GDPR on your website: what you need to comply with the law without scares

Complying with GDPR on your website is not an optional formality nor something reserved for large companies. If your page collects any personal data (a simple contact form, a newsletter or analytics cookies), the data protection law applies to you fully. And the penalties for non-compliance are not symbolic: the Spanish Data Protection Agency fines small businesses and freelancers every year for mistakes that could have been avoided with a bit of order.

The good news is that complying with GDPR on a website is much simpler than it seems once you understand what the regulation actually asks of you. In this guide I explain, in plain language and from my experience developing websites in Málaga, what you need to sleep soundly: the essential legal texts, how to manage cookies, how your forms should be, what security measures to apply and what rights your users have. No unnecessary jargon and with concrete actions.

GDPR (the General Data Protection Regulation) is the European regulation that governs how companies and professionals collect, store and use people's personal data. In Spain it is complemented by the LOPDGDD, the law that adapts the regulation to our country. Together they set the rules of the game: what you can do with your clients' data and what obligations you have to protect it.

Personal data is considered to be any information that allows a person to be identified: name, email, phone, IP address, browsing data... That is why almost no website escapes it. If you have a contact form, a chat, an online store or simply Google Analytics installed, you are processing personal data and must comply. It does not matter if you are a freelancer or a five-person company: the obligation is the same.

Every professional website must include three accessible legal documents, usually linked from the footer. Copying them from another website will not do: they must reflect your real situation, your details and the tools you use. These are the essential ones:

• Legal notice: identifies who is behind the website (name or company name, tax ID, address and contact details). It is required by the LSSI for any economic activity.
• Privacy policy: explains what data you collect, for what purpose, for how long, on what legal basis and with whom you share it. It is the central document of GDPR.
• Cookie policy: details which cookies your website uses, what type they are, what they are for and how the user can manage them.

These texts must be written clearly and be easy to find. A very common mistake is having a generic privacy policy that mentions tools you do not use or omits the ones you do. The consistency between what you say and what you actually do is exactly what the Agency reviews when there is a complaint.

The cookie banner is, by far, the element that accumulates the most penalties, because many websites implement it wrong. The rule is clear: you cannot install non-essential cookies (analytics, advertising, social media) until the user has given explicit consent. That "accept all" banner that loads cookies before you even click is straight-up illegal.

A well-made cookie banner must meet these requirements to be valid:

1. 1Offer balanced options: the reject button must be as visible and accessible as the accept one.
2. 2Not load non-essential cookies until the user actively accepts.
3. 3Allow cookies to be configured by category, not just accepted or rejected in bulk.
4. 4Keep a record of consent in case you have to prove it.
5. 5Make it easy for the user to change their mind and withdraw consent whenever they want.

When I develop or review a website, cookie management is one of the first things I check, because it is a silent failure: the site works perfectly, but it is breaking the rules from the very first visitor. A good consent management platform solves this cleanly and without hurting the user experience.

Every form that collects data (contact, quote, newsletter, registration) must comply with the principle of informed consent. The user has to know what data you are asking for, what you will use it for, and accept consciously. This translates into a series of concrete elements that cannot be missing.

• A privacy policy acceptance checkbox that is not pre-ticked: the user must tick it actively.
• A visible link to the privacy policy next to that checkbox.
• Asking only for the data you really need (minimisation principle): if the email is enough, do not require the phone.
• A clear purpose: if you are going to send commercial communications, it must be stated separately and specifically.
• Keeping proof of consent with date and time.

GDPR does not only ask you to inform, it also requires you to protect the data you collect with adequate technical measures. This is where web development and legal compliance shake hands, because an insecure website is a non-compliant website, even if it has all the legal texts perfect.

The basic security measures every website should have are:

• An SSL certificate (HTTPS) to encrypt the information that travels between the user and your server.
• Regular, automatic backups so you can recover the data after any incident.
• Updated software, plugins and system, since old versions are the main entry point for attacks.
• Strong passwords and access limited only to those who really need it.
• A reliable hosting provider, preferably located in the European Union.

In the event of a security breach affecting personal data, GDPR requires you to notify the Agency within 72 hours. Having security measures well thought out from development drastically reduces that risk and demonstrates the diligence the regulation demands.

GDPR grants people a series of rights over their data, and you, as the controller, have the obligation to handle them. Knowing them saves you problems and lets you respond confidently when a user claims them. The rights known in Spain as ARSOPL are:

1. 1Access: the user can ask what data of theirs you hold and how you use it.
2. 2Rectification: they can request that you correct inaccurate or incomplete data.
3. 3Erasure: the famous right to be forgotten, which lets them ask you to delete their data.
4. 4Objection: they can object to you processing their data for certain purposes.
5. 5Portability: they have the right to receive their data in a reusable format.
6. 6Restriction: they can ask you to limit the processing in certain cases.

In practice, it is enough to state in your privacy policy a contact address where the user can exercise these rights and to handle those requests within a reasonable timeframe (one month maximum). You do not need a complex system, just a clear channel and the willingness to respond.

When reviewing websites of businesses in Málaga and the surrounding area, I keep running into the same failures. Avoiding them already puts you ahead of much of your competition:

• A cookie banner that loads analytics before the user accepts.
• A privacy checkbox pre-ticked by default on forms.
• Legal policies copied from another website that mention tools that are not used.
• A complete absence of a cookie policy or legal notice.
• A website without an SSL certificate collecting data in plain text.
• Not responding to users' requests about their data.

Complying with GDPR on your website comes down to having the right legal texts, a cookie banner that respects consent, well-designed forms, solid security measures and a channel to handle your users' rights. It is not an expense or an obstacle: it is a sign of professionalism that builds trust and, on top of that, protects you from penalties that can be very painful for a small business.

I am Elmar Mamedova, a full stack developer in Málaga. I design and develop websites ready to comply with GDPR from their foundation, and I review live projects to detect and correct non-compliance. If you want the peace of mind that your website is in order and working for your business, let's talk and review it together.