A GDPR checklist for a small business website
For most small sites, GDPR comes down to a short list: know what personal data your site collects and why, use only what you need, tell people plainly, keep it secure, delete it when you're done, and be ready to answer when someone asks what you hold. Work through the eight points below in order. This is practical guidance, not legal advice.
Who this applies to
The GDPR (and the UK GDPR, which mirrors it with some differences) applies to businesses of every size that handle personal data about people, including sole traders. Personal data on a website usually means names, email addresses, phone numbers, messages, booking details and anything that identifies a visitor's device. The good news for small sites is that the duties scale with what you do. A site with one contact form has far less to do than one with accounts and tracking.
The checklist
1. List what you collect
Go through every form, every third-party tool and every place visitors can sign up. Write down each field and where its data goes: your inbox, a spreadsheet, a chat channel, a mailing tool, a CRM. This inventory drives every other point.
2. Cut fields you don't need
Data minimisation means collecting only what you'll use. A contact form rarely needs a phone number and a postal address as well as an email. Each field you drop is one less thing to secure, explain and delete.
3. Pick a lawful basis for each use
The ICO's guide to lawful basis lists the bases, which since 2025 in the UK include recognised legitimate interests. For a contact form, replying to the person who wrote is usually legitimate interests or steps towards a contract; you don't need a consent checkbox for that. Marketing emails are different: they normally need consent under the separate electronic marketing rules.
4. Tell people, in plain words
A privacy policy should say who you are, what you collect, why, who you share it with, how long you keep it and how people can use their rights. Link it from every page and next to every form.
5. Check your processors
Every service that stores or handles the data for you, such as your host, email provider, form tool or CRM, is a processor. Use ones that offer a data processing agreement, note where they store data, and check what happens if data leaves the UK or EU.
6. Set retention periods
The ICO's storage limitation guidance says there are no fixed periods: you decide and justify them, and keeping data "just in case" isn't acceptable. A practical default for enquiries that went nowhere is a few months; for customers, as long as you need records for tax and disputes. Put the periods in your privacy policy and delete on schedule, in every place the data was copied to.
7. Secure it
Use HTTPS everywhere, turn on two-factor sign-in for every account that can read submissions, limit who has access, and avoid forwarding personal data into places many people can see, such as a busy chat channel.
8. Be ready for requests
People can ask for a copy of their data, or for it to be corrected or deleted. The ICO's guide to subject access says to respond without undue delay and within one month, extendable by two months for complex requests. Because of point 1, you'll know every place to look.
Mistakes small sites make
- A pre-ticked marketing box on a contact form. Consent must be an active choice, and replying to an enquiry doesn't need it anyway.
- Copies everywhere. The same enquiry in an inbox, a spreadsheet, a chat channel and a CRM is four places to secure and four to delete from.
- A privacy policy from another site that lists tools you don't use and misses the ones you do.
- Shared logins to the form inbox, so you can't tell who read what.
How to check you're done
Send a test enquiry with a made-up name. Find it in every place your inventory says it lands. Then pretend that person has asked for their data to be deleted, and time how long it takes to remove every copy. If you can do it in an afternoon and your privacy policy describes each place you looked, you're in good shape.
What Anticode handles, and what you still do
On Anticode sites, form submissions are saved and sealed at rest with AES-256-GCM, and an access log records the last 200 reads, exports and deletes of form data. A site that collects data can't be published until the account owner and the person publishing have two-factor sign-in on. Analytics are counted without cookies, and published pages carry no third-party trackers. Each site gets a Privacy Policy written from what it actually does, including where its form data goes.
You still choose what happens next. Connectors send each submission on to tools such as Slack, Google Sheets, HubSpot or Mailchimp, and each of those becomes another processor holding a copy, under its own retention. Deciding retention, answering requests and keeping the policy accurate are yours. Anticode's Keep submissions setting deletes a project's stored submissions automatically after the period you choose, but it doesn't reach the copies in those other tools. For the form side in depth, see storing form data safely and the cookie banner guide.
Questions people ask
Does a contact form need a consent checkbox?
Not to reply to the message. Use a checkbox only if you want to add the person to marketing, and make it unticked and optional.
Does GDPR apply to a sole trader?
Yes, if you handle personal data for your business. Purely personal or household use is outside it, but a business website isn't.
Do I need to register with the ICO?
Many UK businesses that process personal data must pay the data protection fee, with some exemptions. The ICO has a short self-assessment on its website.
Sources
- ICO: A guide to lawful basis, checked
- ICO: Principle (e): Storage limitation, checked
- ICO: A guide to subject access, checked