The General Data Protection Regulation applies to personal data of people in the EU, whatever the size of the business. Personal data is anything that identifies a person: a name, an email address, an IP address in many cases. For a typical business site that means contact forms, bookings, newsletters, accounts, analytics and advertising scripts.
The practical questions to answer
- What do you collect? List every form, every script, every tool that sees visitor data.
- Why, and on what basis? Each purpose needs a lawful basis, such as a contract, a legal obligation, legitimate interest or consent. Consent has strict conditions.
- Who else receives it? Hosting, email services, analytics and payment providers are processors; you need to know who they are and where they process data.
- How long do you keep it? Decide, and delete accordingly.
- How do people exercise their rights? Access, correction, deletion and so on. Give an address and answer within the time the law sets.
- Have you said all this clearly? A privacy notice written for visitors, not lawyers.
Cookies and trackers
Strictly necessary cookies are treated differently from analytics and advertising ones, which usually require consent beforehand. The simplest way to avoid a complicated banner is to not use trackers you do not need.
Where I stop
The rules vary by country and situation, and I am a developer, not a lawyer. I can build sites that collect little and say so honestly, and I can set up the technical side; for legal wording specific to your business, check with someone qualified. The regulation itself is linked below, and this site’s own privacy policy is an example of stating plainly what is processed.