GDPR Checklist for Website Operators

The General Data Protection Regulation (GDPR) is an EU-wide law regulating how companies may collect, store and process personal data. It grants data subjects far-reaching rights, including access to, rectification of and erasure of their data, and in return obliges companies to be transparent and to have a demonstrable legal basis for every processing operation. Violations can be punished by the data protection supervisory authorities with substantial fines.

For website operators, the GDPR is therefore not a one-off project but an ongoing topic. Every new tool, every embedded form and every tracking pixel raises the same question: is this clean, or do we need consent? We’ve put together a checklist you can use for orientation.

What to expect in this article

Data protection officer
SSL certificate
Google Analytics
Google Maps, Google Fonts
Newsletter sign-up
Contact form
Social media buttons

Data protection officer

When is a data protection officer mandatory?

Whether your company needs a data protection officer depends above all on the number of people regularly involved in the automated processing of personal data. Under Section 38 of the German Federal Data Protection Act (BDSG), the obligation applies as soon as at least 20 people are constantly engaged in it; part-time staff, apprentices, interns and freelancers deployed accordingly count too.

Regardless of that number, a data protection officer can still be mandatory if your company conducts extensive systematic monitoring of individuals (e.g. profiling) or processes particularly sensitive data at scale, such as health or biometric data (Art. 37 GDPR).

A note up front: at the end of 2025, the German federal government announced its intention to abolish the 20-person threshold in Section 38 BDSG by the end of 2026. As long as no corresponding law has entered into force, however, the current rule continues to apply, and the obligations under Art. 37 GDPR (profiling, special categories of data) remain unaffected in any case.

What must a data protection officer be able to do?

The GDPR requires “professional qualities and expert knowledge of data protection law and practices” (Art. 37(5)). This can be acquired in different ways: training at chambers of commerce or specialised providers, relevant professional experience, or a combination of both. What matters is that the expertise is demonstrable if in doubt.

Duties

Inform the company about its data protection obligations and monitor compliance.
Act as the point of contact for authorities, customers, employees and management on questions about handling user and customer data.
Advise on and support data protection impact assessments.
Maintain the record of processing activities.
Maintain confidentiality about the identity of data subjects, unless they expressly waive it.

Rights

Protection against dismissal (for internally employed data protection officers).
Freedom from instructions in performing the role; disadvantaging someone for it is not permitted.

SSL certificate

Communication between user and server must be encrypted so third parties cannot read along. An SSL certificate (technically correct today: TLS, though “SSL” has stuck as the umbrella term) does exactly that, recognisable by the lock symbol and https:// in the address bar.

HTTPS is no longer a nice-to-have but the standard: browsers actively mark unencrypted pages as “not secure”, and search engines count HTTPS as a ranking factor. Without a valid certificate you lose not only your visitors’ trust but also visibility.

In summary:

Obtain an SSL/TLS certificate (many hosts provide free certificates automatically, e.g. via Let’s Encrypt).
Install the certificate correctly and ensure regular renewal.

Google Analytics

Since the switch from Universal Analytics to Google Analytics 4 (GA4), quite a bit has changed here. GA4 does not permanently store IP addresses and processes them without the last digits by default; the former manual “IP anonymisation” via a code addition is no longer a separate step.

What has tightened in return: analytics cookies may only be set after active consent, not merely with a subsequent opt-out option. This follows from the GDPR and Germany’s TTDSG in conjunction with the case law of the European Court of Justice (Planet49 ruling). Technically, you implement this with a consent banner solution (cookie management platform) that only loads Google Analytics after consent, ideally with support for Google’s Consent Mode so that restricted, cookieless signals are processed correctly too.

In summary:

Conclude a data processing agreement (DPA) with Google.
Use a consent banner that only loads tracking after active consent.
Set the retention period for user data in Analytics.
Add Google Analytics and the cookies used to your privacy policy.
Offer the ability to revoke consent at any time.

Google Maps, Google Fonts

If you embed Google Fonts directly from Google’s servers, the browser requests the font file there on every page view, transmitting the visitor’s IP address to Google without a legal basis for it. Exactly this led to a nationwide wave of cease-and-desist letters in Germany in 2022 (following, among others, a ruling by the Regional Court of Munich I). The reliable solution: host Google Fonts locally on your own server rather than loading them externally.

The same principle applies to Google Maps. Instead of loading the map automatically on page view, a two-click solution is recommended: initially only a preview is shown, and the actual map loads only after visitors have actively agreed.

Summary:

Embed Google Fonts locally instead of via Google’s servers.
Load Google Maps via a two-click solution only after active consent.

Newsletters remain among the most effective marketing channels, precisely because, unlike social media reach, you don’t have to “rent” them. In data protection terms, though, the sign-up is its own stumbling block: without a clean process, every email sent is potentially actionable.

Summary:

Integrate a mandatory checkbox referencing the privacy policy (no pre-ticked box).
Use the double-opt-in procedure: the sign-up only takes effect after confirmation via a link in the confirmation email, which simultaneously serves as proof of consent.
Provide a working unsubscribe link in every newsletter email.
Never send emails without demonstrable, documented consent.

Contact form

Anyone filling in a contact form must know beforehand what their data will be used for and that it can be deleted on request at any time. In practice, a short notice with a link to the privacy policy directly above the “Send” button is usually sufficient.

Summary:

Offer the form only over an encrypted (HTTPS) connection.
Ensure email dispatch via a secured SMTP connection.
Place a link to the privacy policy directly at the form.
State clearly which data is collected and how long it is retained.
Conclude data processing agreements (DPAs) with your host and email provider.

Classic social media plugins often load content from the respective network as soon as the page opens, transmitting user data before a single click has taken place. Here too, a two-click solution helps: the first click activates the connection to the network, and only the second click actually shares the content.

Summary:

Embed social media buttons via a two-click solution instead of directly embedded plugins.

This checklist covers the most important pitfalls but does not replace individual legal advice. For concrete questions about your website, a specialist lawyer’s or your data protection officer’s assessment is worthwhile in case of doubt. All information without guarantee.