Many small businesses believe that GDPR compliance means adding a cookie banner and a privacy page. The banner may be necessary, but it is not the starting point. The starting point is a more uncomfortable question: what data do you actually need, and why?
1. Map your data
Before writing anything, note down:
- Which forms you have and what they collect.
- Where the data is sent.
- Who has access.
- How long you keep it.
- Which providers you share data with.
If you cannot answer this, no legal text will save you.
2. Minimise
Do not ask for a phone number if you do not need it. Do not ask for a company name if it does not change the answer. Do not keep messages “just in case” for years.
Every field must have a clear purpose. If it does not, remove it.
3. Choose a legal basis
Not everything is based on consent. A quote may be based on pre-contractual measures. A tax obligation, on a legal obligation. Site security, on legitimate interest.
Consent is needed for things like newsletters or non-essential cookies. It must be freely given, specific, informed and revocable.
4. Cookies: only what is needed
If you only use technical cookies, there is no need to invent a banner. If you use analytics or advertising, you need prior consent and a reject option that is just as visible.
Do not load Google Analytics before the user accepts. Do not make rejecting harder than accepting.
5. Consistent legal texts
The privacy policy must describe what you actually do:
- Controller and contact.
- Purposes and legal bases.
- Data categories.
- Recipients and providers.
- International transfers, if any.
- Retention periods.
- Rights and how to exercise them.
Do not copy another company’s template without adapting it.
6. Security and providers
Compliance also means protection. HTTPS, least-privilege access, strong passwords, 2FA, backups and updates. And signing or reviewing data processing agreements with providers that process data for you.
7. Records and review
Keep evidence of consent: policy version, date, form and, if needed, IP. Review the data map when you change tools or forms.
Conclusion
GDPR is not an aesthetic formality. It is a way of deciding what data you need and how you protect it. If you want to review it without fear-mongering, let’s talk.