Two extremes exist around GDPR at most SMEs: one is ignoring it entirely because "this only applies to big companies" — that's not true, and it can carry a serious fine. The other is over-engineering it, plastering everything with cookie-consent pop-ups and unnecessary legal text, ruining the user experience without providing real protection. The reality sits between the two: a handful of concrete, easy-to-understand rules that need to be built into your website properly once, and after that you don't need to think about them anymore — just maintain them.

What you actually need to know about data protection

Your website collects data at every point a visitor interacts with it — filling out a form, signing up for a newsletter, or simply by visiting, through cookies. GDPR's basic principle is simple: only collect data you actually need, only keep it as long as justified, and always be clear about what you'll use it for. This isn't a legal abstraction — concretely, it means a contact form shouldn't ask for data you don't need to answer the inquiry, and you shouldn't keep incoming data for years "in case it comes in handy someday."

The other important principle is transparency: you need to tell the visitor, clearly and in plain language — not legal jargon — what data you collect, why, and for how long you keep it. That's the role of the privacy notice, and it shouldn't need to be long and complicated to protect better — it protects better by actually being read and understood.

Handling cookies — without ruining the user experience

The cookie-consent banner is the most commonly mishandled element of websites. The core rule is that you can only run non-essential cookies — analytics, ad tracking — once the visitor has explicitly consented, before they start running. That means the analytics script can't fire before consent "just to have some data" — that's exactly the practice that most often causes problems during an audit.

The right solution isn't technically complicated either: the cookie management system blocks non-essential scripts by default, and only releases them after the visitor's explicit choice — while necessary, technical cookies (without which the site couldn't even function, for example to keep a login session) can run without consent. If the visitor can change their decision at any time — not just on their first visit, but later too, from a clearly visible place — that's a sign the system genuinely respects the user's choice, not just checking a mandatory box.

What's easy to get wrong, and what's worth keeping tidy

The most common mistake we see isn't malice, it's carelessness: an old form that's still collecting data no one has needed for years; a third-party widget (chat, map, video) that fires before consent because no one noticed; or a privacy notice still describing old services from before the business expanded.

GDPR compliance isn't a one-time task you "handle and forget" — it's a maintained state, worth reviewing at least once a year as your website and your services change.

If you're starting a website build or redesign, that's the cheapest moment to build these rules in properly — minimal data collection, an understandable notice, correctly functioning cookie handling. Doing the same thing afterward, on an already-live site with many forms and integrations, is a lot more work, and the risk runs every single day in the meantime.

If you'd like to know where you currently stand on these rules, request a quick audit — we'll tell you what's genuinely worth fixing, and what's already in good shape.