The misconception
“We’ve got our website sorted - cookie banner installed, privacy policy published. GDPR? Done.”
This is one of the most common - and most dangerous - misconceptions about the GDPR. Your website is the most visible part of your data processing, but it’s just the tip of the iceberg.
What your website covers (and what it doesn’t)
Your website compliance typically includes:
- A cookie consent banner
- A privacy policy page
- Secure forms (HTTPS)
- Google Analytics or tracking tools configured with consent
That’s important, but it covers perhaps 10-15% of your total GDPR obligations.
What you’re probably missing
Your customer data outside the website
- CRM system with customer records
- Email correspondence with clients
- Invoices with personal details
- Customer service logs
Your employee data
- Employment contracts
- Salary and tax records
- Sick leave administration
- Performance reviews
- Application materials
Your third-party sharing
- Accountant (sees financial and personal data)
- Payroll provider (processes salary data)
- IT provider (has access to your systems)
- Cloud storage (stores your files)
- Email tool (processes subscriber data)
For each of these, you need a processing agreement (DPA). Without it, you’re not compliant, regardless of how perfect your website is.
Your procedures
- How do you handle an access request from a customer?
- What do you do when you discover a data breach?
- How long do you retain different types of data?
- Who in your organisation is responsible for privacy?
Your documentation
- Processing register (overview of all data processing activities)
- Data retention policy
- Data breach procedure
- Employee privacy policy
The danger of a copied privacy policy
Many businesses copy a privacy policy from another website or use a free template without customisation. This can actually make things worse:
- If the policy mentions processing activities you don’t do, it looks like you haven’t thought about it
- If the policy omits processing activities you do perform, it fails to inform your data subjects
- A supervisory authority will compare what your policy says with what you actually do - discrepancies are a red flag
A complete picture
Think of GDPR compliance as a building. Your website is the facade - it’s what people see first. But behind the facade, you need:
- Foundation: processing register and legal bases
- Walls: processing agreements with all your data processors
- Roof: procedures for data breaches and data subject requests
- Interior: employee training and awareness
- Maintenance: regular reviews and updates
A beautiful facade on a building without walls doesn’t pass inspection.
What to do
- Start with your website - yes, get the cookie banner and privacy policy right
- But don’t stop there - map all your data processing, not just what happens online
- Check your third parties - do you have processing agreements with everyone who handles data on your behalf?
- Set up procedures - know what to do when someone asks about their data or when something goes wrong
- Document everything - your processing register is the backbone of your compliance
GDPRWise starts with your website scan but goes much further - helping you build complete compliance across your entire business.