General Data Protection Regulation (GDPR)
The General Data Protection Regulation (GDPR) is the EU-wide regulation that governs when and how businesses may process personal data — from contact enquiries to customer files to website tracking.
Basic principle: every processing of personal data needs a legal basis. Art. 6(1) GDPR lists six — consent (a), contract or pre-contractual steps (b), legal obligation (c), vital interests (d), public task (e) and legitimate interests (f). At least one must apply.
Which basis fits depends on the purpose — and it must be determined before processing. Worth knowing: consent is only one of six equal legal bases and can be withdrawn at any time. So it is not automatically the best choice.
Violations can be costly: Art. 83 GDPR has two tiers — up to €10 million or 2% of worldwide annual turnover (e.g. for obligations around data processing on behalf) and up to €20 million or 4% (e.g. for the principles, legal bases and data subject rights), whichever is higher. The supervisory authority sets the actual amount case by case.
What to look out for
- For every processing on the website (forms, newsletter, analytics, chat) determine the appropriate legal basis under Art. 6 and name it in the privacy policy.
- Conclude a data processing agreement with every provider that processes data on your behalf — hosting, email delivery, CRM.
- Only request data that is genuinely needed for the purpose: review mandatory form fields critically.
- Clarify where services store their data — providers with servers in the EU simplify a lot.
- Keep the privacy policy up to date whenever a new tool, form or plugin is added.
Common mistakes
- The privacy policy comes from a generator and lists tools that are not used — or omits ones that are.
- Consent is collected for everything, even where another legal basis fits — and once withdrawn, no basis remains.
- No data processing agreement with hosting, newsletter or CRM providers.
- Contact form enquiries land unencrypted in private inboxes and are never deleted.
Frequently asked questions
No. Art. 6(1) GDPR lists six equal legal bases; at least one must apply. Consent can be withdrawn at any time — other bases such as contract or legitimate interests often fit better depending on the purpose.
Art. 83 GDPR provides for up to €10 million or 2%, or up to €20 million or 4% of worldwide annual turnover, depending on the type of violation and whichever is higher. The supervisory authority sets the actual amount case by case.
With every provider that processes personal data on your behalf and under your instructions — such as hosting, email or CRM providers. This is required by Art. 28(3) GDPR.
Legal basis: Art. 6(1) GDPR · Art. 28 GDPR · Art. 83(4) and (5) GDPR · As of