A significant share of data protection penalties stems not from major breaches but from a few missing notices and badly configured settings on a website. The good news: most of these gaps are not a technical project but a few days of tidying up.
This article is general information and does not constitute legal advice. For an assessment specific to your situation, consult your legal adviser.
Short answer: what does website-side compliance mean?
On the website side, compliance means clearly telling visitors which personal data you collect, for what purpose and on what legal basis — and then processing that data only within the limits you declared. In practice it requires three things: correctly written notices, visibility of those notices at every point where data is collected (forms, cookies, analytics), and genuinely keeping the data limited to the purpose and period you stated.
The notices your site must carry
Their presence matters, but so does being accurate and current. A notice copied from the internet that does not match your actual processing carries more risk than having none — because the gap between what you declare and what you do is read against you in an audit.
- Privacy notice: who the controller is, which data is processed, for what purpose, on what legal basis, who it is shared with, how long it is kept, and the rights of the data subject.
- Cookie policy: which cookies are used, which are strictly necessary, which are optional, and whether third-party cookies are present.
- Privacy policy: your general approach to processing and your security measures.
- Consent text (only where processing relies on consent): for marketing communications it must be separate from the privacy notice and genuinely optional.
- Data subject request channel: how individuals exercise their rights.
The nine points audits catch most
| # | Issue | Why it is risky |
|---|---|---|
| 1 | Privacy notice does not reflect real activity | The gap between declaration and practice is checked first |
| 2 | Consent bundled into a single box with the notice | Undermines the "freely given" and "specific" requirements |
| 3 | Cookies fire before consent | Non-essential cookies must not load before approval |
| 4 | Only an "Accept" option is offered | Refusing must be as easy as accepting |
| 5 | Forms collect more fields than needed | Conflicts with data minimisation |
| 6 | Retention periods undefined | "Keep indefinitely" is not a defensible position |
| 7 | Cross-border transfer not declared | Overseas servers and analytics can constitute transfer |
| 8 | No agreements with processors | Written arrangements with agency, host and mail provider are required |
| 9 | No breach response plan | Notification windows are short; without a plan they are missed |
How cookie consent should work
- Non-essential cookies must not run before consent. If analytics and advertising scripts have already loaded while the banner is still showing, the banner serves no purpose.
- Refusing must be as easy as accepting. If "Accept" is large and colourful while "Reject" is small or two clicks away, whether consent was freely given becomes arguable.
- Offer choice by category: essential, performance/analytics, marketing.
- Keep a consent record — who consented to what, and when, must be demonstrable.
- Consent must be withdrawable, and the way to do it must be easy to find.
A frequent question: "does a banner hurt conversion?" A badly designed one does. A well-designed banner — short, clear, decidable in one view — achieves compliance without exhausting the visitor. What actually harms conversion are designs that cover the screen and are hard to dismiss.
Server location and cross-border transfer
- Hosting location: a server abroad means personal data is processed abroad.
- Analytics and advertising tools: most transfer data to overseas servers.
- Email and form services: newsletter and form-collection tools can also create transfers.
- Backup location: where backups sit is itself a processing activity.
All of these must be stated explicitly in your privacy notice, and the transfer conditions required by law must be met. Choosing domestic hosting materially reduces the complexity here — that is the real compliance benefit of a local hosting choice.
Data minimisation: look at your forms
This is the easiest and most skipped step: for every field you collect, ask "do I genuinely need this?"
Asking for a date of birth, national ID or address on an enquiry form — when you do nothing with them at that stage — is both unnecessary risk and lost conversion. Data you never collect is data you do not have to protect, cannot leak, and need not manage a retention period for.
Nine-point audit checklist
- Does the privacy notice reflect the company's actual processing?
- Is consent taken separately from the notice and genuinely optional?
- Do non-essential cookies run before consent? (Verify with browser developer tools.)
- Is refusal as accessible as acceptance?
- Are there unnecessary fields on your forms?
- Is a retention period defined for each data category, and is data erased at the end?
- Have cross-border transfers (hosting, analytics, mail services) been identified and declared?
- Are there written arrangements with hosting, agency and other processors?
- Is it written down who does what in a breach, and is the contact list current?
Netişlem expert view: three patterns from the field
First, copy-paste notices. On a considerable share of the sites we review, the privacy notice describes another company's activity — occasionally another firm's name is still in the text. That reads less as a compliance gap than as a signal of carelessness.
Second, decorative cookie banners. The banner appears, the user clicks accept — but developer tools show analytics and advertising cookies loading the moment the page opens, before any consent. In that state the banner does not deliver compliance; it only looks as though it does.
Third, not knowing where the data is. Businesses able to answer "where is our data held?" precisely are in the minority. Yet that answer feeds everything from transfer declarations to backup policy.
Our recommended order: first the inventory (what data, where, for how long), then the notices, and only then the technical setup. Projects that start in reverse order tend to stall.
Frequently asked questions
Does a small site with only a contact form need this?
If you collect personal data (name, email, phone), obligations arise. A smaller scope makes compliance simpler but does not remove it. For a single-form site, a privacy notice, a retention period and a request channel are usually an adequate start.
Can I use analytics without a cookie banner?
Non-essential cookies require prior consent, so running analytics without it is a risky choice. Some businesses instead move to measurement methods that avoid cookies or personal data, which can reduce the compliance burden.
Am I non-compliant if my server is abroad?
Not automatically. But it constitutes a cross-border transfer, which must meet the conditions set out in law and be declared in your privacy notice. Choosing domestic hosting reduces the administrative burden here.
Do I have to register with the controllers' registry?
The obligation depends on thresholds such as employee numbers and annual balance sheet, with exemptions by sector. You should check the thresholds against your own figures, and consult your adviser if you are near the boundary.
Can I use a template for the notices?
A template can be a starting point but should not be used as-is. The text must describe what you actually collect and why. A mismatched notice can become evidence of the contradiction between your declaration and your practice.
Conclusion
Website-side compliance is not a complex technology project. It is knowing what you collect, describing it accurately, and staying within what you described. Once those three hold, what remains is largely maintenance.
If you would like us to review your current position with you, get in touch. You can also review our domestic hosting and corporate hosting solutions.