8 min
GDPR for Websites
Privacy policy, cookie banner, and compliance.
GDPR (General Data Protection Regulation) applies to any website that processes personal data of UK or EU residents — the UK GDPR and the EU GDPR set out almost identical obligations. If your site has a contact form, newsletter signup, or webshop, GDPR compliance is mandatory. This guide covers everything you need: privacy policy, cookie banner, SSL, consent management, and avoiding fines of up to £17.5 million (UK) or €20 million (EU).
GDPR for Websites
Create a privacy policy
A privacy policy is mandatory and must clearly state: who processes the data, what data is collected and why, legal basis, retention period, who the data is shared with, user rights and contact info. Use generators like PrivacyPolicies.com as a starting point and adapt to your site.
Add a cookie banner
If you use Google Analytics, Facebook Pixel, YouTube embeds or any marketing/analytics tool, a cookie banner with granular consent options is mandatory. WordPress plugins: Cookie Notice, CookieYes, Complianz. Banner must show before any non-essential cookie is set.
Install an SSL certificate
GDPR requires "appropriate technical measures" to protect personal data. SSL/HTTPS is a baseline. BeoHosting includes free Let's Encrypt SSL on every package — enable AutoSSL in cPanel and force HTTPS via .htaccess.
Add consent checkboxes to forms
Every form that collects personal data (contact, newsletter, registration) must have an explicit opt-in checkbox (not pre-ticked) with a clear link to the privacy policy. Save the consent timestamp with each submission for audit purposes.
Define data retention and user rights
Store personal data only as long as necessary. Document retention periods. Implement user rights: access, rectification, erasure, portability and objection. Provide a clear contact channel for data subject requests (e.g. privacy@yourcompany.com).
Sign a Data Processing Agreement (DPA)
You must have a DPA with every processor that handles personal data on your behalf — hosting provider, email provider, analytics, CRM, payment gateway. BeoHosting offers a DPA on request.
Ready to launch your website?
Join 4,000+ satisfied customers. Free migration and 30-day money-back guarantee.
FAQ
Answers to the most common questions about our services.
Call us: support works 24/7, by phone and through tickets.
(+381) 60 3535 720Does GDPR apply to my website?
GDPR applies if your site processes personal data of people in the UK (UK GDPR) or the EU/EEA (EU GDPR) — whether they are visitors or customers. In practice, almost every website with a contact form, newsletter signup, analytics or a webshop processes personal data and must comply. The two regimes are largely aligned, so the same privacy policy, cookie banner and consent setup covers both.
What are the penalties for non-compliance with GDPR?
Under the UK GDPR, the ICO can impose fines of up to £17.5 million or 4% of annual global turnover (whichever is higher). Under the EU GDPR, fines can reach €20 million or 4% of annual turnover (whichever is higher). Beyond fines, non-compliance damages reputation and user trust.
Do I need a cookie banner if I only use essential cookies?
Strictly speaking, if you use only essential cookies (session, login, cart), you do not need a consent banner. However, if you use Google Analytics, Facebook Pixel, YouTube embeds or any marketing/analytics tool, you are required to have a cookie banner with granular consent options.
How do I create a privacy policy?
You can use free generators (e.g. PrivacyPolicies.com, Termly.io) as a starting point, but adapt it to your site. The policy must be in plain language and include: who processes the data, what data is collected and why, legal basis, retention period, sharing, user rights and contact. For complex cases, consult an IT lawyer.
Does BeoHosting help with GDPR compliance?
BeoHosting provides the technical infrastructure for compliance: free SSL for data encryption, servers with security measures (firewall, DDoS protection, backup), and the ability to install cookie consent plugins for WordPress. BeoHosting also processes data in line with GDPR and provides a Data Processing Agreement (DPA) on request.
Our guarantees for your peace of mind
Protected from every angle
30-day guarantee
We refund without questions in the first 30 days.
Free migration
We migrate your site with no downtime — you do nothing.
24/7 support
Our experts are here 24/7 via tickets and live chat.