GDPR compliance checklist for your website: 15 things a visitor can see

A GDPR compliance checklist for a website is shorter than the ones you’ve seen. Most checklists cover the whole organisation: a register of processing, a data protection officer, impact assessments, staff training. Those matter. None of them show on your site.

This one covers the part a visitor’s browser can see. Fifteen items in five groups: cookies and consent, the privacy notice, rights routes, transfers, and trader details. It’s the list a regulator can read without asking you a single question, and the list a complaint usually starts from.

Each item links to the post that covers it in depth, and to the Handbook article that has the rule itself.

Does GDPR apply to your website?

Probably, if anyone in the EU uses it. Article 3(1) covers a company with an office in the EU, wherever the data ends up. Article 3(2) covers a company with no EU office when it offers goods or services to people in the EU, paid or free, or monitors their behaviour there. Analytics on an EU visitor is monitoring.

The second half of the question is what counts as personal data. Article 4(1) says it’s any information relating to an identified or identifiable natural person. An IP address, a cookie ID and an email address all fit. The personal data examples post has the long version.

If both halves are true for you, the fifteen items below apply.

Cookies and consent: four items

Consent is the group most people think is the whole law. It’s four items out of fifteen.

1. Nothing non-essential loads before a yes: Analytics, advertising and session replay wait until the visitor accepts. The rule is Article 5(3) of the ePrivacy Directive, covered in EU-01. The European Data Protection Board says scrolling or swiping will not under any circumstances count as a clear affirmative action, and that pre-ticked boxes are invalid.
2. Reject is as easy as accept: Article 7(3) says it shall be as easy to withdraw as to give consent. A Reject button on the second screen doesn’t match an Accept button on the first. The same EDPB guidelines say a cookie wall, where content is held back until you accept, isn’t freely given consent.
3. Reject actually stops the tracking: The CNIL’s SHEIN decision in September 2025 found advertising cookies placed before the banner was touched, and new cookies placed after Refuse all. The fine was €150 million.
4. The cookie policy matches the cookies: Every cookie the page sets has a line in the policy with its purpose and lifetime. The cookie policy template post shows the shape, and types of website cookies sorts them.

Smaller sites get the same findings. The Romanian authority’s Urban Home Development decision of 27 May 2024 found cookies that weren’t technically necessary installed before consent, and a fine of 10,000 lei.

The privacy notice: five items

Article 13 lists what a notice has to say when you collect data from the person. The wiki article EU-08 goes through all twelve items. These are the five that show up most in findings.

5. The notice is findable: A link from every public page, usually in the footer, that opens. EU-09 is the check. Article 12(1) asks for information in a concise, transparent, intelligible and easily accessible form.
6. It says who you are: Article 13(1)(a) asks for the identity and the contact details of the controller. In the Urban Home Development case, the website didn’t name the operator at all, and the authority issued a warning for that alongside the cookie fine.
7. Each purpose has a legal basis: Article 13(1)(c) asks for the purposes and the legal basis. Article 6(1) gives six bases: consent, contract, legal obligation, vital interests, public task and legitimate interests. One block that lists all six against all purposes doesn’t say which is which.
8. The recipients are named: Article 13(1)(e) asks for the recipients or categories of recipients. If your page loads a payment provider, an email tool and an analytics script, they belong here. EU-04 compares the list with what the page loads.
9. Retention, rights and the right to complain: Article 13(2) adds how long you keep data, the rights to access, rectification, erasure and the rest, the right to withdraw consent, and the right to lodge a complaint with a supervisory authority.

The Italian Garante’s Confalonieri decision in 2025 shows what happens when a notice ages. The company’s notice referred to rules no longer in force, and the outcome was a warning and an order to comply, with no fine.

The privacy policy example post has a notice built from these items.

Rights routes: three items

A notice can list every right and still fail here, because the rights only work if the route does.

10. A described way to ask for your data or delete it: Article 15 gives the right to a copy of the personal data undergoing processing. Article 17 gives the right to erasure on listed grounds, including when consent is withdrawn and nothing else justifies keeping the data. The notice says how to ask. The what is a DSAR and right to be forgotten posts cover each request end to end.
11. The route opens and someone reads it: The EDPB’s access guidelines say there are no specific requirements on the format of a request, and that a request sent through any channel the company offers counts. An email address that bounces is the finding in EU-07.
12. One month, free: Article 12(3) sets one month, extendable by two for complex requests if you say so in time. Article 12(5) says free of charge, unless a request is manifestly unfounded or excessive.

The Garante’s Noi Compriamo Auto decision shows how item 11 goes wrong. A person wrote to the data protection officer’s address and two others, and the spam filter blocked all three. The fine, which also covered promotional emails, was €45,000.

One thing neither I nor this list can tell you is whether anyone reads the inbox. A bounce shows up in a scan. A message that lands and sits for six weeks doesn’t.

Transfers and trader details: three items

The last group is the one most website checklists skip.

13. Transfers outside the EU are named, with their basis: Article 13(1)(f) asks the notice to say when data goes to a third country and what safeguards apply. Article 44 says a transfer may happen only if the conditions of Chapter V are met. For most small companies the basis is one of two: the Commission’s standard data protection clauses under Article 46(2)(c), or the EU-US Data Privacy Framework, whose adequacy decision the Commission adopted on 10 July 2023 for US companies that participate. EU-06 has the detail.
14. The company behind the site is named, with an address and an email: In Germany, § 5 of the Digitale-Dienste-Gesetz asks for the provider’s name and address and a way to reach it quickly by email, kept easily recognisable, directly reachable and permanently available. That list comes from an EU directive, so the other member states ask for much the same. EU-14 has the directive and the national versions.
15. The register and VAT details are there too: The same German section lists the commercial register and number, and the VAT identification number where the company has one. A footer line does it.

Item 14 overlaps with item 6 on purpose. The notice names the controller; the imprint names the trader. On a small company site they’re the same entity, and a visitor should find the name in both places.

Check your own site in ten minutes

You can do all of this on a phone. No tool, no login. If you’re skimming, steps 1, 3 and 9 are the ones that bite.

1. Open your homepage in a private window and don’t touch the banner. Tap the padlock or the site settings icon; Chrome shows a cookie count there. Anything beyond a session or basket cookie is item 1.
2. Look at the banner. Is Reject on the same screen as Accept, the same size? That’s item 2.
3. Tap Reject, reload, and count again. If the number went up, that’s item 3.
4. Scroll to the footer. Tap the privacy link. Note whether it opens, and the date at the top. Items 5 and 9.
5. Read the first screen of the notice. Does it name a company and give an address or email? Item 6 and item 14.
6. Search the notice for the word “basis”. If it appears once, in a list of all six, that’s item 7.
7. Search for the name of your analytics tool and your email tool. If they aren’t there, that’s item 8.
8. Search for “transfer” or “United States”. Item 13.
9. Find the sentence that says how to ask for your data. Send a one-line test email to that address from a personal account. Wait a day. Item 11.
10. Check the footer for a register number or VAT number. Item 15.

Write the date next to each answer. Next quarter, do it again. The items that change on their own are 1, 3 and 8, because a plugin update or a new marketing tool adds a request without telling anyone.

Peeky reads the public pages of your site. For the fifteen items above, the checks are EU-01 for trackers before consent, EU-08 for the privacy notice, and EU-07 for the rights route in the Handbook. The US side of the same list is the CCPA compliance checklist.

Questions people ask

Does GDPR apply to US companies?

It can. Article 3(2) says the GDPR reaches a company with no EU office when it offers goods or services to people in the EU, paid or free, or monitors their behaviour there. A US shop that ships to Germany, or runs ads aimed at French visitors, is usually in.

How do you prove GDPR compliance?

For the website part, the proof is what the page does. A clean browser shows what loads before consent, the notice shows the Article 13 items, and the rights address shows whether it works. Article 7(1) asks a company to be able to demonstrate that the person consented, so keep a dated record of each check.

What is a GDPR audit?

Inside a company, it's a review of records, contracts and processes. On the website it's narrower: compare what the site does with what it says. This checklist is the website part. It doesn't cover the register of processing, a data protection officer or an impact assessment.

Is a cookie banner enough for GDPR compliance?

No. Consent is four of the fifteen items here. The notice, the rights route, transfers and trader details each have their own rule and their own cases. The Romanian authority's Urban Home Development decision covered early cookies and a missing operator name in the same visit.

How long do I have to answer a data request?

One month, under Article 12(3), and you can add two more for complex requests if you say so within the first month. Article 12(5) says the answer is free of charge unless a request is manifestly unfounded or excessive.