Why GDPR applies to a small website
The General Data Protection Regulation covers personal data: anything that identifies a person, such as a name, email address or phone number. As soon as someone fills in your enquiry form, you are handling personal data. Size does not change that, although the practical work for a small site is usually modest.
This is general information, not legal advice.
1. Know what data your site collects
Write a short list. For each item, note where it comes from, why you need it and where it ends up.
- Contact and quote forms.
- Booking forms.
- Newsletter sign-ups.
- Any analytics or tracking tools.
- Server logs kept by your hosting provider.
Once you see the list, ask whether you need every field. Collecting less is the easiest way to reduce risk.
2. Have a lawful basis for each use
GDPR requires a lawful basis for processing personal data. For a contact form, the usual basis is that the person asked you to respond, for example taking steps before a contract, or your legitimate interest in answering enquiries. For marketing emails, you will usually need consent. Write down which basis you rely on for each use.
3. Publish a clear privacy notice
Your privacy notice should explain, in plain language:
- Who you are and how to contact you.
- What data each form collects and why.
- Your lawful basis for each use.
- How long you keep the data.
- Who else receives it, such as your hosting or email provider.
- Whether data leaves the EU and, if so, how it is protected.
- The person's rights and how to use them.
- Their right to complain to the data protection authority.
Link to the notice from the footer of every page and near every form.
4. Make forms honest
- Do not pre-tick consent boxes for marketing.
- Keep marketing consent separate from sending an enquiry.
- Explain briefly next to the form how you will use the details.
- Do not ask for sensitive information, such as health details, unless you truly need it and have thought through the extra care it requires.
- Make sure form notifications go to an inbox someone actually reads and that only the right people can access.
5. Be ready for access and deletion requests
People can ask what data you hold about them and ask you to delete it. You need to honour these requests, usually within a month. That is much easier if enquiries live in one organised place rather than scattered across inboxes, phones and spreadsheets. Decide now who handles requests and how you will find everything about one person.
6. Keep data secure
- Make sure your site runs on https so form data is encrypted in transit.
- Use strong, unique passwords and two-step login where available.
- Limit who has access to enquiry data.
- Delete old enquiries you no longer need, in line with your retention period.
7. Check your suppliers
Your website host, email provider and any form or booking tool process personal data on your behalf. Check that they offer a data processing agreement, and where they store data. Keeping things in the EU usually makes this simpler.
8. Sort out cookies and tracking
Cookie consent comes from the ePrivacy rules rather than GDPR, but the two overlap. Non-essential cookies and trackers need consent first. Strictly necessary cookies do not. See our guide to whether you need a cookie banner.
9. Review it once a year
Forms change, tools get added and staff move on. Put a yearly reminder in the diary to recheck this list and update your privacy notice. If you are rebuilding your site at the same time, our guide to the European Accessibility Act is worth reading too.
A builder that keeps this simple
Sites made with our builder are hosted in the EU and do no visitor tracking, so no cookie banner is needed. One button adds privacy and terms pages if they are missing, and publishing is blocked until the site passes its checks. Every form enquiry becomes a client record with a person assigned, which makes access and deletion requests easier to handle. It costs €29.95 a month, cancel any month. Start building or ask us a question.
Frequently asked
Does GDPR apply if I only have a contact form?
Yes. A contact form collects names and contact details, which are personal data, so you need a privacy notice and a lawful basis for using them.
Do I need consent to reply to an enquiry?
Usually not. When someone asks you to get back to them, replying is normally covered by another lawful basis, but sending them marketing later generally needs consent.
How long can I keep enquiry data?
Only as long as you need it for the purpose you collected it for. Set a sensible retention period, write it in your privacy notice and delete old enquiries regularly.
Read next
Online tonight.
Ten minutes of questions, an hour of polishing, and you are live on your own domain.
Start building