In short: If you run a website that handles personal data, you are the data controller. You need: a list of processing activities, a clear privacy notice, a properly built cookie banner, provable consent for marketing, agreements with suppliers, a procedure for customers' rights (with a reply within one month), security measures and, if a breach puts people at risk, notification to the supervisory authority (in Italy, the Garante) within 72 hours.
If you run a website that collects personal data, you are the data controller. A contact form is enough to make you one. A shop with registered customers even more so. The EU General Data Protection Regulation (GDPR) doesn't expect you to be a lawyer. It expects you to know what data you process and why, and to be able to prove it.
This is a practical guide, not legal advice. For particular cases, speak to a privacy professional.
1. Know what data you collect
The first step is a list. Where does personal data come in? Contact forms, registration, orders, the newsletter and customer service. Analytics tools, advertising pixels and chat. For each one, note which data, for what purpose, for how long and who receives it. That is the core of the record of processing activities.
2. A clear privacy notice
It must say who you are, what data you collect and for what purposes. It must set out the legal bases and retention periods, who the data is shared with and how people can exercise their rights. It must be reachable from every point where you collect data. A link at the bottom of the form will do.
3. Cookies and tracking tools
You need two things:
- A banner that lets people carry on without being tracked and choose individual purposes, with options given equal prominence. Non-technical tools (non-anonymised statistics, advertising) start only after consent.
- A cookie policy listing the tools and providers.
Check it yourself: open the site in a private window and use the browser to confirm that nothing starts before you consent. Respecting consent is where things most often go wrong.
4. Consent for newsletters and marketing
Marketing consent must be requested separately and without pre-ticked boxes. Keep proof of when and how it was given. Every email must offer a one-click way to unsubscribe.
5. Suppliers and data transfers
Anyone who processes data on your behalf (hosting, management software, email, customer service) is a data processor. You need a written agreement, which the supplier usually already offers in its terms. Ask yourself where the data ends up, too: transfers outside the European Union require specific safeguards.
6. Customers' rights
Anyone can ask to access their data and to have it corrected or erased. They must be able to do so by writing to a stated address. The reply must be given within one month. Put together a basic procedure: who receives the request and who deals with it.
7. Security and breaches
You must protect data with appropriate measures: updates, restricted access and backups. If a breach occurs that puts people at risk, it must be notified to the supervisory authority (in Italy, the Garante) within 72 hours of discovery. Keep a log of incidents, including those you don't notify.
8. Retention and deletion
Don't keep data indefinitely. Set retention periods (for example, tax data from orders for as long as the law requires, and inactive business contacts after a set period) and delete whatever has expired.
An annual check in six questions
- Is the list of processing activities up to date?
- Do the privacy notice and cookie policy match what the website actually does?
- Does the banner respect a refusal?
- Are the supplier agreements on file?
- Do we know what to do if there's a breach?
- Have you deleted what you no longer need?
Further reading: a compliant cookie banner · server-side tracking · mandatory information for an online shop
Frequently asked questions
How quickly must a data breach be notified?
To the supervisory authority (in Italy, the Garante) within 72 hours of becoming aware of it, if the breach poses a risk to people (Article 33 GDPR). Incidents that are not notified must still be recorded.
How quickly must you reply to a customer who asks for their data?
Within one month of the request, which can be extended in complex cases (Article 12 GDPR).
Is a cookie banner enough to be compliant?
No. You also need a privacy notice, documented marketing consent, agreements with suppliers, procedures for data subjects' rights, security measures and a list of processing activities.