GDPR for Small Business Websites: What's Actually Required

Search "GDPR website requirements" and you will find two kinds of content: legal firms selling audits, and cookie-banner vendors selling banners. Both have an incentive to make compliance sound harder than it is.

Here is the honest version. For a typical small-business website — a few pages, a contact form, maybe analytics — GDPR compliance is a bounded, finishable task. This article covers what the law actually requires, what is myth, and a checklist you can work through in an afternoon.

One caveat up front: this is practical guidance, not legal advice. Rules evolve — verify current requirements with your national data protection authority or a lawyer if your situation is unusual (health data, children, large-scale profiling).

The two laws that apply to your website

Most people say "GDPR" and mean two separate things:

1. GDPR (the EU General Data Protection Regulation) governs how you collect and process personal data — names, emails, IP addresses, anything that identifies a person.
2. The ePrivacy rules (implemented nationally — in Portugal as Lei 41/2004, in Germany as TTDSG, and so on) govern cookies and tracking, regardless of whether personal data is involved.

The distinction matters because it answers the most common question wrong-way-round: the cookie banner requirement does not come from GDPR. It comes from ePrivacy. GDPR then governs what you do with the data those cookies collect.

What is actually required

1. Consent for non-essential cookies — and only those

You need prior, informed, freely-given consent before setting cookies that are not strictly necessary for the service the visitor requested. That means:

Cookie type	Consent needed?
Session cookies, login, shopping cart	No
Cookie-consent preference itself	No
Load balancing, security (CSRF tokens)	No
Analytics that set cookies (Google Analytics)	Yes
Marketing / advertising pixels (Meta, Google Ads)	Yes
Embedded YouTube videos, social widgets that track	Yes

The flip side almost nobody mentions: if your site sets no non-essential cookies, you do not need a cookie banner at all. More on that below.

If you do need a banner, it must offer "reject" as prominently as "accept", must not pre-tick boxes, and must not load the trackers until consent is given. A banner that says "by continuing you accept" while the pixels already fired is decoration, not compliance — and regulators across the EU have fined exactly that pattern.

2. A privacy policy that says something true

Article 13 of GDPR lists what you must tell people. For a typical SME site, that means a privacy page stating:

• Who you are — legal name, address, contact email.
• What data you collect — e.g. "name and email via the contact form; server logs including IP addresses".
• Why and on what legal basis — usually "to respond to your enquiry" (legitimate interest or contract) and "analytics with your consent".
• Who processes it for you — your hosting provider, email service, analytics tool, CRM. Name them.
• How long you keep it — pick honest periods ("enquiries: 12 months").
• The person's rights — access, correction, deletion, complaint to the supervisory authority.

A generated template you never read is worse than a short page you wrote yourself, because the template will claim things about your site that are false — and a false privacy policy is itself a violation.

3. Data minimisation on forms

Only ask for what you need. A contact form needs a name, an email, and a message. It does not need a phone number, a date of birth, or a mandatory company field. Every extra required field is data you must now protect, justify, and eventually delete.

4. Know your processors

Every third-party service that touches visitor data — host, form backend, newsletter tool, analytics — is a processor, and you need a data processing agreement (DPA) with each. In practice, reputable providers bundle a DPA into their standard terms; your job is to keep a simple list of who they are and check the DPA exists. Five rows in a spreadsheet is a legitimate "record of processing" for a small business.

What is myth

• "Every website needs a cookie banner." False. No non-essential cookies, no banner.
• "GDPR doesn't apply to small businesses." Also false. There is no headcount exemption for websites; some record-keeping duties relax under 250 employees, but the core rules apply to everyone.
• "You need a paid consent platform." Not necessarily. If your only tracker is analytics, dropping cookie-based analytics eliminates the need entirely.
• "You need a Data Protection Officer." Almost never for an SME site. DPOs are required for large-scale or sensitive processing, not for a contact form.
• "Compliance is a one-time certificate." There is no certificate. It is a state you maintain: when you add a tool, you update the list and the policy.

The cookieless route: skip the banner entirely

Here is the option the banner vendors will not tell you about: use first-party, cookieless analytics. Tools in this category (Plausible, Fathom, Umami, and similar) count visits without setting cookies or building visitor profiles. Result:

• No consent banner required for analytics.
• Faster pages — no consent-management JavaScript, no tag manager.
• Cleaner data — no 30–50% of visitors rejecting tracking and vanishing from your numbers.

You lose remarketing audiences and cross-site attribution. Most small businesses never use those anyway. This is how we build sites at Feitura by default: cookieless analytics, first-party where possible, and a banner only when a client genuinely needs consent-based tools like ad pixels.

The afternoon checklist

1. Open your site in a private window with browser dev tools → check which cookies and third-party requests fire before any consent.
2. List every third-party service handling visitor data. Confirm each has a DPA in its terms.
3. Remove tools you do not actually use (that old Facebook pixel from a 2022 campaign).
4. Consider switching to cookieless analytics — it may eliminate your banner.
5. If a banner remains: equal-prominence reject button, nothing loads pre-consent.
6. Rewrite your privacy policy to match reality: identity, data, purpose, processors, retention, rights.
7. Trim form fields to the minimum. Add a one-line notice under each form linking the policy.
8. Set retention: delete old enquiries and unused mailing-list contacts on a schedule.
9. Diarise a 30-minute review every six months, and verify current rules — enforcement practice and national guidance change.

Most SME sites fail on items 1 and 5: trackers firing before consent. Fixing that alone removes most of your real exposure.

If you'd rather have a site that's compliant by construction — cookieless analytics, minimal forms, honest policy — tell us about your project and get an estimate.