded third-party content that sets cookies need prior consent.
The best consent is the one you don't need: self-host fonts, load maps and videos only after a click, use cookieless analytics. If you still need a banner, our article on cookie banner requirements explains what it must look like.
Third-party services, processors and the US
Every provider that processes personal data on your behalf (hosting, form tool, newsletter, CRM, analytics) needs a data processing agreement under Article 28 GDPR. Large providers usually let you accept it in the account settings; keep a copy in your records anyway.
For US providers, the adequacy decision for the EU-US Data Privacy Framework has applied since July 2023. The EU General Court dismissed the action against it on 3 September 2025 (T-553/23); an appeal is pending at the Court of Justice (C-703/25 P). Check the official DPF list to see whether your provider is certified, and prefer EU providers where an equivalent exists, so a later ruling affects you less.
A well-known example of what small embeds can cost: in 2022 the Munich Regional Court awarded a visitor €100 in damages because a website loaded Google Fonts dynamically and so passed his IP address to Google without a legal basis (case 3 O 17493/20). Self-hosted fonts remove the issue entirely.
Forms, email and retention
Contact forms are where your website collects the most personal data. Ask only for what you need to handle the request (data minimisation, Article 5 GDPR), submit forms over HTTPS only and decide when enquiries that did not lead to a project are deleted. For newsletters, double opt-in is standard practice because Article 7 GDPR requires you to prove consent.
The 12-point checklist
Run through it again after every major website update, not just once at launch:
- 1. A list of all third-party domains from the Network tab exists and is current.
- 2. The privacy policy describes exactly these services, no more and no less.
- 3. The legal notice is complete and reachable from every page.
- 4. No analytics, advertising or third-party content loads before consent.
- 5. Rejecting is as easy as accepting in the banner; consent can be withdrawn at any time.
- 6. Fonts and icons are served from your own server.
- 7. Maps and videos load only after a click (two-click solution).
- 8. Processing agreements with hosting, form, newsletter and CRM providers are in place.
- 9. US services are certified under the Data Privacy Framework or covered by standard contractual clauses.
- 10. Forms ask only for necessary data and run over HTTPS.
- 11. Retention periods for enquiries and newsletter data are defined and enforced.
- 12. Your record of processing activities (Article 30 GDPR) includes the website processing.
Frequently asked questions
- Does my website mean I need a data protection officer?
- In Germany, Section 38 BDSG generally requires one once at least 20 people regularly handle automated processing of personal data. The website alone usually doesn't trigger it.
- Is a privacy policy generator enough?
- As a basis, yes, if you feed it your actual list of services and update it after every website change. The most common problem is an outdated text, not a missing one.
- What happens if I get it wrong?
- Fines under Article 83 GDPR are possible, but for small businesses the more common risks in practice are cease-and-desist letters, complaints to the supervisory authority and damage claims under Article 82 GDPR.
Sources
Send us your website address. We list every third-party connection and show which ones need consent, a contract or a rebuild.
Check my website for GDPR