GDPR and your website: what a small business really has to comply with
Many freelancers think they are “too small” to be affected by the GDPR. Others, on the contrary, imagine they need a legally bulletproof website before they can launch. According to the guidance of the CNIL (the French data protection authority), the reality lies in between: a few simple obligations apply as soon as a website collects any data at all (a contact form is enough), and they don’t depend on the size of the business. Here is what concretely applies to a showcase website. This article is based on French practice and CNIL guidance.
No, being small doesn’t exempt you
The GDPR has no general exemption for small organisations: as soon as a website collects personal data (a name and an email in a contact form are enough), the rules apply, whether you are a sole trader or a large company. What changes with size are some stricter obligations (such as keeping a more detailed record), not the principle itself.
A contact form must inform, not just work
The CNIL recommends adding a notice at the bottom of every form explaining who receives the data, why, how long it is kept, and how visitors can exercise their rights. It isn’t a mere formality: it’s what makes the difference between a compliant form and one that isn’t.
Non-essential cookies require consent, not just a banner
A cookie banner isn’t enough if all it does is inform: for anything that isn’t strictly necessary for the website to work (audience measurement such as Google Analytics, social media buttons, embedded videos), the visitor’s consent must be obtained before the cookie is set, and refusing must be as easy as accepting.
The legal notice and privacy policy must be easy to find
Two separate pieces of information are expected: a legal notice identifying the website’s publisher, and a policy explaining how visitors’ data is handled. Both must be easy to find, not buried at the bottom of a menu.
Visitors must be able to exercise their rights
Access, correction, deletion: a simple channel (a dedicated email address or a form) must allow anyone to exercise these rights over the data you hold about them. There’s no need for a complex system, but the contact point must exist and requests must be dealt with.
The GDPR isn’t a box you tick once and for all: it’s a way of treating your visitors’ data as seriously as you’d expect yours to be treated.
What often gets overcomplicated
A DPO (data protection officer) is only mandatory in specific cases: public bodies, regular and large-scale monitoring of individuals, or large-scale processing of sensitive data. That isn’t the situation of a typical showcase website. Likewise, a very simple record of processing activities is enough in most cases for a small business. Every business has its own specifics: if you’re unsure about your situation, the CNIL publishes free practical guides, and a legal professional remains the right person to settle a particular case.
What I do on my side when I build a website: a form with a built-in information notice, a consent banner that actually works (not just for show), and an up-to-date legal notice and privacy policy, from day one.
