If your website runs analytics, advertising pixels, embedded videos or contact forms, and any of your visitors are in Europe, the General Data Protection Regulation (GDPR) almost certainly applies to you, even if your business is based in the US or elsewhere. Many teams only start asking "does GDPR apply to my business?" or "is my website GDPR compliant?" after a Google Ads consent warning, a customer's data access request, or a headline about another regulator's fine.
The quick fixes rarely hold up. A free cookie banner plugin that shows an "OK" button but loads trackers anyway does not meet GDPR's consent standard. Copy-pasted privacy policy templates go out of date the moment you add a new tool. Spreadsheets for consent records and data requests fall apart at the first audit, and paying outside counsel or an in-house Data Protection Officer for every question is out of reach for most small and mid-sized teams.
Secure Privacy's consent management platform brings these pieces together: it scans your site, blocks non-essential cookies until visitors opt in, and stores audit-ready consent records, while the privacy governance tools and optional DPO as a Service cover records of processing, impact assessments and data subject requests.
By the end of this guide, you will know what GDPR is, whether it applies to you, which obligations matter most for your website, and exactly which in-depth guide to read next for each GDPR compliance topic.
GDPR at a Glance
| Full name | General Data Protection Regulation, Regulation (EU) 2016/679 |
|---|---|
| Applies since | 25 May 2018 |
| Where it applies | The EU and EEA, plus organizations anywhere that offer goods or services to people in the EU or monitor their behavior |
| What it protects | Personal data of individuals (data subjects) in the EU |
| Maximum fines | Up to €20 million or 4% of worldwide annual turnover, whichever is higher |
| Breach reporting | To the supervisory authority within 72 hours of becoming aware of a breach, where feasible |
| Enforced by | National data protection authorities, coordinated by the European Data Protection Board (EDPB) |
| UK equivalent | UK GDPR and the Data Protection Act 2018 |
What Is GDPR?
The General Data Protection Regulation (GDPR) is the European Union's data privacy law that governs how organizations collect, use, store, and share the personal data of people in the EU. It sets rules for how organizations handle personal data and gives individuals more control over their information. If your business runs a website, uses cookies, or processes customer data, understanding GDPR is essential for compliance.
GDPR can apply even if your business is not based in the EU, as long as you offer goods or services to EU residents or monitor their behavior online, for example through analytics or ad tracking. For a full walkthrough of the regulation, read What Is GDPR? A Complete Guide to the EU's Data Protection Law.
Who Is This GDPR Guide For?
- Website owners and marketers who use Google Analytics, ad pixels, or other tracking tools
- SaaS, ecommerce, and B2B companies outside the EU that have European customers or visitors
- Small businesses and startups wondering whether GDPR applies to them
- Legal, privacy, and compliance teams building or reviewing a GDPR compliance program
- Agencies that manage cookie consent and privacy compliance for client websites
Why GDPR Matters for Websites and Businesses
GDPR affects how businesses manage website tracking, cookie consent, privacy notices, user rights, and data security. It is especially important for companies that collect leads, run analytics, use advertising cookies, or process customer information through forms, accounts, or online services.
- It helps protect user privacy and personal data
- It requires transparency about data collection and use
- It affects cookie banners, consent records, and privacy policies
- Non-compliance can lead to complaints, investigations, and fines
Key GDPR Compliance Topics: In-Depth Guides
Use the guides below to explore the most common GDPR questions and compliance issues. Each topic links to a detailed article on the Secure Privacy blog and, where available, to a related Help Center guide.
Why GDPR Matters
Why the regulation exists, the core principles behind every obligation, and how GDPR compares with other privacy laws.
- What is GDPR? Definition, scope, and obligations
- GDPR requirements for making your website compliant
Who GDPR Applies To
GDPR's material and territorial scope, and when it applies to EU, UK, US, and other non-EU businesses.
GDPR Fines and Penalties
The two-tier fine structure, the largest penalties issued so far, and how an enforcement case unfolds.
Personal Data Under GDPR
What counts as personal data, how it differs from PII and sensitive data, and the extra rules for special category data such as health or biometric information.
- PII vs personal data vs sensitive data: key differences and examples
- GDPR Article 9: processing special categories of personal data
International Data Transfers Outside the EU
When you can send personal data outside the EU, including adequacy decisions, standard contractual clauses, and transfer impact assessments.
- Everything you need to know about data transfers under GDPR
- How to run a transfer impact assessment
- Cross-border data transfers and your DPO
Who Enforces GDPR
How national data protection authorities and the EDPB enforce GDPR, which regulators are most active, and what they are targeting next.
- GDPR enforcement heat map: which DPAs are fining and for what
- How your DPO communicates with supervisory authorities
Data Protection Officers (DPOs)
What a Data Protection Officer does, when appointing one is mandatory, and how an outsourced DPO compares with an in-house hire.
- What is a Data Protection Officer and do you need one?
- When is appointing a DPO mandatory under GDPR?
- DPO as a Service vs an in-house DPO
GDPR for Small Businesses and Startups
GDPR has no general size-based exemption. These guides cover the narrow record-keeping relief available to smaller organizations and a realistic compliance roadmap for small teams.
- GDPR exemptions for startups: a compliance roadmap for small teams
- Privacy governance for small businesses
Data Breach Response and Notification
What counts as a personal data breach, how to report it within the 72-hour window, and how to build a breach response plan.
Cookie Consent and Lawful Basis
What your cookie banner must do to collect valid GDPR consent, and when another lawful basis such as legitimate interest applies instead.
- GDPR cookie consent: what your banner actually needs to do
- GDPR consent requirements every business needs to know
- Legitimate interest vs consent under GDPR
Data Subject Rights and Access Requests
How to verify, track, and answer data subject access requests (DSARs) and other privacy rights requests on time.
Building a GDPR Compliance Program
The core obligations, a step-by-step checklist, and the accountability documents regulators expect, such as records of processing and DPIAs.
How to Make Your Website GDPR Compliant in 6 Steps
Most website GDPR compliance work comes down to six steps. Here is the order we recommend, with the guide to read for each one.
Step 1 - Scan your website for cookies and trackers
Find every cookie, script, and third-party tag your site sets before you decide what needs consent. Run the free GDPR cookie scanner, then see how to scan your website for compliance in Secure Privacy.
Step 2 - Map your personal data and choose a lawful basis
Document what personal data you collect, why, and where it goes, then assign a lawful basis to each purpose. Start with GDPR data mapping and the DPO advisory on lawful bases for processing.
Step 3 - Block non-essential cookies until visitors consent
Under GDPR and the ePrivacy rules, analytics and marketing cookies must not load before a visitor opts in. Follow the complete guide to blocking cookies for GDPR compliance and learn which cookie categories need blocking.
Step 4 - Show a GDPR-compliant cookie banner and record consent
Give visitors an equally easy way to accept or reject, let them choose by purpose, and store proof of every choice. See what makes a cookie banner GDPR compliant, then install Secure Privacy on your CMS. If you run Google Ads, also follow the guide to installing a cookie banner that meets Google's EU User Consent Policy.
Step 5 - Update your privacy policy and enable data subject requests
Your privacy notice must explain what you collect, why, and how people can exercise their rights. Review the GDPR privacy notice requirements under Articles 12, 13, and 14, then set up a request form with the DSAR form builder.
Step 6 - Document your compliance and review it regularly
GDPR's accountability principle means you need to be able to prove compliance. Keep your Article 30 records of processing activities current and run DPIAs for high-risk processing.
What Happens After You Become GDPR Compliant
GDPR compliance is ongoing, not a one-time project. New tools, new tags, and new regulatory guidance can change what your website needs.
- Rescan your site whenever you add tools or tags, and on a regular schedule: how to perform a website rescan
- Refresh consent before it goes stale: GDPR consent renewal and expiration policies
- Build regular reviews into your routine: ongoing compliance checkup best practices
- Watch for rule changes that affect cookie consent: EU Digital Omnibus: what Article 88a changes for cookie consent
GDPR FAQ: Common Questions About GDPR Compliance
Does GDPR apply to businesses outside the EU, such as US companies?
Yes, in many cases. GDPR applies to organizations inside and outside the EU if they offer goods or services to people in the EU or monitor their behavior, for example with analytics or advertising cookies. Read who GDPR applies to for worked examples.
Does GDPR apply to small businesses?
Yes. GDPR has no revenue or headcount exemption. Organizations with fewer than 250 employees get limited relief from keeping detailed records of processing, but only when their processing is occasional, low risk, and does not involve special category or criminal conviction data. Every other obligation, including cookie consent, still applies.
What counts as personal data under GDPR?
Personal data is any information that can identify a person directly or indirectly. It includes names, email addresses, IP addresses, location data, cookie identifiers, and device IDs.
What are the penalties for GDPR non-compliance?
Fines can reach €20 million or 4% of a company's worldwide annual turnover, whichever is higher, for the most serious violations, and €10 million or 2% for others. Regulators can also order you to stop processing data. The actual amount depends on the nature, severity, and duration of the violation.
Do I need a cookie banner to be GDPR compliant?
If your website uses non-essential cookies or trackers, such as analytics or advertising tags, you need prior consent from EU visitors. The ePrivacy Directive requires that consent, and GDPR sets the standard it must meet: freely given, specific, informed, and as easy to refuse as to accept. A consent banner is the usual way to collect and record it.
Do I need to appoint a Data Protection Officer?
A DPO is mandatory if you are a public authority, if your core activities involve regular and systematic monitoring of people on a large scale, or if they involve large-scale processing of special category or criminal offence data. Many other businesses choose an outsourced DPO for expert support.
How quickly do I have to report a data breach under GDPR?
You must notify your supervisory authority within 72 hours of becoming aware of a personal data breach, unless the breach is unlikely to put people at risk. If the risk to individuals is high, you must also inform the affected people without undue delay.
Is UK GDPR the same as EU GDPR?
UK GDPR is closely based on EU GDPR but is a separate law, enforced by the UK Information Commissioner's Office and amended by UK legislation. Businesses serving both markets usually need to meet both. See the complete UK GDPR guide.
How can I make my website GDPR compliant?
Review your data collection practices, block non-essential cookies until visitors consent, use a compliant cookie consent banner, update your privacy policy, manage user consent correctly, and keep records of consent. The six steps above walk through each one.
What should I look for in GDPR compliance software?
Look for automatic cookie scanning and prior blocking, a banner that offers reject as easily as accept, stored consent records, Google Consent Mode and IAB TCF support, and tools for DSARs and records of processing. Our GDPR software comparison reviews the leading options.