GDPR Website Compliance Checklist 2026

The General Data Protection Regulation (GDPR) continues to be the gold standard for data privacy legislation. Even in 2026, many websites still fail basic compliance requirements—exposing them to fines up to €20 million or 4% of global annual revenue (whichever is higher).

This checklist covers the 12 key areas of GDPR compliance for websites. Use it to audit your website, identify gaps, and build a compliance roadmap.

A few numbers are worth holding on to before the list starts. The GDPR is Regulation (EU) 2016/679; it entered into force in 2016 and has applied across the EU since 25 May 2018, replacing the 1995 Data Protection Directive. Article 83(5) sets the upper fine band at €20 million or 4% of worldwide annual turnover for breaches of the basic principles, and Article 83(4) sets the lower band at €10 million or 2%. Article 33(1) allows 72 hours to notify a personal data breach, and Article 12(3) allows one month to answer an access request. Germany layers its own BDSG, recast in 2018, on top. Beside the GDPR sit the ePrivacy Directive 2002/58/EC for cookies, NIS2 — Directive (EU) 2022/2555, with transposition due by 17 October 2024 — for essential and important entities, and the EU AI Act, Regulation (EU) 2024/1689, which reaches €35 million or 7% of worldwide annual turnover under Article 99(3).

1. Data Inventory & Mapping (Data Processing Register)

You cannot protect data you don't know you have. GDPR requires a documented Records of Processing Activities (RoPA).

Document all data sources

List every place where personal data is collected: forms, cookies, API endpoints, third-party services, analytics, etc.

Map data flows

Track where data goes after collection. Which databases? Which third parties? Which countries? How long is it retained?

Identify the legal basis

Every data collection needs a legal basis: Consent, Contract, Legal obligation, Vital interests, Public task, or Legitimate interest

Scan your website for exposed data

Use piisafe.eu to audit what personal information is actually publicly visible on your site

2. Privacy Policy & Transparency

Your privacy policy must be clear, specific, and in plain language. It must tell users exactly what you collect and why.

Publish a comprehensive privacy policy

Include: identity of controller, purposes, legal basis, recipient categories, retention periods, user rights, complaint procedures

Make it easily accessible

Link from homepage, footer, and before any form. Avoid burying it 5 clicks deep

Cover all processing activities

Don't just mention forms. Address analytics, cookies, retargeting, email marketing, API integrations, CDNs, payment processors

Update annually

Technology and services change. Review and update at least once per year or when you add new processing

For non-essential processing, consent is required. It must be freely given, specific, informed, and unambiguous.

Implement a consent banner

Before any cookies, tracking, or analytics—ask for consent. "Accept all" must not be pre-selected

Differentiate consent types

Essential (always allowed), Functional, Analytics, Marketing. Users must be able to refuse non-essential without penalty

Store consent records

Log when, how, and which consents users gave. Retain records for audit purposes

Allow easy withdrawal

Users must be able to withdraw consent as easily as they gave it. Provide a link to consent settings in footer

4. Data Subject Access Rights

Users have 8 core rights under GDPR. You must have processes to handle requests within 30 days.

Right of Access (Article 15)

Provide a process for users to request and download all their personal data in a machine-readable format (CSV, JSON)

Right to Rectification (Article 16)

Allow users to correct inaccurate or incomplete data directly via their account

Right to Erasure (Article 17)

Provide a "Delete my account" feature that removes personal data from all systems (with legal exceptions)

Right to Restrict Processing (Article 18)

Allow users to temporarily stop certain processing while disputes are resolved

Right to Data Portability (Article 20)

Provide a data export in a standard format so users can switch services

Right to Object (Article 21)

Allow users to opt-out of marketing emails, profiling, and automated decision-making

Rights Related to Automated Processing (Article 22)

If you use algorithms for decisions (credit scoring, profiling, automated rejection), users have a right to human review

Track and respond to requests

Set up a system to log all requests and respond within 30 days. Document your compliance

5. Data Retention & Deletion

You cannot keep data forever. GDPR requires that personal data is "kept in a form which permits identification of data subjects for no longer than necessary."

Define retention periods for each data type

Form data: 1 year? Customer records: 3 years? Marketing lists: Until unsubscribe + 1 year? Document the business reason

Implement automated deletion

Don't rely on manual cleanup. Use database jobs to automatically delete expired data

Address backup & archive retention

Data in backups and archives is still personal data. You need a retention schedule for those too

6. Data Protection Impact Assessment (DPIA)

For high-risk processing, you must conduct a DPIA. This includes large-scale processing, monitoring, automated decision-making, or use of new technologies.

Identify high-risk processing activities

AI/ML models? Behavioral tracking? Cross-border transfers? Automated decisions? You likely need a DPIA

Document the assessment

Describe purposes, necessity, risks (to individuals and organization), safeguards, and mitigation measures

Consult with regulators if needed

If risks cannot be adequately mitigated, consult your local DPA before starting the processing

7. Third-Party Data Processors

If you use services that access personal data (hosting, analytics, CRM, payment processor), you need a Data Processing Agreement (DPA).

Create a vendor list

Document every vendor that touches personal data: hosting, analytics, email, payment, CDN, etc.

Verify DPAs are in place

Each processor must have a DPA that covers their processing activities for your use case

Verify data location & adequacy

Is data processed in the EU (always safe) or transferred to third countries? USA requires SCCs. Other countries need adequacy decisions

Audit vendor security

Request SOC 2 reports, security certifications, or conduct security assessments of critical vendors

8. International Data Transfers

Transferring data outside the EU/EEA requires a legal mechanism. This is complex and changes frequently.

Map international transfers

Which services send data to the US? China? Singapore? Document every country where personal data flows

Use Standard Contractual Clauses (SCCs) or Binding Corporate Rules

For transfers to inadequate countries, use EU-approved mechanisms. Update SCCs to the 2021 version

Check local law for adequacy

Some countries (US, India, etc.) have national security laws that might override data protection. Consider risks

9. Data Breach Response & Notification

If you experience a data breach, you have specific obligations. Delays or failures here can result in massive fines.

Have an incident response plan

Document steps: detect, contain, assess, notify, remediate. Who does what? What are timelines?

Notify the regulator within 72 hours

After discovering a breach, notify your DPA within 72 hours (unless the breach poses no risk to individuals)

Notify affected individuals without undue delay

If high risk to individuals, notify them directly before or with regulator notification. Document who was notified

Document everything

Keep records of the breach, impact assessment, actions taken, and notifications. This is your proof of compliance

10. Data Protection Officer & Governance

Depending on your organization, you may need a Data Protection Officer (DPO). You always need someone responsible for GDPR compliance.

Determine if you need a DPO

Required if you: are a public authority, monitor people at scale, or process sensitive data at scale. Optional otherwise but recommended

Assign a GDPR lead

Someone must own compliance. Give them authority and budget to implement safeguards

Train staff on GDPR

Annual training for anyone handling personal data. Contractors and vendors too

11. Security & Encryption

GDPR requires "appropriate technical and organizational measures" to protect personal data. This means encryption, access controls, and regular security audits.

Encrypt data in transit (TLS)

All data transmission must use HTTPS/TLS. No plain HTTP for any page handling personal data

Encrypt sensitive data at rest

Password hashes (bcrypt, argon2), encryption keys, health data, financial records should be encrypted in databases

Implement access controls

Only authorized staff can access personal data. Use role-based access, strong authentication, audit logs

Regular security testing

Annual penetration tests, vulnerability scans, code reviews. Document findings and remediation

Disable unnecessary services

Turn off features you don't use (SSH, admin panels, debug modes) to reduce attack surface

12. Regular Compliance Audits

GDPR compliance is not a one-time project. It requires ongoing monitoring and improvement.

Annual compliance review

Audit all 11 areas above once per year. Document findings and remediation plans

Scan your website for exposed PII

Use piisafe.eu quarterly to verify no personal information is accidentally exposed publicly

Monitor regulatory changes

GDPR enforcement evolves. Follow updates from your national DPA and EDPB guidance

Maintain compliance documentation

Keep all records: RoPA, DPAs, DPIAs, breach records, consent logs, staff training. This is your defense if audited

Pro Tip: Use this checklist to generate a compliance roadmap. Prioritize high-risk items (data access requests, breach response, consent management). Allocate 1-3 months to implement basic compliance. Then continuously improve based on your audit results.

Where This Checklist Stops

A checklist is a prompt, not a legal opinion. These are its limitations, stated plainly, so you know what it does not cover.

It is not legal advice. Article 39(1)(a) GDPR places the duty to advise on your data protection officer, not on a web page. Ask a qualified adviser before you rely on any item here.
It is not a substitute for the text. Regulation (EU) 2016/679 runs to 99 articles and 173 recitals, and national laws add more on top — the German BDSG, for example. Twelve headings cannot stand in for that.
A scanner finds exposure, not lawfulness. Automated scanning shows which personal data a page publishes. It cannot tell you whether Article 6(1) GDPR gave you a lawful basis to process that data in the first place.
Regulated sectors need more. Essential and important entities also fall under NIS2, Directive (EU) 2022/2555. Providers and deployers of AI systems also fall under the EU AI Act, Regulation (EU) 2024/1689, which entered into force in 2024. Neither is covered above.
Scan scope is bounded. One piisafe.eu scan covers at most 1,000 pages, and you may start 20 scans per hour from one IP address. A large estate needs several runs and a plan for stitching the results together.

Key Takeaways

GDPR applies if you process data of EU residents, regardless of where you're located
You need documented proof of compliance (privacy policy, DPA, DPIA, RoPA, breach logs)
Consent must be explicit, informed, and easy to withdraw
Users have strong rights: access, correction, deletion, portability, and objection
Breaches must be reported to regulators within 72 hours
Data cannot be kept longer than necessary
Regular audits (including PII scanning) are essential to stay compliant

GDPR compliance requires effort, but it's not impossible. Start with this checklist, prioritize high-risk items, and build a compliance culture in your organization. Your users—and regulators—will appreciate it.