GDPR and your business website: what you actually need to put in place

What GDPR covers on a brochure website

GDPR applies as soon as personal data is collected or processed, meaning any information that can identify a person: a name, an email address, a phone number, but also an IP address. A brochure site with no online shop is therefore covered from its first contact form, and often earlier, through its mere connection logs.

The regulation rests on a few constant principles: collect only what is necessary, say clearly what you do with the data, do not keep it forever, and let people exercise their rights, access, rectification, erasure. None of this requires a legal department.

For a typical brochure site, the touchpoints with GDPR can be counted on one hand: the form, cookies and trackers, the privacy policy, data hosting, and the third-party tools embedded in the pages. Each has its own section below.

The contact form and its notices

A contact form collects personal data: it must therefore come with clear information at the moment of collection. Who processes the data, for what purpose, how long it is kept, and how to exercise your rights. A sentence under the form, linking to the privacy policy, fulfils this obligation.

Replying to a contact request does not require a checkbox: the processing is justified by the person’s own initiative. A consent box becomes necessary when you want to do something else with the address, typically adding it to a newsletter. That consent must be a positive act, never a pre-ticked box.

The minimisation principle also applies to the form itself. Every field needs a reason to exist: asking for a birth date or a postal address for a simple enquiry means collecting data you do not need, and having to protect it for nothing.

Cookies and trackers: what needs consent

The rule is subtler than a banner for everyone. Trackers strictly necessary for the site to work, such as a session or basket cookie, are exempt from consent. Anything serving advertising, cross-site tracking or profiling requires prior consent, freely given and revocable.

Audience measurement sits in between. The CNIL accepts that an analytics tool configured to be strictly anonymous, with no cross-referencing or cross-site tracking, can be exempt from consent. Conversely, the standard measurement tools of the big advertising platforms fall into the consent-required category.

The practical consequence deserves stating: a sober brochure site, ad-free and with privacy-respecting analytics, can operate legally without a cookie banner. The banner is not a compliance talisman, it is the consequence of the tools you choose to embed.

The privacy policy

The privacy policy is where you keep GDPR’s transparency promise. It must be reachable from every page, usually in the footer, and written to be understood, not to impress. Legal text copied from another website, describing processing you do not do, is worse than no text at all: it is false.

Its content follows the reality of your site, nothing more. Who is responsible for processing, what data is collected and through which channels, for what purposes, for how long, who has access, and how to exercise your rights. If a point does not apply to you, it does not belong in the document.

• Identity and contact details of the data controller
• Data collected and how it is collected
• Purposes and legal basis of each processing activity
• Retention periods
• Recipients and processors, hosting provider included
• People’s rights and how to exercise them

Data hosting and where it happens

Your hosting provider is a processor under GDPR: it stores personal data on your behalf. The regulation requires a contract to frame that relationship; with serious providers, these commitments live in the terms or in a data processing agreement accepted at signup. Check that it exists, and name the provider in your privacy policy.

Location matters because GDPR regulates transfers outside the European Union. Hosting within the Union, or in a country recognised as offering adequate protection, keeps things simple: no transfer mechanism to document. Hosting with a provider under a third-country jurisdiction instead requires additional safeguards, and a mention of it.

The subject extends beyond the main server: fonts loaded from a third-party service, embedded videos and external scripts also send visit data away from you. We operate our own platforms in production, and that practice is what led us to serve fonts and scripts from our own infrastructure rather than calling third-party services on every visit.

The case of French-speaking Switzerland: nFADP and GDPR

Switzerland is not an EU member, but it has its own law, the new Federal Act on Data Protection, in force since 2023. The nFADP follows the spirit of GDPR, transparency, minimisation, individual rights, with its own arrangements, such as no general consent obligation for cookies, though information is still owed.

A business in French-speaking Switzerland can also fall under GDPR itself: the European regulation applies as soon as a website targets people located in the Union, for instance by explicitly addressing French or Belgian customers. Many export-oriented Swiss companies are therefore covered by both laws at once.

In practice, aiming for GDPR-level compliance covers most nFADP requirements. A site built cleanly for one satisfies the other with almost no extra effort, which simplifies life for businesses active on both sides of the border.

Frequent mistakes on small websites

The most visible is the cosmetic cookie banner: it displays, but trackers load before any choice, or refusing is buried while accepting is highlighted. Consent that is not real consent has no value, and the banner becomes evidence of the very problem it claims to solve.

Next comes the copy-pasted privacy policy, describing imaginary processing while ignoring the real kind. Or ghost collection: a signup form for a newsletter that no longer exists, contact messages kept for years without sorting, job application data lingering in a mailbox.

Basic security is the most serious blind spot. A site without HTTPS sends what visitors type into forms in the clear, and a never-updated CMS exposes the collected data. GDPR requires proportionate security measures: for a small site, encryption, updates and serious passwords are the foundation.

Getting compliant without rebuilding everything

Compliance for a brochure site almost never requires a rebuild. It starts with an honest inventory: what data enters the site, through which channels, where it goes, who sees it, how long it stays. On a small site, that inventory fits on one page and takes a single working session.

The inventory then dictates the actions, in a natural order. Removing collections and third-party tools you do not use is compliance gained without writing a word. Then adjust what remains: notices under the form, a truthful privacy policy, real consent where required, purging of old data.

• Inventory the data collected and the third-party tools present
• Remove unnecessary collection and trackers
• Add information notices under every form
• Write a privacy policy that matches reality
• Set up real consent if trackers require it
• Purge old data and secure access to the site