GDPR-Compliant Website 2026: The Checklist for Small Businesses

A missing or faulty privacy policy in Germany isn't just a legal risk — it also signals to potential customers that a business isn't entirely serious. The good news: for a typical small-business website, the list of obligations is manageable.

Here's the understandable version — without the legalese. (Note: this is general orientation, not legal advice.)

1. Impressum (§ 5 TMG)

Every commercially used website in Germany needs an Impressum (legal notice) — easy to find, usually in the footer. At a minimum it must contain:

• Full name or company name and legal form
• Postal address (no PO box)
• Contact: email and, as a rule, a phone number
• Where applicable: VAT ID, commercial register entry, the responsible supervisory authority

The Impressum must be reachable in no more than two clicks.

2. Privacy Policy (GDPR)

The privacy policy (Datenschutzerklärung) explains which data you process and why. For a small business website that typically covers:

• Server log files (technically necessary, legitimate interest)
• Contact or booking form (processing based on consent)
• Hosting provider (e.g. Vercel — including a note on possible data transfer)
• Analytics tools, if used (only with consent)

Important: the policy must match your actual website. A copied template that lists services you don't even use is just as wrong as having none at all.

3. Cookie Consent — Done Right

The most common mistake: a cookie banner that already loads the very thing it's supposed to block before the visitor agrees.

Correct looks like this:

• Before consent, no non-essential cookies or tracking scripts are loaded.
• Declining must be just as easy as accepting.
• The user's choice is stored and respected.

Many small websites manage entirely without tracking cookies. Cookieless analytics (e.g. Vercel Analytics) measure visitor numbers without building personal profiles — which dramatically reduces the banner burden.

4. Forms: Consent and Data Minimization

For every contact or booking form:

• An active consent (checkbox, not pre-ticked) with a reference to the privacy policy
• Only ask for the data you genuinely need
• A spam safeguard (e.g. an invisible honeypot field) — it protects you and your visitors

5. Retention: Don't Store Data Forever

Personal data may only be kept for as long as the purpose requires. A simple, clear rule — such as "inquiries are automatically deleted after 60 days" — is cleaner than "we keep everything forever."

The Short Version to Tick Off

• [ ] Impressum with all mandatory details, max. two clicks away
• [ ] Privacy policy that matches the real website
• [ ] Cookie consent that loads nothing before agreement
• [ ] Forms with a consent checkbox and data minimization
• [ ] Clear retention periods
• [ ] SSL/HTTPS active (standard today)

What It Should Look Like

On a professionally built website, these points are baked in from the start — not bolted on afterwards. All of the industry demos here are built to be GDPR-compliant: with Impressum, privacy policy, and correct cookie consent.

Conclusion

GDPR sounds like bureaucracy, but for a typical business website it's entirely manageable — provided the foundations are set correctly from the beginning. It protects you legally and signals professionalism to the outside world.

---

Vladyslav Kobiakov builds GDPR-compliant websites for small businesses. Based in Mykolaiv, Ukraine — working remotely. Get in touch. This article is general information and does not replace legal advice.