GDPR and you
Forms, cookies, stats, and data retention: understand your website's checks and how technical support can help you stay compliant.
Sur cette page6 sections
Your website has a cookie banner, a privacy policy, and a contact form. At first glance, GDPR seems sorted. However, do you know where the messages sent from your form go, how long they are stored, and which tools receive data when someone opens a page?
This is often where the questions begin. A map added to help customers find you, an analytics tool, or a booking module can change what the site transmits. The visible banner is only one part of the operation.
GDPR, the General Data Protection Regulation, governs the use of personal data. On your website, the subject is not just about displaying the right documents. The information given to visitors must match what you actually do, and the settings must ensure that the choices announced are respected.
I recommend starting from this concrete operation rather than a list of notices to copy. This article provides benchmarks for preparing your website checks; it does not replace a legal review tailored to your business.
Start by tracing the path of a request. The customer fills out the form; the message arrives in your inbox, perhaps also in the site administration, and then possibly in a CRM tool. If you only look at the form, you risk forgetting the copies stored elsewhere.
For each use, you must be able to explain what you collect, why you need it, who accesses it, and what justifies the processing. This last point corresponds to the legal basis. Consent is one possibility, but not the automatic answer to every need: GDPR provides several legal bases.
For example, information needed to prepare a quote requested by an individual may fall under pre-contractual measures, under conditions explained by the CNIL for the contractual legal basis. This does not allow you to freely reuse the same address for all your other purposes.
The best practice remains to ask for what is necessary at the time you need it. If an initial request can be handled with a message and a way to reply, why require a date of birth? Adding a field "just in case" increases the data to be protected and can unnecessarily complicate making contact.
Some trackers, particularly those strictly necessary for the requested service, may be exempt from consent. Others require prior agreement. The CNIL details this distinction in its rules on cookies and trackers. A third-party tool should therefore not be automatically categorised like all others: you must look at its operation and purpose.
When consent is required, the visitor must be able to choose and withdraw their agreement easily. But the banner text is not enough: the tools subject to this choice must actually wait for the required agreement. A "Decline" button that still allows the trackers to fire does not solve the problem.
Practical monitoring involves opening the site in a new session, seeing what loads before any action, then testing refusal, acceptance, and changing choices. The CNIL recommended methods specifically remind us that refusing must be as easy as accepting.
A map, an embedded video, or a social media button also deserves scrutiny. Just because a module doesn't show an obvious cookie doesn't mean no information is transmitted. Conversely, the existence of a transfer alone is not enough to say that consent is always the only possible basis. You must qualify what is happening, not just recognise a logo.
A manager like Klaro can be used to organise choices and the loading of services. However, it must be configured and the integrations controlled; its installation is not a certificate of site compliance.
The visitor must be able to understand who uses their data, for what purposes, on what basis, with which recipients, and for how long or according to which criteria. You must also explain the applicable rights and how to exercise them. This information must be tailored to the processing, not just accessible somewhere in the footer. The CNIL provides examples of form notices to prepare this information at the time of collection.
Next, check that the stated contact exists and that someone knows how to handle the request received. A dedicated address is of little use if no one checks it. And a deletion request should not be executed without examining the retention obligations that may still apply.
On this last point, there is no universal duration for all site data. You must distinguish between uses and plan for what happens at the end: deletion, appropriate anonymisation, or justified archiving with limited access. The CNIL guidelines on retention periods help in preparing this work.
Legal notices have a different role, notably identifying the site publisher. They replace neither this data information nor the organisation required to respect it.
Matomo, for example, can be hosted in an environment you control. This choice allows you to manage the storage location and collection parameters. It does not automatically take the data out of the scope of GDPR, and a truncated IP address is not enough to qualify all tracking as anonymous.
Some audience measurement systems can benefit from a consent exemption if they meet the applicable conditions. This depends on the purposes, the data, and the configuration, not just the name of the software. The CNIL explains these conditions and evaluation possibilities on its page about audience measurement tools.
I therefore recommend starting with the questions you want to answer. Which services are being viewed? Are visitors finding the contact info? Where does the journey stop? You can then seek a measurement proportionate to the need, rather than activating every available function and wondering afterwards if they were necessary.
HTTPS protects exchanges when correctly implemented, but does not replace other measures. Access, authentication, updates, and backups must also be adapted to the risk. The CNIL security guide presents these precautions. The issue of backups is also explored in this article on what to check before a failure.
You also need to know which service providers are involved and what they do with the information entrusted to them. Hosting, booking tools, email, and CRM can have different roles. Necessary commitments and any transfers must be examined in this context. The CNIL notably provides clauses to frame subcontracting.
Not all small businesses must automatically appoint a Data Protection Officer, or DPO. The obligation depends on specific criteria, notably certain large-scale activities; the CNIL details these in its sheet on appointing a DPO. What remains necessary is knowing who is responsible for data matters in your organisation.
This work must remain linked to your organisation. You know how you use the requests received; specific legal questions may require the intervention of a consultant or a DPO. A web provider cannot guarantee the compliance of your entire business just by installing a banner or writing a page.
To start, I recommend taking an important journey, such as a quote request, and following it through to the tools where the information is stored. This makes the subject concrete and helps prioritise corrections. The approach proposed by the CNIL also gives starting points for organisation beyond the site.
And after a new integration, the relevant checks will need to be redone. A site changes: its settings and information must follow. This is part of the site maintenance and support work, not a document to be filed away forever after launch.
If you don't know what your site collects or if you want to clarify the corrections to be planned, we can look at the starting point together.
This is often where the questions begin. A map added to help customers find you, an analytics tool, or a booking module can change what the site transmits. The visible banner is only one part of the operation.
GDPR, the General Data Protection Regulation, governs the use of personal data. On your website, the subject is not just about displaying the right documents. The information given to visitors must match what you actually do, and the settings must ensure that the choices announced are respected.
I recommend starting from this concrete operation rather than a list of notices to copy. This article provides benchmarks for preparing your website checks; it does not replace a legal review tailored to your business.
What data does your website really collect?
You don't need an online shop or thousands of customers to process personal data. A name and an email address in a form are enough to raise questions about their use. Depending on the tools installed, technical information or identifiers can also be associated with an individual.Start by tracing the path of a request. The customer fills out the form; the message arrives in your inbox, perhaps also in the site administration, and then possibly in a CRM tool. If you only look at the form, you risk forgetting the copies stored elsewhere.
For each use, you must be able to explain what you collect, why you need it, who accesses it, and what justifies the processing. This last point corresponds to the legal basis. Consent is one possibility, but not the automatic answer to every need: GDPR provides several legal bases.
For example, information needed to prepare a quote requested by an individual may fall under pre-contractual measures, under conditions explained by the CNIL for the contractual legal basis. This does not allow you to freely reuse the same address for all your other purposes.
The best practice remains to ask for what is necessary at the time you need it. If an initial request can be handled with a message and a way to reply, why require a date of birth? Adding a field "just in case" increases the data to be protected and can unnecessarily complicate making contact.
A banner must control what happens, not just be displayed
Rules on cookies and other trackers concern access to information on the visitor's device. They complement personal data rules; the two subjects are linked but not interchangeable.Some trackers, particularly those strictly necessary for the requested service, may be exempt from consent. Others require prior agreement. The CNIL details this distinction in its rules on cookies and trackers. A third-party tool should therefore not be automatically categorised like all others: you must look at its operation and purpose.
When consent is required, the visitor must be able to choose and withdraw their agreement easily. But the banner text is not enough: the tools subject to this choice must actually wait for the required agreement. A "Decline" button that still allows the trackers to fire does not solve the problem.
Practical monitoring involves opening the site in a new session, seeing what loads before any action, then testing refusal, acceptance, and changing choices. The CNIL recommended methods specifically remind us that refusing must be as easy as accepting.
A map, an embedded video, or a social media button also deserves scrutiny. Just because a module doesn't show an obvious cookie doesn't mean no information is transmitted. Conversely, the existence of a transfer alone is not enough to say that consent is always the only possible basis. You must qualify what is happening, not just recognise a logo.
A manager like Klaro can be used to organise choices and the loading of services. However, it must be configured and the integrations controlled; its installation is not a certificate of site compliance.
Customer information must describe your organisation
A privacy policy copied from another site may be well-written yet explain nothing about your own operation. It might mention a tool you don't use, forget the one that receives your requests, or state a retention period that no one follows.The visitor must be able to understand who uses their data, for what purposes, on what basis, with which recipients, and for how long or according to which criteria. You must also explain the applicable rights and how to exercise them. This information must be tailored to the processing, not just accessible somewhere in the footer. The CNIL provides examples of form notices to prepare this information at the time of collection.
Next, check that the stated contact exists and that someone knows how to handle the request received. A dedicated address is of little use if no one checks it. And a deletion request should not be executed without examining the retention obligations that may still apply.
On this last point, there is no universal duration for all site data. You must distinguish between uses and plan for what happens at the end: deletion, appropriate anonymisation, or justified archiving with limited access. The CNIL guidelines on retention periods help in preparing this work.
Legal notices have a different role, notably identifying the site publisher. They replace neither this data information nor the organisation required to respect it.
Useful statistics without assuming the tool fixes everything
You need to know if visitors are finding your services and if your site is bringing in enquiries. Audience measurement can help answer these questions, but you must choose what you measure and check the settings.Matomo, for example, can be hosted in an environment you control. This choice allows you to manage the storage location and collection parameters. It does not automatically take the data out of the scope of GDPR, and a truncated IP address is not enough to qualify all tracking as anonymous.
Some audience measurement systems can benefit from a consent exemption if they meet the applicable conditions. This depends on the purposes, the data, and the configuration, not just the name of the software. The CNIL explains these conditions and evaluation possibilities on its page about audience measurement tools.
I therefore recommend starting with the questions you want to answer. Which services are being viewed? Are visitors finding the contact info? Where does the journey stop? You can then seek a measurement proportionate to the need, rather than activating every available function and wondering afterwards if they were necessary.
Security and service providers are also part of the subject
Data can be correctly described in documents yet remain too widely accessible. Does a former contractor still have an account? Do multiple people use the same login? Are backups protected, and do you know how to restore them?HTTPS protects exchanges when correctly implemented, but does not replace other measures. Access, authentication, updates, and backups must also be adapted to the risk. The CNIL security guide presents these precautions. The issue of backups is also explored in this article on what to check before a failure.
You also need to know which service providers are involved and what they do with the information entrusted to them. Hosting, booking tools, email, and CRM can have different roles. Necessary commitments and any transfers must be examined in this context. The CNIL notably provides clauses to frame subcontracting.
Not all small businesses must automatically appoint a Data Protection Officer, or DPO. The obligation depends on specific criteria, notably certain large-scale activities; the CNIL details these in its sheet on appointing a DPO. What remains necessary is knowing who is responsible for data matters in your organisation.
What I can review with you on the site
My role on the web side is to make these decisions applicable to the site's operation. This starts by examining forms, loaded services, and journeys that collect or transmit information. We can then identify settings to adjust, remove unnecessary collection, and verify that the choices announced to visitors are technically respected.This work must remain linked to your organisation. You know how you use the requests received; specific legal questions may require the intervention of a consultant or a DPO. A web provider cannot guarantee the compliance of your entire business just by installing a banner or writing a page.
To start, I recommend taking an important journey, such as a quote request, and following it through to the tools where the information is stored. This makes the subject concrete and helps prioritise corrections. The approach proposed by the CNIL also gives starting points for organisation beyond the site.
And after a new integration, the relevant checks will need to be redone. A site changes: its settings and information must follow. This is part of the site maintenance and support work, not a document to be filed away forever after launch.
If you don't know what your site collects or if you want to clarify the corrections to be planned, we can look at the starting point together.
