Is Your Website GDPR Compliant? A Plain English Checklist for Irish Small Businesses

Almost certainly, yes. If your website collects any personal information at all, GDPR applies. That includes a contact form, a quote request, a booking system, a newsletter sign up and, in most cases, analytics tools that track visitors. The size of your business doesn't change that.

Your website needs a privacy notice (often called a privacy policy) that's easy to find, usually linked in the footer. You can see our own privacy notice as an example. It should explain, in language a customer can understand:

1. Who you are and how to contact you.
2. What personal information you collect, such as names, phone numbers, email addresses and addresses.
3. Why you collect it and what legal reason you rely on, such as replying to a quote request someone asked for.
4. Who you share it with, such as your email provider, booking tool or accountant.
5. How long you keep it.
6. The rights people have, including asking for a copy of their data or asking you to delete it, and their right to complain to the Data Protection Commission.

A template is a fine starting point, but it has to match what your business actually does. A copied policy that mentions tools you don't use, or leaves out ones you do, isn't much help.

This is where most Irish websites fall down. The Data Protection Commission has been clear on the basics:

1. No tracking before consent. Analytics, advertising and social media cookies shouldn't load until the visitor agrees. Only cookies that are strictly needed for the site to work can load straight away.
2. Reject must be as easy as accept. If there's a big "Accept all" button, there should be an equally easy way to say no.
3. No pre ticked boxes. Consent has to be an active choice.
4. Scrolling isn't consent. Carrying on browsing doesn't count as agreeing.
5. People can change their mind. Visitors should be able to update their choice later, usually through a link in the footer. Our cookie policy shows one way to explain this.

If you use Google Analytics, a Facebook pixel or embedded YouTube videos, you're almost certainly setting cookies that need consent.

Forms are often the main way your website collects personal data, so check that they:

1. Only ask for what you genuinely need to reply.
2. Link to your privacy notice near the submit button.
3. Don't sign people up to marketing emails automatically. Any newsletter opt in should be a separate, unticked box.
4. Are sent securely over HTTPS, so the padlock shows in the browser.

Your hosting company, email provider, form tool and booking system all handle your customers' data on your behalf. Under GDPR, you should have a data processing agreement with each of them. Most well known providers include one in their terms, but it's worth checking, and it's good practice to list them in your privacy notice.

GDPR expects you to take reasonable steps to protect the data you collect. For a website, that usually means:

1. HTTPS on every page.
2. Keeping your website software, themes and plugins up to date. Older WordPress sites with outdated plugins are a common weak spot. Our guide to what makes a good tradesman website covers the basics of a well built site.
3. Strong passwords and two step login for anyone who can access the site.
4. Not leaving old form submissions sitting in an inbox or database forever.

If a data breach does happen and it puts people at risk, you generally have 72 hours from becoming aware of it to report it to the Data Protection Commission.

1. A cookie banner that looks right but loads Google Analytics before anyone clicks anything.
2. No privacy notice at all, or one copied from another business that names the wrong company.
3. A contact form with a pre ticked box adding people to a mailing list.
4. A privacy notice that hasn't been updated since new tools were added to the site.
5. The website still running on HTTP, with no padlock.

Our free website audit includes compliance checks alongside SEO, speed and security, so you can see the obvious gaps at a glance. Run your free check now, or ring us on 087 182 8745 or email info@sitefully.ie if you'd like a hand fixing anything it finds.