GDPR for website owners: the security side most teams miss

When website owners think about GDPR, they usually think about cookie banners. Consent matters, but it is only part of the regulation. Article 32 requires "appropriate technical and organisational measures" to protect personal data, and Articles 33 and 34 set out what happens when that protection fails. In the audits we run for businesses serving European customers, the consent banner is usually in place while the underlying data handling is not: contact form submissions stored forever in the database, full customer exports sitting in shared drives, and no plan for what to do if the site is breached. This is not legal advice, and you should involve counsel for your specific situation, but here is the practical engineering side that most teams miss.

Know what personal data your site holds

You cannot protect or minimize data you have not mapped. For a typical marketing site or store, personal data turns up in more places than expected:

• Form submissions saved by form plugins, often indefinitely.
• User accounts, order histories and addresses in e-commerce databases.
• Comments, reviews and support tickets.
• Server and application logs, which contain IP addresses and sometimes query strings with email addresses.
• Backups, which contain copies of all the above.
• Third-party tools: email marketing, CRM, analytics, chat widgets, heatmaps.

We document each location with the data it holds, why, how long it is kept and who can access it. A simple spreadsheet is fine. For many clients, this map becomes the backbone of their records of processing activities.

Collect less and keep it for less time

Data minimization is the most effective security control GDPR asks for, because data you do not hold cannot leak. In practice:

1. Trim forms. If a contact form does not need a phone number, remove the field. We often cut form fields by a third without any drop in lead quality.
2. Stop storing what you forward. Many sites save every form submission in the database and also email it to the team. Pick one, or delete stored entries automatically after 30 to 90 days.
3. Set log retention. Access logs are useful for security investigations, but 30 to 90 days is usually enough. Anonymize or truncate IP addresses in analytics.
4. Purge inactive accounts after a documented period, with notice to the user first.
5. Align backup retention with your retention policy, and document that deleted data persists in backups until they expire.

The cheapest breach to handle is the one that exposes nothing, because the data was deleted months ago under a retention policy you actually enforced.

What "appropriate security" looks like for a website

The regulation deliberately does not prescribe specific controls. It asks for measures appropriate to the risk. For most business websites, regulators and auditors will expect a recognizable baseline:

• Encryption in transit everywhere, and at rest for databases and backups holding personal data.
• Access control with named accounts, two-factor authentication and least privilege.
• Timely patching of the CMS, plugins, frameworks and server software.
• Logging sufficient to reconstruct who accessed what during an incident.
• Tested backups, because availability and the ability to restore personal data are explicitly part of Article 32.
• Regular testing and evaluation, such as periodic audits or penetration tests.

Writing down what you do matters as much as doing it. If you ever need to demonstrate compliance, a short security policy and evidence such as update logs, access reviews and restore test records carry weight.

Handling data subject requests safely

Access and deletion requests are a security issue as well as a compliance one. An attacker who emails pretending to be a customer and asks for "all the data you hold on me" is attempting social engineering. Verify identity through a channel you already trust, such as the email address on the account, before exporting anything. On the engineering side, build a repeatable export and deletion routine that covers every location in your data map, including third-party tools, so that each request takes minutes rather than an afternoon of searching.

Contracts and third parties

Every plugin, script and service that touches personal data on your behalf is a processor, and GDPR requires a data processing agreement with each. Most reputable providers publish a standard one; the job is to find, accept and file them. The more interesting question is technical: which third-party scripts load on your pages, and what do they collect? We regularly find chat widgets, heatmaps and advertising pixels that nobody currently on staff remembers adding. A Content Security Policy in report-only mode is a useful way to produce a definitive list.

Plan for a breach before you have one

If a breach is likely to result in a risk to people's rights and freedoms, you must notify the relevant supervisory authority within 72 hours of becoming aware of it, and in high-risk cases inform the affected individuals without undue delay. Seventy-two hours goes quickly when you are also trying to contain the incident. A one-page plan helps:

1. Who decides whether an incident is a notifiable breach, and who is their backup.
2. Contact details for your hosting provider, maintenance team, legal counsel and data protection officer if you have one.
3. Where logs and backups are and how to preserve them as evidence.
4. Template wording for the authority notification and for customers.
5. A breach register, since even non-notifiable breaches must be documented.

Run through the plan once a year as a tabletop exercise. It takes an hour and reliably exposes gaps, such as nobody knowing who holds the hosting account.

Our GDPR compliance service covers the data map, retention automation, consent setup and breach plan. The technical controls themselves are covered in our security audits, and ongoing patching and log retention are handled under monthly care plans.

Close the gaps behind the cookie banner

Tell us what your site collects and which tools you use, and we will return a fixed-price proposal for the data map, cleanup and breach plan. Request a quote from our team.