Privacy law for your website: what a small business actually needs
Any site with a contact form is processing personal data. The steps that genuinely matter, without going overboard.
This article isn't legal advice; it explains common situations in plain language. As your activity grows, consulting a lawyer is worthwhile.
Does your site process personal data?
Very likely yes. If you have any of these, you do:
- A contact form (name, email)
- Newsletter signup
- A comments section
- Visitor analytics (Google Analytics and similar)
- Accounts or an ordering system
The steps that genuinely matter
1. A privacy notice. State what data you collect, why, for how long, and who you share it with. In plain language. Rather than downloading a template and filling in blanks, describe what your site actually does — listing data you don't collect is as problematic as omitting data you do.
2. Consent on the form. Under the contact form, include a sentence saying what submitting means, and link to the privacy page.
3. Cookie information. If you only use strictly necessary cookies (a language preference, for instance) you don't need consent; information is enough. If you use analytics or advertising cookies, you must obtain consent before using them.
4. A retention period. "We keep it indefinitely" isn't an acceptable answer. Set a reasonable period for contact messages and delete them at the end of it.
5. A way to make a request. People have the right to access, correct and delete their data. Publish an email address for such requests and respond within 30 days.
Common mistakes
Copied text. Copying another site's privacy policy makes you declare practices your site doesn't have. That's riskier than having no text at all.
Pre-ticked consent boxes. These don't count as valid consent; the user has to tick it themselves.
Running analytics without consent. This is the most widespread gap. Either set up a consent mechanism or drop analytics.
The simplest valid setup
For a small brochure site, this is enough:
- Contact form + privacy notice + privacy page
- Cookies only for language and theme preference (no consent needed)
- No analytics
This arrangement is both the cleanest legally and the easiest to build. When you genuinely need visitor statistics, you add the consent mechanism then.
- #privacy
- #gdpr
- #legal
