Your website is your company’s digital showcase, but whether it is contact forms, newsletter sign-ups or tracking cookies, you are collecting data. This GDPR website checklist helps you avoid leaving legal gaps. In this article you get a guide to making your legal notice (Impressum, mandatory for websites in Germany), privacy policy, cookie banner, forms and technical security GDPR-compliant. Those who do their homework avoid warning letters from competitors (Abmahnungen, common in Germany) and fines, increase visitor trust and improve their SEO rankings (Google favours secure HTTPS sites, among other things). So let’s get started with a full check of your web presence.
Key points: GDPR website checklist
- Always enable SSL/TLS
- Cookie banner with genuine consent
- Up-to-date privacy policy (including tools & plugins)
- Data-minimising forms
1. Legal notice (Impressum) and privacy policy
- Legal notice (Impressum): Under Section 5 TMG and Section 55 RStV (German telemedia and broadcasting rules), you must clearly state your identity as a website operator (company name, address, contact details).
- Privacy policy: It informs visitors which data you collect and for what purpose (contact forms, cookies, newsletter, etc.). Make sure it has:
- Understandable language
- A list of all tools (tracking, social plugins)
- Legal bases (Art. 6 GDPR)
- Contact details of the data protection officer (if you have one)
2. SSL/TLS encryption
An HTTPS connection is standard. Without SSL/TLS, all form data is transmitted unencrypted and is therefore insecure. Modern browsers often flag unsecured pages as “not secure”. For GDPR purposes, encrypted transmission is indispensable, especially for login fields, orders and contact forms. It also improves your SEO ranking.
3. Cookie banner & tracking
- Essential vs. optional cookies: You may set only technically necessary cookies (e.g. session cookies for the shopping cart) without consent. Everything else requires an opt-in (e.g. marketing, analytics).
- Transparency: Explain in your cookie banner what you use cookies for and how users can decline them.
- Consent management: Use tools such as Cookiebot, Borlabs or similar to document consent.
4. Contact and order forms
- Data minimisation: Ask only for information you really need. Mandatory fields? As few as possible.
- Consent notice: Do you point out the processing, with a link to your privacy policy where appropriate?
- Double opt-in: For newsletter sign-ups, it is better to use double opt-in.
- SSL/TLS: Transmit forms only in encrypted form.
5. Technical security (Art. 32 GDPR)
- Up-to-date systems: Regular updates of your CMS (WordPress, Typo3) and plugins.
- Strong passwords: No default logins such as “admin”. Two-factor authentication wherever possible.
- Security plugins: Firewalls and malware scanners (e.g. Wordfence for WordPress).
- Regular backups: Store them encrypted so that you can restore quickly after a hacker attack.
Link: German Federal Office for Information Security (BSI)
6. Social media plugins
Anyone who embeds Facebook, Instagram or Twitter buttons often sends data to the respective platforms. The following approaches are GDPR-compliant:
- Two-click solutions: The plugin is loaded only after the user clicks.
- Cookie opt-in: Do not set tracking cookies without consent.
- Transparency: State in your privacy policy which data goes to whom.
7. Page speed and UX
This is not strictly a GDPR matter, but Google factors user experience into its ranking. A slow or confusing website reduces the time visitors spend on it. The GDPR aspects (e.g. no cookie spam, transparent notices) can also have a positive effect on user experience if you implement them in a user-friendly way.
Link: IHK Halle-Dessau: data protection guidance (in German)
FAQ: GDPR website checklist
The usual approach is a link in the footer that is accessible from every subpage. That is sufficient.
Yes, if your hosting provider could have access to personal data (which is usually the case). In that case, a data processing agreement is mandatory.
There are currently court rulings finding that loading Google Fonts externally transmits IP addresses. It is better to host fonts locally to minimise GDPR risks.
