The General Data Protection Regulation (GDPR) applies to any organisation that handles personal data about people in the EU, whatever its size. A contact form, a newsletter, an online shop and the analytics on your site all count. This guide covers what a small website needs to get right. It explains the rules in plain terms and is not legal advice; for your own situation, ask a lawyer or your national data protection authority.
Start with what you collect
Personal data is anything that identifies a person, directly or indirectly: a name, an e-mail address, a phone number, an IP address or a cookie ID. Before anything else, write down:
- what personal data your site collects, and through which forms, plugins and services;
- why you collect each item;
- where it is stored and who can see it;
- how long you keep it.
This list becomes the backbone of your privacy notice and your answer to almost every GDPR question. If you cannot say why you collect something, stop collecting it.
Pick a lawful basis for each use
You may only use personal data when one of six lawful bases applies. Choose it before you start, and write it down.
Consent is only one of the six, and it is often the wrong choice. If you need someone's address to deliver their order, the basis is the contract. Use consent where the person has a real choice, such as a newsletter.
Consent for marketing e-mail
Valid consent is freely given, specific, informed and unambiguous. In practice:
- Use an unticked checkbox or a separate sign-up form. Pre-ticked boxes do not count.
- Keep it separate from your terms and conditions, and do not make it a condition of buying.
- Say what you will send and how often.
- Record when and how each person agreed. A double opt-in, where people confirm by clicking a link, gives you that record.
- Make it as easy to withdraw as it was to agree, with an unsubscribe link in every message.
There is one narrow exception, often called the soft opt-in. You may e-mail existing customers about your own similar products, as long as you offered a clear way to opt out when you collected their address and in every message since. The details vary between EU countries, so check your national rules.
Cookies and similar technologies
Cookies are covered by a separate law, the ePrivacy Directive of 2002, as each EU country has written it into national law. It requires consent before a site stores or reads anything on a visitor's device, unless it is strictly necessary for a service the visitor asked for, such as a shopping cart or a login session. Analytics and advertising cookies usually need consent.
- Ask before any non-essential cookie is set, not after.
- Make Reject as easy to find as Accept. European regulators have said so in their joint work on cookie banners.
- Let visitors change their mind later, for example through a link in the footer.
A planned replacement, the ePrivacy Regulation, was withdrawn by the European Commission in 2025. In November 2025 the Commission proposed changes to the cookie rules as part of its Digital Omnibus package. As of October 2026 those changes are still being negotiated, so the current rules apply.
Write a clear privacy notice
Your privacy notice tells people what you do with their data. Write it in plain language and link to it from every form. It should say:
- who you are and how to contact you;
- what data you collect, why, and the lawful basis for each use;
- who receives it, such as your host, e-mail provider and analytics service;
- whether it leaves the European Economic Area, and how it is protected if so;
- how long you keep it;
- the rights people have, and their right to complain to the data protection authority.
The services that handle data for you are called processors. You need a data processing agreement with each one. Most large providers include one in their terms.
Answer data requests on time
People can ask to see the data you hold about them, correct it, delete it, receive it in a portable format, restrict its use or object to it. You have one month to reply. For complex or numerous requests you can extend that by two more months, as long as you tell the person within the first month. Requests are normally free.
Check identity in proportion to the risk. Asking for a passport to unsubscribe someone is too much; replying to an e-mail address you already have on file is often enough.
If data leaks
If personal data is lost, stolen or exposed, you must tell your data protection authority within 72 hours of finding out, unless the breach is unlikely to put anyone at risk. If the risk to people is high, you must tell them too. Keep a short internal record of every breach, including the ones you did not report.
Do you need a Data Protection Officer?
Most small websites do not. A Data Protection Officer (DPO) is required when:
- you are a public authority or body;
- your core activity involves regular and systematic monitoring of people on a large scale, for example tracking behaviour for advertising; or
- your core activity involves large-scale processing of sensitive data, such as health records, or data about criminal convictions.
If you appoint a DPO, publish their contact details and send them to your data protection authority. In Cyprus that authority is the Commissioner for Personal Data Protection, and the national law that sits beside the GDPR is Law 125(I)/2018. The Commissioner's site has guidance in Greek and English, and forms for notifying a breach.
Common questions
- Do I need a cookie banner if I only use necessary cookies?
- No consent is needed for strictly necessary cookies. You should still list them in your privacy notice.
- Can I keep e-mailing a list I bought?
- No. People on a bought list did not agree to hear from you. Delete it and build your own list with clear consent.
- How long can I keep data?
- Only as long as you need it for the purpose you collected it for, or as long as a law requires, such as tax rules for invoices. Set a period for each type of data and delete it after.
- What are the fines?
- For the most serious breaches, up to €20 million or 4% of worldwide annual turnover, whichever is higher. Authorities take the size of the organisation and the harm done into account, and many cases end with an order to fix the problem.
Most of the GDPR comes down to collecting less, saying clearly why, and keeping your word. If your site needs a proper cookie banner, cleaner forms or a privacy notice that matches what it really does, a professional on Internetivo can do that work. See how your first project works.