What is GDPR and what does it mean for your website?

GDPR sounds like something only big corporations need to worry about, and that assumption is exactly what trips small businesses up. A one-page site for a local plumber is covered just as much as a national retailer, because the law triggers on the data, not the size of the business. The reassuring news: for a small site, compliance is mostly common sense and a short checklist, not a legal department.

GDPR (the General Data Protection Regulation) is an EU and UK law that controls how businesses collect, store and use people’s personal data, and it applies to your website the moment you gather any visitor information, including names, emails, enquiry forms, analytics or cookies. If your site has a contact form, a newsletter sign-up, or even Google Analytics, GDPR applies to you.

What counts as personal data?

Personal data is any information that can identify a living person. On a typical small-business website that includes:

• Names, email addresses and phone numbers from a contact form or enquiry
• IP addresses and device data collected by analytics
• Cookies that track behaviour across pages
• Booking details, payment records and customer accounts
• Anything in your email inbox tied to a real person

If your website touches any of the above, you’re a “data controller” under the law and you have legal duties.

Does GDPR still apply in the UK after Brexit?

Yes. The UK kept GDPR after leaving the EU, in a near-identical form called UK GDPR, enforced by the Information Commissioner’s Office (ICO). If you also serve EU customers, EU GDPR applies on top. For most small businesses the practical rules are the same either way.

PECR (the Privacy and Electronic Communications Regulations) is the partner law that governs cookie banners and marketing emails specifically. People often lump it in with GDPR.

What your website actually needs

You don’t need a legal team. For most small sites, compliance comes down to a short checklist:

The risks of ignoring it

The headline GDPR fines (up to £17.5m or 4% of turnover) are aimed at large companies misusing data at scale. A small business is far more likely to face:

• A complaint to the ICO from an unhappy customer or competitor
• Reputational damage if a data breach goes public
• Lost trust, since visitors increasingly notice missing privacy policies

The realistic risk is rarely a giant fine. It’s the slow erosion of trust, and the scramble if you ever do have a breach with no policy in place.

Because we build and manage the whole site, GDPR basics are baked in: HTTPS by default, a privacy policy tailored to your services, a consent-first cookie banner, and forms that store enquiries securely rather than scattering them across inboxes. You stay focused on the business while the compliance plumbing is handled. See what’s included on the pricing page. Weighing up DIY versus managed? DIY vs done-for-you website walks through the trade-offs.

Open your own website right now and check three things: is there a privacy policy linked in the footer, does a cookie banner appear before tracking starts, and is the address bar showing a padlock (HTTPS)? If any answer’s no, that’s your first job this week.