GDPR Compliance Checklist for Small Businesses and Websites

Overview

GDPR compliance is not limited to adding a privacy policy to a website. It involves understanding your data flows, choosing and documenting an appropriate lawful basis, giving people clear information, limiting access, managing suppliers, and responding properly when individuals exercise their rights or something goes wrong.

A small business may process personal data through a website form, customer account, booking system, email platform, payment provider, analytics service, recruitment process, or internal spreadsheet. Each activity can create separate privacy responsibilities. The goal of this checklist is to connect those activities to identifiable owners, documented decisions, and repeatable controls.

Start by creating a simple compliance record with these fields:

• What data is collected or accessed?
• Whose data is involved?
• Why is it needed?
• What lawful basis is being relied on?
• Where is the data stored and who receives it?
• How long should it be retained?
• Who owns the process and when will it be reviewed?

Keep the record proportionate. A clear spreadsheet or privacy management tool may be enough for a small operation, provided it is accurate and maintained.

Checklist by scenario

1. Before collecting personal data

• Map the activity: Identify every form, account, list, database, device, and manual process that handles personal data.
• Define the purpose: State what the data is needed for in specific terms. “Business purposes” is usually too vague to guide retention, access, or notice decisions.
• Minimize the fields: Remove information that is convenient but not necessary for the stated purpose.
• Choose a lawful basis: Consider the relevant basis for each purpose rather than selecting one basis for the entire business. If relying on consent, make sure it is informed, specific, freely given, and capable of being withdrawn.
• Check sensitive data: If the process involves health information, biometric data, precise location, information about children, or other sensitive categories, identify any additional conditions and safeguards that may apply.
• Prepare the notice: Explain who collects the data, why it is used, what categories are involved, who receives it, retention practices, individual rights, and how to make contact.

2. For a marketing website

• Inventory cookies and similar technologies: Record what each tool does, what information it collects, its provider, and whether it is essential or optional.
• Separate optional tracking: Do not treat analytics, advertising, personalization, or social media tools as automatically necessary just because they are installed through a website platform.
• Use a meaningful consent flow: Give visitors a clear choice where consent is required, avoid preselected optional choices, and make withdrawal reasonably accessible.
• Check tags and scripts: Confirm that optional tools do not load before the relevant choice is recorded, and retest after theme, plugin, code, or analytics changes.
• Link the privacy notice: Make it easy to find from forms, account creation pages, checkout, and other points where information is collected.
• Review web policies together: A privacy notice explains data practices; terms and conditions, a website disclaimer, refund terms, or an earnings disclaimer serve different purposes. Use the appropriate page for each issue. See the Website Disclaimer Guide for a related website policy review.

3. When using vendors and processors

• List every provider: Include hosting, email, customer relationship management, payroll, support, forms, cloud storage, payment, scheduling, analytics, and backup services.
• Clarify roles: Determine whether the provider acts on your instructions, makes its own decisions about the data, or participates in a shared decision. The contract and actual operation should match.
• Review the data processing terms: Check instructions, confidentiality, security, subprocessors, assistance with rights requests, breach notification, deletion or return of data, and audit or assurance provisions.
• Check locations and transfers: Record where data may be accessed or stored and identify the safeguards used for transfers outside the relevant legal framework.
• Limit access: Give vendors and staff only the access required for their role, and remove access when the relationship or role changes.

4. For data subject requests

• Create one intake route: Tell people how to contact you about access, correction, deletion, objection, restriction, portability, or other applicable rights.
• Train the first recipient: A request may arrive through customer support, social media, or an ordinary email rather than a form labelled “privacy request.”
• Verify proportionately: Confirm identity when necessary, but do not collect more information than needed to do so.
• Search consistently: Check relevant systems, inboxes, shared drives, backups, customer records, and supplier-held data according to your documented process.
• Record the outcome: Note the request, dates, searches, decision, response, and any permitted reason for refusing or limiting an action.

5. For security incidents and breaches

• Define an escalation route: Staff should know who to contact if an email is sent to the wrong person, an account is compromised, a device is lost, or data is exposed.
• Contain the incident: Preserve relevant information, restrict access, reset credentials where appropriate, and prevent further disclosure.
• Assess the risk: Consider the type and amount of data, affected individuals, likely consequences, and the safeguards already in place.
• Document the decision: Record the facts, risk assessment, actions taken, communications, and reasons for any notification decision.
• Test the plan: A short tabletop exercise can reveal missing contacts, unclear authority, or inaccessible backups before a real incident occurs.

What to double-check

Before marking a GDPR compliance checklist complete, compare the documents with the way the business actually operates. Confirm that:

• The privacy notice matches current forms, tools, purposes, recipients, and retention practices.
• Consent records show what was presented, when the choice was made, and what the person selected.
• Optional cookies and scripts behave consistently across browsers, devices, logged-in areas, and checkout pages.
• Supplier contracts cover the data and services currently in use, including changes introduced by integrations or subcontractors.
• Former staff, contractors, and vendors no longer have unnecessary access.
• Retention rules are practical: someone knows when records should be reviewed, archived, anonymized, or deleted.
• Deletion processes account for copies in exports, shared folders, support tools, and routine backups.
• Marketing preferences are synchronized across mailing lists, customer records, and campaign platforms.
• Any high-risk or unusual processing has received a more careful assessment before launch.

Do not rely on a privacy policy checker alone. Automated tools can help identify visible page issues, cookies, or missing links, but they may not understand your lawful bases, internal access controls, supplier responsibilities, retention decisions, or actual data flows.

Common mistakes

• Copying a generic privacy notice: A document that names tools or purposes the business does not use can be misleading, while omitting a real process creates a gap.
• Using consent for everything: Consent is not a universal replacement for analyzing the appropriate lawful basis, and it creates obligations around recording and withdrawal.
• Installing tools before reviewing them: A new chat widget, advertising pixel, form plugin, or AI feature can change data collection and sharing without an obvious redesign.
• Confusing security with compliance: Passwords and encryption are important, but they do not replace transparency, minimization, retention, rights procedures, or supplier management.
• Ignoring offline records: Printed forms, call notes, spreadsheets, paper files, and employee records can be part of the privacy review.
• Failing to assign ownership: A checklist without a named owner and review date becomes an archive rather than a control.
• Deleting without considering other duties: Retention decisions may need to account for accounting, employment, contractual, regulatory, or dispute-related requirements. Document the reasoning instead of applying one blanket period.

When to revisit this checklist

Review the checklist on a recurring schedule and whenever the underlying inputs change. A practical small-business rhythm is to perform a short operational check monthly or quarterly, with a deeper review at least annually where appropriate. The right frequency depends on the volume, sensitivity, and complexity of the data involved.

Revisit it before launching a website, product, newsletter, loyalty program, hiring campaign, customer portal, or automated decision process. Review it after changing a hosting provider, analytics setup, payment system, email platform, form tool, cookie banner, or customer support workflow. It should also be reopened after a security incident, a material complaint, a data subject request that exposed a process weakness, or a change in the locations where data is accessed.

For a practical next step, schedule a 60-minute review and assign one owner to each item: data map, lawful-basis record, privacy notice, cookie inventory, supplier list, request procedure, incident plan, and retention schedule. Mark each item as complete, needs evidence, or needs a decision. Record the next review date and keep a change log. This turns a one-time GDPR compliance checklist into a maintainable data protection process.